Alarm information processing method and device, equipment, storage medium and program product

Abstract

The invention discloses an alarm information processing method and device, equipment, a storage medium and a program product. Comprising the following steps: acquiring an alarm information data set comprising a plurality of alarm information; projecting each piece of alarm information to a plurality of preset dimensions to obtain a weight vector of each piece of alarm information; inputting the weight vector of each piece of alarm information into a preset alarm labeling model, and outputting to obtain an initial classification label of each piece of alarm information, the alarm labeling model being obtained by training a plurality of samples and labels of each sample; the multiple pieces of alarm information, the corresponding weight vectors and the initial classification labels serve as a training data set, a preset large language model is trained in combination with a preset first low-rank matrix and a preset second low-rank matrix, and an alarm noise reduction large language model is obtained; the ranks of the first low-rank matrix and the second low-rank matrix are far smaller than the dimension of a weight matrix of the large language model, the row number of the first low-rank matrix is the row number of the weight matrix, and the column number of the second low-rank matrix is the column number of the weight matrix.

Description

Technical Field

[0001] This application belongs to the field of data processing technology, and in particular relates to a method, apparatus, device, storage medium and program product for processing alarm information. Background Technology

[0002] In the fields of artificial intelligence technology and cybersecurity, alerts are proactive status prompts or risk notifications issued by the system based on preset rules, model analysis, or anomaly detection results. Their core function is to transform "system anomalies / potential risks" into signals that can be recognized by manual or automated processes, making them a crucial link in ensuring stable system operation and security protection. Existing technologies, such as rule-based noise reduction, can reduce the number of false alerts and improve the detection accuracy of real attacks by developing and optimizing rule sets. However, due to technological advancements leading to the continuous evolution of attack methods, a large number of security alerts are generated, placing enormous pressure on security teams for analysis and resulting in a large number of false positives. Rule-based noise reduction technology requires regular updates and maintenance of the rule set to adapt to new threats and behavioral patterns, resulting in high rule maintenance costs. Furthermore, rule-based technology may not cover all types of attacks, especially when facing unknown or novel attacks, limiting its applicability. Summary of the Invention

[0003] This application provides a method, apparatus, device, storage medium, and program product for processing alarm information, which can significantly reduce the parameter scale and computational overhead in the fine-tuning process, eliminate the need for maintenance of rule matching noise reduction technology, and is applicable to all types of attacks.

[0004] In a first aspect, embodiments of this application provide a method for processing alarm information, the method comprising: Obtain an alarm information dataset, wherein the alarm information dataset includes multiple alarm information; Each alarm message is projected onto multiple preset dimensions to obtain a weight vector for each alarm message; The weight vectors of each alarm message are input into a preset alarm labeling model, and the initial classification labels of each alarm message are output. The alarm labeling model is obtained by training a preset learning model with multiple samples and the labels of each sample. Multiple alarm messages, their corresponding weight vectors, and initial classification labels are used as training datasets. A preset large language model is trained using a first low-rank matrix and a second low-rank matrix to obtain an alarm denoising large language model. The ranks of the first low-rank matrix and the second low-rank matrix are much smaller than the dimension of the weight matrix of the large language model. The number of rows in the first low-rank matrix is ​​the same as the number of rows in the weight matrix, and the number of columns in the second low-rank matrix is ​​the same as the number of columns in the weight matrix.

[0005] Secondly, embodiments of this application provide an alarm information processing apparatus, the apparatus comprising: The first acquisition module is used to acquire an alarm information dataset, which includes multiple alarm information. The projection module is used to project each of the alarm messages onto multiple preset dimensions to obtain a weight vector for each of the alarm messages. The first labeling module is used to input the weight vector of each alarm information into a preset alarm labeling model and output the initial classification label of each alarm information. The alarm labeling model is obtained by training a preset learning model with multiple samples and the labels of each sample. The first training module is used to use multiple alarm messages, their corresponding weight vectors, and initial classification labels as training datasets, and to train a preset large language model by combining a preset first low-rank matrix and a preset second low-rank matrix to obtain an alarm noise reduction large language model. The ranks of the first low-rank matrix and the second low-rank matrix are much smaller than the dimension of the weight matrix of the large language model, and the number of rows in the first low-rank matrix is ​​the same as the number of rows in the weight matrix, and the number of columns in the second low-rank matrix is ​​the same as the number of columns in the weight matrix.

[0006] Thirdly, embodiments of this application provide an electronic device, the device including: a processor and a memory storing computer program instructions; the processor, when executing the computer program instructions, implements the alarm information processing method described in any of the above.

[0007] Fourthly, embodiments of this application provide a computer-readable storage medium storing computer program instructions, which, when executed by a processor, implement the alarm information processing method described in any of the above claims.

[0008] Fifthly, embodiments of this application provide a computer program product, wherein when the instructions in the computer program product are executed by the processor of an electronic device, the electronic device performs the alarm information processing method as described in any of the above claims.

[0009] The alarm information processing method, apparatus, device, storage medium, and program product of this application embodiment can project each alarm information in the alarm information dataset onto multiple preset dimensions to obtain the weight vector of each alarm information. Then, the weight vector of each alarm information is input into a preset alarm labeling model to output the initial classification label of each alarm information. The alarm labeling model is trained by multiple samples and the labels of each sample. Finally, multiple alarm information, the corresponding weight vector, and the initial classification label are used as training datasets, and combined with preset first low-rank matrices and second low-rank matrices, a preset large language model is trained to obtain an alarm noise reduction large language model. Thus, in this embodiment, the initial classification labels and weight vectors are used as weak supervision guides, and together with each alarm information, the large language model is fine-tuned through self-supervised clustering to obtain an alarm-denoised large language model. Since the self-supervised clustering fine-tuning of the large language model combines a first low-rank matrix and a second low-rank matrix, the ranks of which are much smaller than the dimension of the weight matrix of the large language model. Furthermore, the number of rows in the first low-rank matrix is ​​the same as the number of rows in the weight matrix, and the number of columns in the second low-rank matrix is ​​the same as the number of columns in the weight matrix. This not only significantly reduces the parameter scale and computational overhead during the fine-tuning process, but also eliminates the need for maintenance of rule-matching denoising techniques, and is applicable to all types of attacks. Attached Figure Description

[0010] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0011] Figure 1 This is a flowchart illustrating a method for processing alarm information provided in an embodiment of this application; Figure 2 This is a flowchart illustrating another alarm information processing method provided in an embodiment of this application; Figure 3 This is a schematic diagram of the LoRA clustering fine-tuning model structure provided in the embodiments of this application; Figure 4 This is a schematic diagram of the alarm information processing device provided in the embodiments of this application; Figure 5 This is a schematic diagram of the structure of the electronic device provided in the embodiments of this application. Detailed Implementation

[0012] The features and exemplary embodiments of various aspects of this application will be described in detail below. To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only intended to explain this application and not to limit it. For those skilled in the art, this application can be implemented without some of these specific details. The following description of the embodiments is merely to provide a better understanding of this application by illustrating examples.

[0013] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising..." does not exclude the presence of additional identical elements in the process, method, article, or apparatus that includes said element.

[0014] In the fields of artificial intelligence technology and cybersecurity, alerts are proactive status prompts or risk notifications issued by the system based on preset rules, model analysis, or anomaly detection results. Their core function is to transform "system anomalies / potential risks" into signals that can be recognized by manual or automated processes, making them a crucial link in ensuring stable system operation and security protection. Existing technologies, such as rule-based noise reduction, can reduce the number of false alerts and improve the detection accuracy of real attacks by developing and optimizing rule sets. However, due to technological advancements leading to the continuous evolution of attack methods, a large number of security alerts are generated, placing enormous pressure on security teams for analysis and resulting in a large number of false positives. Rule-based noise reduction technology requires regular updates and maintenance of the rule set to adapt to new threats and behavioral patterns, resulting in high rule maintenance costs. Furthermore, rule-based technology may not cover all types of attacks, especially when facing unknown or novel attacks, limiting its applicability.

[0015] The acquisition, storage, use, and processing of data in this application comply with relevant national laws and regulations. It should be noted that certain software, components, models, and other existing industry solutions may be mentioned in the embodiments of this application. These should be considered exemplary, intended only to illustrate the feasibility of implementing the technical solution of this application, and do not imply that the applicant has already used or necessarily used such solutions.

[0016] To address the problems of the prior art, embodiments of this application provide a method, apparatus, device, storage medium, and program product for processing alarm information. The method for processing alarm information provided in this application embodiment will be described first below.

[0017] Figure 1 A flowchart illustrating an embodiment of the alarm information processing method provided in this application is shown. Figure 1 As shown, a method for processing alarm information may include the following steps S101 to S104: S101. Obtain the alarm information dataset, which includes multiple alarm information; S102. Project each alarm message onto multiple preset dimensions to obtain the weight vector of each alarm message; S103. Input the weight vector of each alarm information into the preset alarm labeling model, and output the initial classification label of each alarm information. The alarm labeling model is obtained by training the preset learning model with multiple samples and the labels of each sample. S104. Using multiple alarm messages, their corresponding weight vectors, and initial classification labels as training datasets, and combining them with a preset first low-rank matrix and a preset second low-rank matrix, a preset large language model is trained to obtain an alarm noise reduction large language model. The ranks of the first low-rank matrix and the second low-rank matrix are much smaller than the dimension of the weight matrix of the large language model, and the number of rows in the first low-rank matrix is ​​the same as the number of rows in the weight matrix, and the number of columns in the second low-rank matrix is ​​the same as the number of columns in the weight matrix.

[0018] The alarm information processing method of this application embodiment can project each alarm information in the alarm information dataset onto multiple preset dimensions to obtain the weight vector of each alarm information. Then, the weight vector of each alarm information is input into a preset alarm labeling model to output the initial classification label of each alarm information. The alarm labeling model is trained by multiple samples and the labels of each sample. Finally, multiple alarm information, the corresponding weight vector, and the initial classification label are used as training datasets, and combined with preset first low-rank matrices and second low-rank matrices, a preset large language model is trained to obtain an alarm noise reduction large language model. Thus, in this embodiment, the initial classification labels and weight vectors are used as weak supervision guides, and together with each alarm information, the large language model is fine-tuned through self-supervised clustering to obtain an alarm-denoised large language model. Since the self-supervised clustering fine-tuning of the large language model combines a first low-rank matrix and a second low-rank matrix, the ranks of which are much smaller than the dimension of the weight matrix of the large language model. Furthermore, the number of rows in the first low-rank matrix is ​​the same as the number of rows in the weight matrix, and the number of columns in the second low-rank matrix is ​​the same as the number of columns in the weight matrix. This not only significantly reduces the parameter scale and computational overhead during the fine-tuning process, but also eliminates the need for maintenance of rule-matching denoising techniques, and is applicable to all types of attacks.

[0019] In S101, the aforementioned alarm information dataset can include multiple alarm messages. The alarm information dataset needs to ensure the authenticity of the alarm messages and maintain a balanced data ratio across four dimensions: attack time, attack intensity, attack region, and attack method. Regarding the attack time dimension, alarm information should be collected during periods such as network security operations, statutory holidays, and important meetings. To ensure data balance in the attack intensity dimension, alarm information at different intensity levels needs to be collected. Data on large-scale attacks (such as large-scale DDoS attacks with thousands or even tens of thousands of requests per second) should be collected, as well as data on small-scale, frequent probing attacks (such as malicious scans several times per minute). In terms of the attack region dimension, alarm information from different countries and regions should be collected geographically, which can be achieved by using IP address-based geographic location information. Attack events can be categorized in detail based on the attack method, such as network attacks (including DDoS attacks, port scanning, network sniffing, etc.), system attacks (such as malware intrusion, operating system vulnerability exploitation, etc.), and application attacks (such as SQL injection, cross-site scripting attacks, etc.). Each type of attack event can be further refined. In network attacks, attack methods under different protocols (TCP, UDP, etc.) can be distinguished; in system attacks, attack events on different operating system platforms (Windows, Linux, etc.) can be distinguished.

[0020] In some embodiments of this application, obtaining an alarm information dataset can, for example, involve collecting alarm data from multiple dimensions; cleaning the alarm data to obtain multiple alarm messages; the cleaning process includes checking and deleting duplicate alarm records, filling or deleting missing alarm data, converting the timestamps of the alarms to a uniform format, and extracting at least one of the following:

[0021] In S102, the aforementioned preset multiple dimensions can, for example, be four dimensions: attack time, attack popularity, attack area, and attack method. Of course, the multiple dimensions in this application are not limited to these, and can be set according to the user's actual needs, which are not specifically limited here.

[0022] In some embodiments of this application, each alarm message is projected onto multiple preset dimensions to obtain a weight vector for each alarm message. For example, each alarm message may be filled into a preset prompt template to generate a prompt word; the prompt word may be input into a general large model to obtain a weight vector of each alarm message projected onto multiple preset dimensions.

[0023] In S103, the aforementioned alarm labeling model can be obtained by training a preset learning model using multiple samples and the labels of each sample. For example, the alarm information dataset can be divided into a first training sample set and a second training sample set according to a preset ratio, where the number of alarm information in the first training sample set is greater than the number of alarm information in the second training sample set; each alarm information in the second training set is labeled to determine its label; the weight vectors of the multiple alarm information in the second training set are used as multiple samples, and the labels of each alarm information in the second training set are used as the labels of each sample, to train the learning model and obtain the alarm labeling model.

[0024] In some embodiments of this application, the weight vectors of each alarm message are input into a preset alarm labeling model, and the initial classification labels of each alarm message are output. For example, the weight vectors of each alarm message in a first training sample set can be input into the alarm labeling model, and the initial classification labels of each alarm message in the first training sample set can be output. The initial classification labels can, for example, be used to indicate that the alarm message is one of misjudgment, high risk, and low risk.

[0025] In S104, the ranks of the first low-rank matrix and the second low-rank matrix are much smaller than the dimension of the weight matrix of the large language model, and the number of rows of the first low-rank matrix is ​​the same as the number of rows of the weight matrix, and the number of columns of the second low-rank matrix is ​​the same as the number of columns of the weight matrix.

[0026] The large language model mentioned above, for example, can be the Large Language Model Meta AI (LLaMA). In this embodiment of the application, the large language model is not limited to this, and can be selected according to the actual needs of the user. As long as it is an open source large language model, it is acceptable. No specific limitation is made here.

[0027] In some embodiments of this application, multiple alarm messages, their corresponding weight vectors, and initial classification labels are used as training datasets. These datasets are then combined with a preset first low-rank matrix and a preset second low-rank matrix to train a preset large language model, thereby obtaining an alarm-denoised large language model. For example, multiple alarm messages, their corresponding weight vectors, and initial classification labels can be used as training datasets. These datasets are then combined with a preset first low-rank matrix and a preset second low-rank matrix to train the preset large language model. The loss function value of the large language model is calculated. If the loss function value is less than a preset threshold, the trained large language model is determined as the alarm-denoised large language model.

[0028] In some embodiments, S101 may specifically include: Collect alarm data from multiple dimensions; The alarm data is cleaned to obtain multiple alarm messages. The cleaning process includes checking and deleting duplicate alarm records, filling or deleting missing alarm data, converting the alarm timestamps to a uniform format, and extracting at least one of the following:

[0029] In some embodiments, the above-mentioned collection of alarm data from multiple dimensions can, for example, be carried out through an alarm platform.

[0030] The cleaning process described above may include checking and deleting duplicate alarm records, filling in or deleting missing alarm data, converting alarm timestamps to a uniform format, and extracting time features, among at least one of these.

[0031] Among these steps, checking and deleting duplicate alarm records involves removing redundant alarm records that are exactly the same or highly similar from the dataset to avoid duplicate data interfering with subsequent tasks such as alarm duration statistics and model training.

[0032] Imputing or deleting missing alarm data: Resolve issues related to missing alarm data fields (such as missing end time, signal strength values, etc.) to ensure the integrity and availability of each alarm record. Prioritize "imputation" (for non-critical fields and data with low missing rates), and secondarily "deletion" (for data with missing critical fields and high missing rates that are of no value) to avoid excessive deletion leading to insufficient sample size.

[0033] Convert alarm timestamps to a unified format: eliminate differences in timestamp formats reported by different devices and systems, and ensure comparability and calculability in the time dimension.

[0034] Extracting time features: Extracting time-dimensional features with business value from the unified format timestamps, such as date, day of the week, and time, to provide data support for subsequent "alarm-time period correlation analysis".

[0035] In some embodiments of this application, alarm data is cleaned to obtain multiple alarm messages. For example, multiple alarm data collected may be cleaned, including checking and deleting duplicate alarm records, filling or deleting missing alarm messages, converting the timestamps of the alarms into a unified format, and extracting time features such as date and time to obtain multiple alarm messages.

[0036] In this embodiment of the application, by collecting alarm data from multiple dimensions and performing cleaning processes including checking and deleting duplicate alarm records, filling or deleting missing alarm data, converting alarm timestamps to a unified format, and extracting time features, high-quality multiple alarm information can be obtained, which is convenient for subsequent data annotation and model training.

[0037] In some embodiments, the above-described S102 can specifically be Fill each alarm message into the preset prompt template to generate prompt words; Input the prompt words into the general large model to obtain the weight vector of each alarm information projected onto multiple preset dimensions.

[0038] The aforementioned general-purpose large models, for example, can be large models with deep reasoning capabilities such as Deepseek-r1 and Hunyuan. The core technology of deep thinking in such general-purpose large models is the thought chain technology, which draws inspiration from human thinking, breaks down complex problems into multiple simple steps, and gradually derives the final answer, making the answer more accurate and reliable, and the process clearer and more understandable.

[0039] In this embodiment, excessive raw features may contain redundant or noisy information. By filling each alarm message into a preset prompt template, prompt words are generated, and these prompt words are input into a general large model to obtain a weight vector of each alarm message projected onto multiple preset dimensions. This dimensionality reduction projection of the general large model based on the prompt template removes possible interference information, allowing the general large model to focus on key features and improve its generalization ability to new data. Furthermore, by carefully selecting the four dimensions of attack time, attack popularity, attack area, and attack event, the most representative and influential information can be extracted, providing clear and core feature basis for subsequent classification. When judging the degree of danger of an alarm, these four dimensions directly reflect the key elements of the attack, avoiding interference from other secondary features and making the model's decision more targeted. Compared to a large number of raw features, a 1×4 vector is easier to understand and interpret. Evaluating an alarm from four dimensions—attack time, attack popularity, attack area, and attack event—also conforms to the rules of manual alarm type judgment and has strong interpretability.

[0040] In some embodiments, the above-mentioned prompt template may include multiple dimensions, contextual example display, thought chain guidance, and mind tree; the contextual example display can be used to show multiple historical alarm information and the weight vector of historical alarm information as examples to enable the general large model to learn; the above-mentioned thought chain guidance can be used to interweave descriptions of the thought process of how to obtain the weight vector from historical alarm information in each example, guiding the general large model to understand the reasoning logic; the above-mentioned mind tree can be used to decompose the projection task into multiple sub-steps, reflect the logical relationship between the steps in the prompt words, and help the general large model complete the projection task in a more organized manner.

[0041] In this embodiment, since the prompt template can include multiple dimensions, contextual example display, thought chain guidance, and thought tree, it can guide the general large model to use its own semantic understanding ability and professional knowledge to project the alarm information onto four dimensions: attack time, attack popularity, attack area, and attack event, thereby obtaining the weight vector of each alarm information. Since the general large model can think deeply and decompose complex problems into multiple simple steps, it can gradually deduce the final answer, which not only makes the answer more accurate and reliable, but also makes the process clearer and more understandable, thus improving the user's service experience.

[0042] As one implementation of this application, in order to reduce the need for manually labeled data in the training of the alarm labeling model, the method may further include the following before S103: The alarm information dataset is divided into a first training sample set and a second training sample set according to a preset ratio. The number of alarm information in the first training sample set is greater than the number of alarm information in the second training sample set. Each alarm message in the second training set is labeled, and the label for each alarm message is determined. The weight vectors of multiple alarm messages in the second training set are used as multiple samples, and the labels of each alarm message in the second training set are used as the labels of each sample. The learning model is trained to obtain the alarm labeling model. Specifically, S103 mentioned above may include: The weight vectors of each alarm information in the first training sample set are input into the alarm labeling model, and the initial classification labels of each alarm information in the first training sample set are output.

[0043] The number of alarm messages in the first training sample set is greater than the number of alarm messages in the second training sample set.

[0044] In some embodiments of this application, multiple alarm messages in the alarm information dataset are divided according to a preset ratio to obtain a first training sample set and a second training sample set. For example, multiple alarm messages in the alarm information dataset may be divided into a training set and a test set according to a preset ratio of 7:3; wherein the training set is further divided according to a ratio of 9:1 to obtain a 90% first training sample set and a 10% second training sample set.

[0045] In some embodiments of this application, each alarm message in the second training set is labeled to determine the label of each alarm message. For example, the labels of each alarm message in the second training set can be determined manually by performing high-quality labeling.

[0046] The aforementioned learning model, exemplarily, can be a Kolmogorov-Arnold network model. The Kolmogorov-Arnold network model is built upon the Kolmogorov-Arnold theorem, which states that any multivariate continuous function can be precisely represented by a finite number of univariate continuous functions. This property allows the Kolmogorov-Arnold network model to theoretically and effectively approximate the complex relationship between the weight vector of the alarm information and the classification label. Of course, the learning model in this application is not limited to the aforementioned Kolmogorov-Arnold network model; other learning models can also be used, and no specific limitations are made here.

[0047] In this embodiment, a small alarm labeling model is trained using a small amount of labeled second training set. Although the amount of labeled second training set data is limited, the small alarm labeling model can still capture key classification information through careful design of network structure and training method. This can reduce the need for manual labeling data in the training of alarm labeling model and provide reliable initial classification labels for subsequent fine-tuning of large language model. It can serve as "weakly supervised" information for large language model, thereby helping large language model to better understand the relationship between the weight vector distribution of alarm information and the category in unsupervised fine-tuning.

[0048] In some embodiments, the network structure of the learning model described above may include an input layer, an intermediate layer, and an output layer. The intermediate layer may include multiple processing units, the connection method between the processing units, and an activation function. The number and level of the multiple processing units are such that the classification accuracy of the learning model is greater than a preset accuracy threshold, and the convergence of the loss function of the learning model satisfies a preset first condition.

[0049] The input layer described above has the same number of nodes as the dimension of the weight vector, namely 4 nodes, corresponding to the feature weights of attack time, attack popularity, attack region, and attack event dimensions, respectively. These 4 nodes take the weight vector as input, uniformly increasing the dimension to 4×1024, with 4 type labels. The similarity or distance of each type is calculated using a 1024-dimensional vector, preserving the model's separability in high-dimensional space and providing basic data for subsequent network layer processing. The reason for choosing an input dimension of 1024 usually involves a comprehensive consideration of several factors: 1. Hardware computational efficiency optimization: 1024 is 2^10, which meets the optimization requirements of modern GPU / TPU parallel computing architectures. 2. Effective utilization of computing resources: with a batch size of 32 and 1024 dimensions, the memory usage is approximately 4.2GB (FP16), which is exactly 1 / 6 of a mid-range graphics card (such as an RTX 3090 24GB), facilitating multi-tasking parallelism. 3. Historical and Traditional Factors: In the early stages of neural network development, some classic studies and models adopted a 1024-dimensional input dimension, such as pioneering work in image recognition and natural language processing. Subsequent researchers, building upon these classic models, often adopted similar dimensional settings, thus forming certain traditions and conventions. Over time, 1024-dimensional input has gradually become a generally accepted industry standard or common practice in some fields. New research and models, to facilitate comparison and integration with existing work, also tend to choose 1024 dimensions as the input dimension.

[0050] According to the Kolmogorov-Arnold theorem, the intermediate layer mentioned above needs to design a series of processing units to simulate univariate continuous functions and realize the composition operation of functions through specific connection methods.

[0051] The aforementioned intermediate layer may include multiple processing units, the connection methods between processing units, and activation functions. The number and hierarchy of the multiple processing units ensure that the classification accuracy of the learning model is greater than a preset accuracy threshold, and that the convergence of the loss function of the learning model satisfies a preset first condition.

[0052] Each processing unit is responsible for simulating a univariate continuous function. The choice of these univariate continuous functions is crucial to network performance. For example, common nonlinear functions such as the Gaussian function and variations of the exponential function can be chosen as the basic function form. Furthermore, to enhance the flexibility and adaptability of the function, each processing unit also contains a set of learnable parameters. Taking the Gaussian function as an example, its general form is... ,in , , These are learnable parameters that are adjusted through training so that the function can better fit the complex patterns in the alarm data.

[0053] The number and hierarchy of the aforementioned processing units can be determined through extensive experimentation. First, try setting 3-5 layers of processing units. In the first layer, 32 processing units can be set, each performing a different univariate function transformation on the input data. The second layer can have 16 processing units, which receive the output from the first layer and perform function transformations again to further extract data features. Subsequent layers follow the same pattern, and the number of processing units can be dynamically adjusted based on experimental results. During this process, observe the impact of different numbers and levels of processing units on model performance, including classification accuracy and the convergence of the loss function. Find the optimal configuration when the classification accuracy of the learning model exceeds a preset accuracy threshold and the convergence of the learning model's loss function meets a preset first condition. The first condition can be fast and oscillating convergence; however, this application's first condition is not limited to this and can be set according to the user's actual needs, without specific limitations here.

[0054] The connection methods between the aforementioned processing units determine the order and manner of function composition. One feasible connection method is full connection, where the output of each processing unit in the previous layer serves as the input to each processing unit in the next layer. This allows each processing unit to comprehensively consider the outputs of all units in the previous layer, enabling more complex function composition. Simultaneously, to avoid overfitting and reduce computational cost, sparse connection strategies can be introduced, such as randomly disconnecting some connections or determining connection relationships based on data correlation. During training, the connection weights are continuously adjusted to optimize the function composition effect.

[0055] The activation functions mentioned above are suitable for use among the processing units in the intermediate layers, such as the sigmoid or tanh functions, which can enhance the nonlinear expressive power of the network. These activation functions perform nonlinear transformations on the outputs of the processing units, enabling the network to learn more complex patterns.

[0056] The number of nodes in the output layer depends on the classification category. In some embodiments of this application, alarms can be divided into three categories: high-risk alarms, low-risk alarms, and false alarms, so the output layer has 3 nodes. The output layer uses the Softmax activation function, which transforms the output values ​​into a probability distribution for easier classification. Its mathematical expression is: in, It is the input vector. It is the number of categories. Indicates the first There are several categories.

[0057] In this embodiment, the training of the learning model is an intermediate step in the entire method. It connects the initial step of obtaining feature weight vectors using a general large model and the later step of unsupervised fine-tuning using a large language model to achieve the final alarm classification. Without the initial processing of the learning model, the large language model lacks effective guidance information when faced with a large amount of unlabeled alarm data, making it difficult to perform targeted fine-tuning. The alarm labeling model trained by the learning model provides necessary label information to the large language model through preliminary classification, making the entire method a coherent and organic whole. The output labels obtained through the alarm labeling model are similar to weak supervision by an "expert," with the large model providing crucial guidance information.

[0058] As another implementation of this application, in order to initialize and obtain the first low-rank matrix and the second low-rank matrix, before S104 above, the above method may further include: The elements in the preset first matrix and second matrix are randomly initialized, and the first low-rank matrix is ​​calculated from the first matrix and the second matrix. The elements in the preset third and fourth matrices are randomly initialized, and the second low-rank matrix is ​​calculated from the third and fourth matrices; The ranks of the first and second low-rank matrices are such that the feature retention rate of the alarm noise reduction large language model is greater than a preset retention rate threshold, and the ratio of the number of samples in the training dataset to the rank is greater than or equal to a preset fit ratio threshold.

[0059] In some embodiments of this application, the elements in a preset first matrix and a second matrix are randomly initialized, and the first low-rank matrix is ​​calculated from the first matrix and the second matrix. For example, it can be derived from a normal distribution. Mid-sampling, of which It is a small positive value, typically set between 0.01 and 0.1. Specifically, for a matrix... elements ,have For matrices elements ,have First low-rank matrix Represented as .

[0060] In some embodiments of this application, the elements in the preset third and fourth matrices are randomly initialized, and the second low-rank matrix is ​​calculated from the third and fourth matrices. For example, this can be done by... and The elements of the low-rank matrix also follow the same normal distribution initialization rule. Represented as B .

[0061] In some embodiments of this application, the ranks of the first low-rank matrix and the second low-rank matrix are such that the feature retention rate of the alarm denoising large language model is greater than a preset retention rate threshold, and the ratio of the number of samples in the training dataset to the rank is greater than or equal to a preset fit ratio threshold. For example, in practical applications, the ranks of the first low-rank matrix and the second low-rank matrix can be selected... This is a crucial step; improper selection can lead to performance degradation or overfitting. The choice depends on the following factors: Model complexity: For complex tasks, a larger [model] may be required. Values ​​to capture sufficient features; Data volume: In few-shot learning, a relatively small amount of data is required. Values ​​help prevent overfitting.

[0062] Continuous adjustments through experiments The value of is such that the feature retention rate of the large language model in alarm noise reduction is greater than the preset retention rate threshold, and the ratio of the number of samples to the rank of the training dataset is greater than or equal to the preset fit ratio threshold, in order to find the optimal setting.

[0063] In this embodiment of the application, in the scenario of initializing the matrix, a smaller first matrix is ​​initialized separately. Second matrix The third matrix and the fourth Indirectly initialize the first low-rank matrix Second low-rank matrix This approach helps maintain the low-rank structure of the matrix while effectively avoiding gradient vanishing or exploding problems, thereby accelerating model convergence and improving performance. Furthermore, the first low-rank matrix is ​​initialized using matrix decomposition. Second low-rank matrix Initialization is performed to provide suitable starting parameters for training large language models, ensuring efficient model convergence. It also has significant advantages in maintaining the structural properties of low-rank matrices, avoiding gradient problems, and accelerating convergence, thus enabling efficient fine-tuning of large-scale models.

[0064] In some embodiments, the above-described S104 may specifically include: Multiple alarm messages, their corresponding weight vectors, and initial classification labels are used as the training dataset. The preset large language model is trained by combining the preset first low-rank matrix and the preset second low-rank matrix. Calculate the loss function value of the large language model; If the loss function value is less than a preset threshold, the trained large language model will be identified as the alarm and noise reduction large language model.

[0065] In some embodiments of this application, multiple alarm messages, their corresponding weight vectors, and initial classification labels are used as a training dataset, and combined with a preset first low-rank matrix and a preset second low-rank matrix to train a preset large language model. For example, the first training sample set may be used as a training dataset. and the corresponding weight vector set Initial category tag set To perform the splicing and merging, soon , and original alarm data Plug and merge into data : in, Includes the initial classification results output by the alarm labeling model. The weight vector output by the projection model These two items serve as soft labels at the beginning of the merged vector, guiding subsequent clustering in the large language model. The reconstructed data, after being input into the large language model, is projected into a high-dimensional vector. This high-dimensional vector contains more information, making it easier for the large language model to uncover potential connections within the data.

[0066] The weight matrix of the above large language model is represented as follows: The original weight matrix of the LLaMA large language model is represented as follows: Its dimensions are ( × ),in The number of input features, The number of output features. The goal of low-rank adaptation is to optimize the weight matrix of the LLaMA large language model. Make adjustments to make it into +Δ The low-rank adaptation matrix Δ It is generated using low-rank matrices. Two low-rank matrices are defined. and , such that: Δ = , where the matrix The dimension is ( × ),matrix The dimension is ( × ), It is the rank of a low-rank matrix, much smaller than the rank of a low-rank matrix. and .

[0067] In some embodiments of this application, the above-described calculation of the loss function value of the large language model can, for example, be used to design a loss function to achieve self-supervised clustering fine-tuning, such that similar alarms have high similarity and different alarms have low similarity. Through iterative training, the large language model can mine the potential relationships between high-dimensional vectors and find the common connections between similar alarms. The loss function is as follows: in yes The feature vector of each alarm data point Indicates an alarm and alarm The similarity between them. Indicates an alarm And alarms of different categories The similarity between them. It's a hyperparameter, a boundary value used to control the threshold of similarity difference. As the similarity increases during training iterations... The vectors will become increasingly similar, below The vectors will move further and further away, and in this process, the parameters of the large language model are updated, completing the model training. (Add...) A higher value for the hyperparameter will result in the model having a higher requirement for similarity; only data with very high similarity will be clustered into the same class, thus leading to more refined classification. Specific hyperparameters can be selected in experiments.

[0068] In this embodiment of the application, through low-rank adaptive fine-tuning, the large language model only needs fine-tuning. × + × (r << , The number of parameters is much smaller than that of full-scale fine-tuning. × This method significantly reduces the hardware resource requirements for fine-tuning the large language model by eliminating the need for manual labeling of data. Furthermore, during self-supervised clustering fine-tuning, the data does not require manual labeling; instead, a soft label is added by the alarm labeling model as a guide. Although the accuracy of the alarm labeling model trained on a small sample size is not particularly high, and there are misclassified labels (e.g., high-risk alarms are misclassified as low-risk alarms), the initial training phase, due to the randomness of the low-rank matrix parameters, is heavily influenced by the soft labels and may result in the alarms being grouped with other misclassified alarms. As the large language model iterates, it continuously uncovers deep relationships within the high-dimensional vectors, eventually grouping alarms with similar alarms closer together in the vector space. This method greatly reduces resource and data labeling requirements, and the use of soft labels also significantly improves the interpretability of alarm denoising.

[0069] As another implementation of this application, in order to achieve the purpose of alarm noise reduction, after S104 above, the method may further include: Obtain multiple real-time alarm messages; Each real-time alarm message is filled into a preset prompt template and input into a general large model to obtain a weight vector of each real-time alarm message projected onto multiple preset dimensions. The prompt template includes multiple dimensions. The weight vectors of each real-time alarm information are input into the alarm denoising language model, and the alarm labels of each real-time alarm information are output.

[0070] The aforementioned alarm labels may include one of the following: false positive, high risk, and low risk. In some embodiments of this application, real-time alarm information with an alarm label of false positive is also ignored or filtered.

[0071] In this embodiment, during production, real-time alarm information can be dimensionality-reduced and projected onto a general large model based on a prompt template to obtain a weight vector, which is then input into an alarm noise reduction large language model. This model categorizes real-time alarm information into categories such as misjudgment, high-risk alarms, and low-risk alarms, while ignoring misjudged alarm information, thereby achieving the purpose of alarm noise reduction.

[0072] To facilitate understanding of the alarm information processing method in the embodiments of this application, the actual application process of this alarm information processing method is described as follows: The alarm information processing method provided in this application is divided into three stages: general large model dimensionality reduction projection based on prompt template (no training required), supervised fine-ranking training of small models (training with small sample labeled data), and self-supervised clustering fine-tuning of large models based on low-rank adaptation (LoRA) (using a trained fine-ranking small model (equivalent to the alarm labeling model mentioned above) to process a large amount of unlabeled data to generate soft labels and fine-tuning the large language model for self-supervised learning training). By training small models with small samples and fine-tuning large models through self-supervised clustering, resource consumption and labeled data requirements are reduced. By training small models in conjunction with large models, interpretability and alarm noise reduction accuracy are improved.

[0073] This method essentially transforms the alarm noise reduction task into a classification task. A preliminary classification result for an alarm is obtained by collaborating a general large model with a fine-tuned small model. This classification result serves as a soft label, providing weak supervision. This soft label is then concatenated with the original alarm information to obtain training data, which is used to fine-tune a large language model through self-supervised clustering. This training results in a dedicated alarm noise reduction large language model capable of multi-classifying alarms (equivalent to the alarm noise reduction large language model mentioned above). In production deployment, the alarm noise reduction large language model classifies real-time data into multiple categories such as false positives and high-risk alarms, ignoring false positives to achieve the goal of alarm noise reduction.

[0074] This application adopts the following... Figure 2 The process shown: Step 100: Small sample alarm data collection and preprocessing; Step 200: Dimensionality reduction projection of a general large model based on prompt templates; Step 300: Supervised fine-tuning training of the small model; Step 400: Self-supervised clustering fine-tuning of large language models based on LoRA.

[0075] Step 100: Alarm Data Collection and Preprocessing Collecting alert data through an alerting platform requires ensuring the authenticity of the data and maintaining a balanced data ratio across four dimensions: attack time, attack intensity, attack region, and attack method. Regarding attack time, alert data should be collected during periods such as cybersecurity operations, statutory holidays, and important meetings. To ensure data balance in terms of attack intensity, alert data at different intensity levels needs to be collected. This includes data on large-scale attacks (such as large-scale DDoS attacks with thousands or even tens of thousands of requests per second) as well as data on small-scale, frequent probing attacks (such as malicious scans several times per minute). In terms of attack region, alert data should be collected from different countries and regions, which can be achieved by using geographical location information based on IP addresses. Attack events can be categorized in detail based on the attack method, such as network attacks (including DDoS attacks, port scanning, network sniffing, etc.), system attacks (such as malware intrusion, operating system vulnerability exploitation, etc.), and application attacks (such as SQL injection, cross-site scripting attacks, etc.). Each type of attack event can be further refined. In network attacks, attack methods under different protocols (TCP, UDP, etc.) can be distinguished; in system attacks, attack events on different operating system platforms (Windows, Linux, etc.) can be distinguished.

[0076] The collected data needs to be cleaned, including checking and deleting duplicate alarm records, filling in or deleting missing alarm data, converting alarm timestamps to a uniform format, and extracting features such as date and time. The collected and processed dataset is then shuffled and split into training and testing sets in a 7:3 ratio. In the training set, 10% is used in step 300, requiring high-quality data annotation. The remaining 90% of unlabeled data is used in step 400.

[0077] Step 200: Dimensionality Reduction Projection of a General Large Model Based on Prompt Templates By constructing prompt templates to guide a general-purpose large model, and leveraging the model's semantic understanding capabilities and expertise, multi-feature alert information is projected onto four dimensions: attack time, attack popularity, attack area, and attack event. This requires the use of large models with deep reasoning capabilities, such as Deepseek-r1 and Hunyuan. The core technology of this type of general-purpose large model's deep thinking is the thought chain technique, which draws inspiration from human thought processes to break down complex problems into multiple simple steps, gradually deriving the final answer, making the answer more accurate and reliable, and the process clearer and more understandable.

[0078] The core of prompt templates is to pass input data and task objectives to a large language model in the form of natural language. In prompt word engineering, context-learning, CoT, and ToT can be combined to design prompt word templates. The key components are as follows: 1) Context-learning: Provides multiple representative alarm messages (equivalent to the historical alarm messages mentioned above) and corresponding projection result examples, allowing the model to learn task patterns through examples.

[0079] 2) Chain of Thought (CoT): The examples are interspersed with descriptions of the thought process of how to derive the projection result from the alarm information, guiding the model to understand the reasoning logic.

[0080] 3) Tree of Thought (ToT): Decomposes the projection task into multiple sub-steps and reflects the logical relationship between the steps in the prompts, helping the model to complete the task in a more organized manner.

[0081] Based on the above principles, the following is an example of a prompt word template: Excessive raw features may contain redundant or noisy information. Dimensionality reduction removes potential interference, allowing the model to focus on key features and improve its generalization ability to new data. By carefully selecting four dimensions—attack time, attack popularity, attack region, and attack event—the most representative and influential information can be extracted, providing clear and core feature basis for subsequent classification. When judging the severity of an alert, these four dimensions directly reflect the key elements of the attack, avoiding interference from other secondary features and making the model's decisions more targeted. Compared to a large number of raw features, a 1×4 vector is easier to understand and interpret. Evaluating an alert from four dimensions—attack time, attack popularity, attack region, and attack event—also aligns with the patterns of manual alert type judgment and has strong interpretability.

[0082] Step 300: Supervised fine-tuning training of the small model In the entire process, the small model fine-tuning takes over the feature weight vectors generated by the large model in the first step. Based on these features, it performs preliminary classification of alarms, dividing them into three categories: false positives, low-risk, and high-risk. This process is like setting up a preliminary screening checkpoint in massive alarm information, which can quickly distinguish obvious false alarms from alarms with different levels of danger, laying the foundation for subsequent processing. This module unifies the alarm vectors to 4×1024 dimensions, with 4 type labels. The similarity or distance of each type's 1024-dimensional vector is calculated, preserving the model's separability in high-dimensional space.

[0083] This method trains a small model using a limited amount of labeled data. Despite the limited amount of labeled data, through careful design of the network structure and training method, the small model can still capture key classification information, providing reliable soft labels for subsequent fine-tuning of the large model. The output of the small model's ranking is an important basis for the large model's LoRA fine-tuning, providing "weakly supervised" information and helping the large model better understand the distribution and category characteristics of alarm data during unsupervised fine-tuning.

[0084] This method considers replacing the original multilayer perceptron with a Kolmogorov-Arnold network. The Kolmogorov-Arnold network is built upon the Kolmogorov-Arnold theorem, which states that any multivariate continuous function can be accurately represented by a finite number of univariate continuous functions. This property allows the Kolmogorov-Arnold network to theoretically and effectively approximate the complex relationship between alarm features and classification labels.

[0085] The Kolmogorov-Arnold network structure is constructed as follows: Input Layer: The number of nodes in the input layer is the same as the feature vector dimension obtained in the first step, i.e., 4 nodes, corresponding to the feature weights of the four dimensions of attack time, attack popularity, attack region, and attack event, respectively (see step 100 for details). These 4 nodes take the weight vector obtained by dimensionality reduction projection of the large model as input, providing basic data for subsequent network layer processing. The reason for choosing an input dimension of 1024 usually involves a comprehensive consideration of several factors: 1. Hardware computation efficiency optimization. 1024 is 2^10, which meets the optimization requirements of modern GPU / TPU parallel computing architecture. 2. Effective utilization of computing resources. When the batch size is 32 for 1024 dimensions, the memory usage is about 4.2GB (FP16), which is exactly 1 / 6 of the memory of a mid-range graphics card (such as RTX 3090 24GB), facilitating multi-task parallelism. 3. Historical and traditional factors. In the early stages of neural network development, some classic research and models adopted an input dimension of 1024 dimensions, such as some pioneering works in image recognition, natural language processing, and other fields. Subsequent researchers, drawing on these classic models, have often adopted similar dimensional settings, thus forming certain traditions and conventions. Over time, 1024-dimensional input has gradually become a default industry standard or common practice in some fields. New research and models, in order to facilitate comparison and connection with existing work, also tend to choose 1024 dimensions as the input dimension.

[0086] Intermediate layer: According to the Kolmogorov-Arnold theorem, the intermediate layer needs to design a series of processing units to simulate univariate continuous functions and realize the composition operation of functions through specific connection methods.

[0087] Processing Unit Design: The intermediate layer consists of multiple processing units, each responsible for simulating a univariate continuous function. The choice of these univariate continuous functions is crucial to network performance. For example, common nonlinear functions such as the Gaussian function and variations of the exponential function can be chosen as the basic function form. Furthermore, to enhance the flexibility and adaptability of the function, each processing unit also contains a set of learnable parameters. Taking the Gaussian function as an example, its general form is... , in , , These are learnable parameters that are adjusted through training so that the function can better fit the complex patterns in the alarm data.

[0088] Number and Hierarchy of Processing Units: The number and hierarchy of processing units were determined through extensive experiments. First, 3-5 layers of processing units were experimented with. In the first layer, 32 processing units were used, each performing a different univariate function transformation on the input data. The second layer could have 16 processing units, which received the output from the first layer and performed another function transformation to further extract data features. Subsequent layers followed the same pattern, and the number of processing units could be dynamically adjusted based on experimental results. Throughout this process, the impact of different numbers and levels of processing units on model performance was observed, including classification accuracy and the convergence of the loss function, to find the optimal configuration.

[0089] Connection Method: The connection method between processing units determines the order and manner of function composition. One feasible connection method is full connection, where the output of each processing unit in the previous layer serves as the input to each processing unit in the next layer. This allows each processing unit to comprehensively consider the outputs of all units in the previous layer, enabling more complex function composition. Simultaneously, to avoid overfitting and reduce computational cost, sparse connection strategies can be introduced, such as randomly disconnecting some connections or determining connection relationships based on data correlation. During training, the connection weights are continuously adjusted to optimize the function composition effect.

[0090] Activation functions: Appropriate activation functions, such as the sigmoid or tanh functions, are used between processing units in the intermediate layers to enhance the network's nonlinear expressive power. These activation functions perform nonlinear transformations on the outputs of the processing units, enabling the network to learn more complex patterns.

[0091] Output Layer: The number of nodes in the output layer depends on the classification category. We classify alarms into three categories: high-risk alarms, low-risk alarms, and false positives, so the output layer has 3 nodes. The output layer uses the Softmax activation function, which transforms the output values ​​into a probability distribution, facilitating classification. Its mathematical expression is: in It is the input vector. It is the number of categories. Indicates the first There are several categories.

[0092] The small model fine-tuning is located in the middle of the entire method. It connects the earlier step of obtaining feature weights using the large model and the later step of unsupervised fine-tuning using the large model to achieve the final alarm classification. Without the preliminary processing of the small model fine-tuning, the large model lacks effective guidance information when faced with a large amount of unlabeled alarm data, making it difficult to perform targeted fine-tuning. The small model, through preliminary classification, provides the necessary label information for the large model, making the entire method a coherent and organic whole. The output labels are obtained after the small model. Similar to weak supervision by an "expert," the large model provides crucial guiding information.

[0093] Step 400: Fine-tuning of large-scale model self-supervised clustering based on LoRA Direct fine-tuning of large language models presents two challenges: 1. High computational resource requirements. Direct fine-tuning of large language models places extremely high demands on hardware resources, such as GPUs. 2. High data requirements. Large language models have massive numbers of parameters and require a large amount of high-quality labeled datasets for training; otherwise, overfitting will occur, affecting generalization ability. This application employs self-supervised clustering fine-tuning of large models based on Low Rank Adaptation (LoRA). By introducing LoRA, the amount of parameter updates during the fine-tuning process is significantly reduced, thereby improving training efficiency and reducing computational resource requirements. Self-supervised clustering fine-tuning avoids the need for extensive data labeling, using only the results of the small model output in step 300 as soft labels for guidance. Specifically, it can be divided into the following two steps: Step 401: Data Reconstruction and Vectorization The 90% unlabeled dataset prepared in step 100 After step 200, the weight vector is obtained, and then after step 300, the finely ranked small model is trained to obtain the label set. and weight vector set ,Will , and original alarm data Plug and merge into data : in Includes the classification results output by the finely ranked small model. The weight vector output by the projection model These two items serve as soft labels at the beginning of the vector, which guide subsequent clustering in large language models.

[0094] After the reconstructed data is input into the large language model, it will be projected into a high-dimensional vector. The high-dimensional vector has more information in more dimensions, making it easier for the large language model to discover the potential relationships within the data.

[0095] Step 402: LoRA Clustering Fine-tuning The alarm noise reduction task is a classification task. The Large Language Model MetaAI (LLaMA) is selected. For the LLaMA model, a LoRA module is inserted into a fully connected layer to achieve low-rank adaptation of the weights. The specific steps are as follows: a. Representation of the weight matrix: like Figure 3 As shown, the original weight matrix of the LLaMA large model is represented as follows: Its dimensions are ( × ),in The number of input features, The number of output features. The goal of LoRA is to optimize the weight matrix of a large LLaMA model. Make adjustments to make it into +Δ The low-rank adaptation matrix Δ It is generated using low-rank matrices. Two low-rank matrices are defined. and , such that: Δ = , where the matrix The dimension is ( × ),matrix The dimension is ( × ), It is the rank of a low-rank matrix, much smaller than the rank of a low-rank matrix. and .

[0096] b. Initialization of the low-rank matrix 1) Parameter initialization For low-rank matrices and Initialization is performed to provide suitable starting parameters for model training, ensuring efficient model convergence and preserving the structural properties of the low-rank matrix for efficient fine-tuning of large-scale models. The low-rank matrix... Represented as low-rank matrix Represented as B By initializing smaller matrices separately. , , and Indirect initialization and This approach helps maintain the low-rank structure of the matrix while effectively avoiding gradient vanishing or exploding problems, thereby accelerating model convergence and improving performance.

[0097] For matrix , , and The elements can be initialized randomly. For example, from a normal distribution. Mid-sampling, of which It is a small positive value, typically set between 0.01 and 0.1. Specifically, for a matrix... elements ,have For matrices elements ,have Similarly, for a matrix and The elements also follow the same normal distribution initialization rule. This provides the model with a relatively broad search space for initial parameters, helping the model explore different parameter combinations during training.

[0098] In the context of initializing matrices, using matrix decomposition for initialization offers significant advantages in maintaining low-rank structure, avoiding gradient problems, and accelerating convergence.

[0099] 2) Determine the lower rank In practical applications, choosing the rank of a low-rank matrix is ​​a crucial step. An inappropriate choice can lead to performance degradation or overfitting. The choice depends on the following factors: Model complexity: For complex tasks, a larger [model] may be required. Values ​​are needed to capture sufficient features.

[0100] Data volume: In few-shot learning, a relatively small amount of data is required. Values ​​help prevent overfitting.

[0101] Experimental verification: Through continuous adjustments in experiments The value is used to find the optimal setting.

[0102] c. Fine-tuning self-supervised clustering based on LoRA To achieve self-supervised clustering fine-tuning, a loss function needs to be designed to ensure high similarity between similar alarms and low similarity between different alarms. Through iterative training, the large language model mines the latent relationships between high-dimensional vectors to find commonalities among similar alarms. The loss function is as follows: in yes The feature vector of each alarm data point Indicates an alarm and alarm The similarity between them. Indicates an alarm And alarms of different categories The similarity between them. It's a hyperparameter, a boundary value used to control the threshold of similarity difference. As the similarity increases during training iterations... The vectors will become increasingly similar, below The vectors will move further and further away, and in this process, the parameters of the large language model are updated, completing the model training. (Add...) A higher value for the hyperparameter will result in the model having a higher requirement for similarity; only data with very high similarity will be clustered into the same class, thus leading to more refined classification. Specific hyperparameters can be selected in experiments.

[0103] With LoRA fine-tuning, large language models only require minor adjustments. × + × (r << , The number of parameters is much smaller than that of full-scale fine-tuning. × The reduced number of parameters significantly decreases the hardware resource requirements for fine-tuning large language models. During self-supervised clustering fine-tuning, data does not require manual labeling; only soft labels are added to the data in step 300 as guidance. Although the accuracy of small-sample trained, finely ranked models is not particularly high, There are misclassified labels (e.g., high-risk alarms are misclassified as low-risk alarms). Initially, during training, the parameters of the low-rank matrix were random. Significantly influenced by soft labels, it may be categorized together with misclassified labels. As large models iterate, they continuously uncover deeper relationships within high-dimensional vectors. Eventually, alarms of the same type will become increasingly closer in distance to each other in the vector space and be classified into the same category. This method greatly reduces resource and data labeling requirements, and the use of soft labels can also significantly improve the interpretability of alarm denoising.

[0104] In this embodiment of the application, a method for processing alarm information specifically includes the following three stages: 1. Dimensionality Reduction Projection of a General Large Model Based on Prompt Templates: The alarm data is dimensionality reduced by projecting a general large model to extract high-dimensional features, providing a high-quality input representation for subsequent training.

[0105] 2. Supervised Fine-Tuning Training of a Small Model: A lightweight fine-tuning model is trained based on a small amount of labeled data to generate soft labels. These soft labels serve as supervisory signals for fine-tuning the larger model, effectively alleviating the problem of insufficient labeled data.

[0106] 3. Self-supervised clustering fine-tuning of large models based on LoRA: Soft labels generated by finely ranked small models are combined with Low-Rank Adaptation (LoRA) technology to perform self-supervised clustering fine-tuning of large models. LoRA technology significantly reduces the parameter size and computational cost during the fine-tuning process through low-rank matrix factorization.

[0107] Compared with existing technologies, this application has the following advantages: 1. Excellent noise reduction effect: Through collaborative training of large and small models and self-supervised learning, the accuracy of alarm noise reduction is significantly improved.

[0108] 2. High interpretability: The design based on prompt templates and soft labels enhances the interpretability of the model.

[0109] 3. Low data requirements: Only a small amount of labeled data is needed to train a high-performance model, reducing the cost of data collection and labeling.

[0110] 4. Low resource overhead: Through LoRA technology and large model dimensionality reduction projection, the computational resources and storage requirements are significantly reduced.

[0111] In summary, this application addresses the pain points of existing alarm noise reduction technologies through an innovative multi-stage self-supervised learning framework, providing a high-efficiency, low-cost, and highly interpretable solution for vertical industries.

[0112] Based on the alarm information processing method provided in the above embodiments, this application also provides specific implementations of the alarm information processing apparatus. Please refer to the following embodiments.

[0113] like Figure 4 As shown, the alarm information processing device 400 provided in this application embodiment may include the following modules: a first acquisition module 401, a projection module 402, a first annotation module 403, and a first training module 404.

[0114] The first acquisition module 401 is used to acquire an alarm information dataset, which includes multiple alarm information. Projection module 402 is used to project each alarm information onto multiple preset dimensions to obtain a weight vector of each alarm information. The first labeling module 403 is used to input the weight vector of each alarm information into the preset alarm labeling model and output the initial classification label of each alarm information. The alarm labeling model is obtained by training the preset learning model with multiple samples and the labels of each sample. The first training module 404 is used to take multiple alarm information and corresponding weight vectors and initial classification labels as training datasets, and combine them with preset first low-rank matrices and second low-rank matrices to train a preset large language model to obtain an alarm noise reduction large language model. The ranks of the first low-rank matrix and the second low-rank matrix are much smaller than the dimension of the weight matrix of the large language model, and the number of rows of the first low-rank matrix is ​​the same as the number of rows of the weight matrix, and the number of columns of the second low-rank matrix is ​​the same as the number of columns of the weight matrix.

[0115] The alarm information processing apparatus of this application embodiment can project each alarm information in the alarm information dataset onto multiple preset dimensions to obtain the weight vector of each alarm information. Then, the weight vector of each alarm information is input into a preset alarm labeling model, and the initial classification label of each alarm information is output. The alarm labeling model is trained by multiple samples and the labels of each sample. Finally, multiple alarm information, the corresponding weight vector, and the initial classification label are used as training datasets, and combined with preset first low-rank matrices and second low-rank matrices, a preset large language model is trained to obtain an alarm noise reduction large language model. Thus, in this embodiment, the initial classification labels and weight vectors are used as weak supervision guides, and together with each alarm information, the large language model is fine-tuned through self-supervised clustering to obtain an alarm-denoised large language model. Since the self-supervised clustering fine-tuning of the large language model combines a first low-rank matrix and a second low-rank matrix, the ranks of which are much smaller than the dimension of the weight matrix of the large language model. Furthermore, the number of rows in the first low-rank matrix is ​​the same as the number of rows in the weight matrix, and the number of columns in the second low-rank matrix is ​​the same as the number of columns in the weight matrix. This not only significantly reduces the parameter scale and computational overhead during the fine-tuning process, but also eliminates the need for maintenance of rule-matching denoising techniques, and is applicable to all types of attacks.

[0116] In some embodiments, the first acquisition module 401 described above may specifically include: The data acquisition unit is used to collect alarm data from multiple dimensions. The cleaning unit is used to clean the alarm data to obtain multiple alarm messages. The cleaning process includes checking and deleting duplicate alarm records, filling or deleting missing alarm data, converting the alarm timestamps to a unified format, and extracting at least one of the following:

[0117] In some embodiments, the projection module 402 described above may specifically include: The generation unit is used to fill each alarm message into a preset prompt template and generate prompt words; The projection unit is used to input the prompt words into the general large model and obtain the weight vector of each alarm information projected onto multiple preset dimensions.

[0118] In some embodiments, the above-mentioned prompt template may include multiple dimensions, contextual example display, thought chain guidance, and mind tree; the contextual example display can be used to show multiple historical alarm information and the weight vector of historical alarm information as examples to enable the general large model to learn; the above-mentioned thought chain guidance can be used to interweave descriptions of the thought process of how to obtain the weight vector from historical alarm information in each example, guiding the general large model to understand the reasoning logic; the above-mentioned mind tree can be used to decompose the projection task into multiple sub-steps, reflect the logical relationship between the steps in the prompt words, and help the general large model complete the projection task in a more organized manner.

[0119] As one implementation of this application, in order to reduce the need for manually labeled data in the training of the alarm labeling model, the above-mentioned device 400 may further include: The segmentation module is used to segment multiple alarm messages in the alarm information dataset according to a preset ratio to obtain a first training sample set and a second training sample set. The number of alarm messages in the first training sample set is greater than the number of alarm messages in the second training sample set. The second annotation module is used to annotate each alarm message in the second training set and determine the label of each alarm message. The first training module is used to train the learning model by taking the weight vectors of multiple alarm information in the second training set as multiple samples and the labels of each alarm information in the second training set as the labels of each sample, and obtaining the alarm labeling model. The first annotation module 403 is specifically used to input the weight vector of each alarm information in the first training sample set into the alarm annotation model and output the initial classification label of each alarm information in the first training sample set.

[0120] In some embodiments, the network structure of the learning model may include an input layer, an intermediate layer, and an output layer. The intermediate layer may include multiple processing units, the connection method between the processing units, and an activation function. The number and level of the multiple processing units are such that the classification accuracy of the learning model is greater than a preset accuracy threshold, and the convergence of the loss function of the learning model satisfies a preset first condition.

[0121] As another implementation of this application, in order to initialize and obtain the first low-rank matrix and the second low-rank matrix, the above-mentioned device 400 may further include: The initialization module is used to randomly initialize the elements in the preset first matrix and second matrix. The first low-rank matrix is ​​calculated from the first matrix and the second matrix. The aforementioned initialization module is also used to randomly initialize the elements in the preset third and fourth matrices, and the second low-rank matrix is ​​calculated from the third and fourth matrices; The ranks of the first and second low-rank matrices mentioned above ensure that the feature retention rate of the alarm noise reduction large language model is greater than the preset retention rate threshold, and that the ratio of the number of samples in the training dataset to the rank is greater than or equal to the preset fit ratio threshold.

[0122] In some embodiments, the first training module 404 described above may specifically include: The training unit is used to train a pre-defined large language model by taking multiple alarm messages, their corresponding weight vectors, and initial classification labels as the training dataset, and combining them with a pre-defined first low-rank matrix and a pre-defined second low-rank matrix. The computational unit is used to calculate the loss function value of the large language model; The determination unit is used to determine the trained large language model as the alarm and noise reduction large language model when the loss function value is less than a preset threshold.

[0123] As another implementation of this application, in order to achieve the purpose of alarm noise reduction, the above-mentioned device 400 may further include: The second acquisition module is used to acquire multiple real-time alarm information; The projection module 402 described above is also used to fill each real-time alarm information into a preset prompt template and input it into a general large model to obtain the weight vector of each real-time alarm information projected onto multiple preset dimensions. The prompt template includes multiple dimensions. The noise reduction module is used to input the weight vectors of each real-time alarm information into the alarm noise reduction language model and output the alarm labels of each real-time alarm information.

[0124] Figure 5 A schematic diagram of the hardware structure of the electronic device provided in an embodiment of this application is shown.

[0125] An electronic device may include a processor 501 and a memory 502 storing computer program instructions.

[0126] Specifically, the processor 501 may include a central processing unit (CPU), an application-specific integrated circuit (ASIC), or one or more integrated circuits that can be configured to implement the embodiments of this application.

[0127] Memory 502 may include mass storage for data or instructions. For example, and not limitingly, memory 502 may include a hard disk drive (HDD), floppy disk drive, flash memory, optical disk, magneto-optical disk, magnetic tape, or Universal Serial Bus (USB) drive, or a combination of two or more of these. Where appropriate, memory 502 may include removable or non-removable (or fixed) media. Where appropriate, memory 502 may be internal or external to the integrated gateway disaster recovery device. In a particular embodiment, memory 502 is non-volatile solid-state memory.

[0128] In a particular embodiment, memory 502 may include read-only memory (ROM), random access memory (RAM), disk storage media device, optical storage media device, flash memory device, electrical, optical, or other physical / tangible memory storage device. Thus, generally, memory includes one or more tangible (non-transitory) computer-readable storage media (e.g., memory devices) encoded with software including computer-executable instructions, and when the software is executed (e.g., by one or more processors), it is operable to perform the operations described with reference to the method according to one aspect of this disclosure.

[0129] The processor 501 reads and executes computer program instructions stored in the memory 502 to implement any of the alarm information processing methods in the above embodiments.

[0130] In one example, the electronic device may also include a communication interface 503 and a bus 510. Wherein, as... Figure 5 As shown, the processor 501, memory 502, and communication interface 503 are connected through bus 510 and complete communication with each other.

[0131] The communication interface 503 is mainly used to realize communication between various modules, devices, units and / or equipment in the embodiments of this application.

[0132] Bus 510 includes hardware, software, or both, that couples components of an electronic device together. For example, and not limitingly, the bus may include an Accelerated Graphics Port (AGP) or other graphics bus, an Enhanced Industry Standard Architecture (EISA) bus, a Front Side Bus (FSB), HyperTransport (HT) interconnect, an Industry Standard Architecture (ISA) bus, an Infinite Bandwidth Interconnect, a Low Pin Count (LPC) bus, a memory bus, a Microchannel Architecture (MCA) bus, a Peripheral Component Interconnect (PCI) bus, a PCI-Express (PCI-X) bus, a Serial Advanced Technology Attachment (SATA) bus, a Video Electronics Standards Association Local (VLB) bus, or other suitable buses, or combinations of two or more of these. Where appropriate, bus 510 may include one or more buses. Although specific buses are described and illustrated in embodiments of this application, this application contemplates any suitable bus or interconnect.

[0133] The electronic device can execute the alarm information processing method in the embodiments of this application, thereby achieving the combination of Figure 1 and Figure 4 The method and apparatus for processing alarm information are described.

[0134] Furthermore, in conjunction with the alarm information processing methods in the above embodiments, this application embodiment can provide a computer-readable storage medium for implementation. This computer-readable storage medium stores computer program instructions; when these computer program instructions are executed by a processor, they implement any of the alarm information processing methods in the above embodiments.

[0135] This application also provides a computer program product, including a computer program, which, when executed by a processor, implements any of the alarm information processing methods in the above embodiments.

[0136] It should be clarified that this application is not limited to the specific configurations and processes described above and shown in the figures. For the sake of brevity, detailed descriptions of known methods are omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of this application is not limited to the specific steps described and shown. Those skilled in the art can make various changes, modifications, and additions, or change the order of steps, after understanding the spirit of this application.

[0137] The functional blocks shown in the above-described structural diagram can be implemented as hardware, software, firmware, or a combination thereof. When implemented in hardware, they can be, for example, electronic circuits, application-specific integrated circuits (ASICs), appropriate firmware, plug-ins, function cards, etc. When implemented in software, the elements of this application are programs or code segments used to perform the required tasks. Programs or code segments can be stored on a machine-readable medium or transmitted over a transmission medium or communication link via data signals carried on a carrier wave. "Machine-readable medium" can include any medium capable of storing or transmitting information. Examples of machine-readable media include electronic circuits, semiconductor memory devices, ROM, flash memory, erasable ROM (EROM), floppy disks, CD-ROMs, optical disks, hard disks, fiber optic media, radio frequency (RF) links, etc. Code segments can be downloaded via computer networks such as the Internet, intranets, etc.

[0138] It should also be noted that the exemplary embodiments mentioned in this application describe methods or systems based on a series of steps or apparatus. However, this application is not limited to the order of the above steps; that is, the steps can be performed in the order mentioned in the embodiments, or in a different order, or several steps can be performed simultaneously.

[0139] The aspects of this disclosure have been described above with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this disclosure. It should be understood that each block in the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to produce a machine such that these instructions, executable via the processor of the computer or other programmable data processing apparatus, enable the implementation of the functions / actions specified in one or more blocks of the flowchart illustrations and / or block diagrams. Such a processor can be, but is not limited to, a general-purpose processor, a special-purpose processor, a special application processor, or a field-programmable logic circuit. It is also understood that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can also be implemented by special-purpose hardware performing the specified functions or actions, or can be implemented by a combination of special-purpose hardware and computer instructions.

[0140] The above description is merely a specific implementation of this application. Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, modules, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here. It should be understood that the protection scope of this application is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in this application, and these modifications or substitutions should all be covered within the protection scope of this application.

Claims

1. A method for processing alarm information, characterized in that, include: Obtain an alarm information dataset, wherein the alarm information dataset includes multiple alarm information; Each alarm message is projected onto multiple preset dimensions to obtain a weight vector for each alarm message; The weight vectors of each alarm message are input into a preset alarm labeling model, and the initial classification labels of each alarm message are output. The alarm labeling model is obtained by training a preset learning model with multiple samples and the labels of each sample. Multiple alarm messages, their corresponding weight vectors, and initial classification labels are used as training datasets. A preset large language model is trained using a first low-rank matrix and a second low-rank matrix to obtain an alarm denoising large language model. The ranks of the first low-rank matrix and the second low-rank matrix are much smaller than the dimension of the weight matrix of the large language model. The number of rows in the first low-rank matrix is ​​the same as the number of rows in the weight matrix, and the number of columns in the second low-rank matrix is ​​the same as the number of columns in the weight matrix.

2. The method according to claim 1, characterized in that, The acquisition of the alarm information dataset includes: Collect alarm data from the multiple dimensions mentioned above; The alarm data is cleaned to obtain the multiple alarm information. The cleaning process includes checking and deleting duplicate alarm records, filling or deleting missing alarm data, converting the timestamp of the alarm to a uniform format, and extracting at least one of the following:

3. The method according to claim 1, characterized in that, The step of projecting each of the alarm messages onto multiple preset dimensions to obtain a weight vector for each of the alarm messages includes: Fill each of the aforementioned alarm messages into a preset prompt template to generate a prompt message; The prompt words are input into a general large model to obtain the weight vectors of each alarm message projected onto multiple preset dimensions.

4. The method according to claim 3, characterized in that, The prompt template includes the multiple dimensions, contextual example display, thought chain guidance, and thought tree; the contextual example display is used to display multiple historical alarm information of the multiple dimensions and the weight vector of the historical alarm information as examples, so that the general large model can learn; The thought chain guidance is used to interweave descriptions of the thought process of how to obtain the weight vector from the historical alarm information in each of the examples, guiding the general large model to understand the reasoning logic; the thought tree is used to decompose the projection task into multiple sub-steps, and the logical relationship between the steps is reflected in the prompt words, helping the general large model to complete the projection task in a more organized manner.

5. The method according to claim 1, characterized in that, Before inputting the weight vectors of each alarm message into a preset alarm labeling model and outputting the initial classification labels of each alarm message, the method further includes: The alarm information dataset is divided into multiple alarm information according to a preset ratio to obtain a first training sample set and a second training sample set, wherein the number of alarm information in the first training sample set is greater than the number of alarm information in the second training sample set. Each alarm message in the second training set is labeled to determine the label of each alarm message; The weight vectors of multiple alarm messages in the second training set are used as the multiple samples, and the labels of each alarm message in the second training set are used as the labels of each sample. The learning model is trained to obtain the alarm labeling model. The step of inputting the weight vectors of each alarm message into a preset alarm labeling model and outputting the initial classification labels of each alarm message includes: The weight vectors of each alarm information in the first training sample set are input into the alarm labeling model, and the initial classification labels of each alarm information in the first training sample set are output.

6. The method according to claim 5, characterized in that, The network structure of the learning model includes an input layer, an intermediate layer, and an output layer. The intermediate layer includes multiple processing units, the connection method between each processing unit, and an activation function. The number and level of the multiple processing units are such that the classification accuracy of the learning model is greater than a preset accuracy threshold, and the convergence of the loss function of the learning model satisfies a preset first condition.

7. The method according to claim 1, characterized in that, Before training a preset large language model by using multiple alarm messages, their corresponding weight vectors, and initial classification labels as a training dataset, and combining them with a preset first low-rank matrix and a preset second low-rank matrix to obtain an alarm denoising large language model, the method further includes: The elements in the preset first matrix and second matrix are randomly initialized, and the first low-rank matrix is ​​calculated from the first matrix and the second matrix; The elements in the preset third and fourth matrices are randomly initialized, and the second low-rank matrix is ​​calculated from the third and fourth matrices; The ranks of the first low-rank matrix and the second low-rank matrix are such that the feature retention rate of the alarm noise reduction large language model is greater than a preset retention rate threshold, and the ratio of the number of samples in the training dataset to the rank is greater than or equal to a preset fit ratio threshold.

8. The method according to claim 1, characterized in that, The step involves using multiple alarm messages, their corresponding weight vectors, and initial classification labels as a training dataset, and combining them with a preset first low-rank matrix and a preset second low-rank matrix to train a preset large language model, thereby obtaining an alarm denoising large language model, including: The alarm information, its corresponding weight vector, and initial classification label are used as the training dataset, and the preset large language model is trained by combining the preset first low-rank matrix and the preset second low-rank matrix. Calculate the loss function value of the large language model; If the loss function value is less than a preset threshold, the trained large language model is determined as the alarm and noise reduction large language model.

9. The method according to claim 1, characterized in that, After using multiple alarm messages, their corresponding weight vectors, and initial classification labels as training datasets, and combining them with a preset first low-rank matrix and a preset second low-rank matrix to train a preset large language model to obtain an alarm denoising large language model, the method further includes: Obtain multiple real-time alarm messages; Each of the real-time alarm messages is filled into a preset prompt template and input into a general large model to obtain a weight vector of each of the real-time alarm messages projected onto multiple preset dimensions, wherein the prompt template includes the multiple dimensions; The weight vectors of each real-time alarm information are input into the alarm denoising language model, and the alarm labels of each real-time alarm information are output.

10. An alarm information processing device, characterized in that, The device includes: The first acquisition module is used to acquire an alarm information dataset, which includes multiple alarm information. The projection module is used to project each of the alarm messages onto multiple preset dimensions to obtain a weight vector for each of the alarm messages. The first labeling module is used to input the weight vector of each alarm information into a preset alarm labeling model and output the initial classification label of each alarm information. The alarm labeling model is obtained by training a preset learning model with multiple samples and the labels of each sample. The first training module is used to use multiple alarm messages, their corresponding weight vectors, and initial classification labels as training datasets, and to train a preset large language model by combining a preset first low-rank matrix and a preset second low-rank matrix to obtain an alarm noise reduction large language model. The ranks of the first low-rank matrix and the second low-rank matrix are much smaller than the dimension of the weight matrix of the large language model, and the number of rows in the first low-rank matrix is ​​the same as the number of rows in the weight matrix, and the number of columns in the second low-rank matrix is ​​the same as the number of columns in the weight matrix.

11. An electronic device, characterized in that, The device includes: a processor and a memory storing computer program instructions; when the processor executes the computer program instructions, it implements the alarm information processing method as described in any one of claims 1-9.

12. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer program instructions, which, when executed by a processor, implement the alarm information processing method as described in any one of claims 1-9.

13. A computer program product, characterized in that, When the instructions in the computer program product are executed by the processor of the electronic device, the electronic device performs the alarm information processing method as described in any one of claims 1-9.

Images