Alarm processing method and device, model training method and device, equipment and medium

Abstract

The embodiment of the invention provides an alarm processing method and device, a model training method and device, equipment and a medium, and the proposed alarm processing method comprises the steps: obtaining alarm information corresponding to an alarm event, and obtaining scene information corresponding to the alarm event; performing text combination based on the alarm information and the scene information to obtain a synthetic text; inputting the synthetic text into a trained continuous learning model to obtain a target alarm processing strategy which is output by the continuous learning model and corresponds to the alarm event; and according to the target alarm processing strategy corresponding to each alarm event, calculating the correlation degree between the alarm event and other alarm events, and constructing a dynamic correlation degree table of the alarm events based on the correlation degree. Therefore, the misjudgment probability of the alarm event is reduced, the prediction accuracy of the target alarm processing strategy is improved, the stability and availability of equipment or a system are ensured, and meanwhile, the solving efficiency of the alarm event is improved.

Description

Technical Field

[0001] This invention belongs to the field of alarm processing, and in particular relates to an alarm processing method, a continuous learning model training method, an apparatus, an electronic device, and a readable storage medium. Background Technology

[0002] With the development of Internet technology, the complexity of devices and systems is increasing. Devices or systems with alarm functions will issue alarms when they malfunction. How to effectively use these alarm information to resolve faults is crucial for measuring the stability and availability of devices or systems.

[0003] Currently, the relevant technologies typically involve acquiring the alarm information corresponding to the alarm, such as the alarm source, alarm time, and anomaly description information generated during business operations, and then using a pre-trained machine learning model to process the alarm information in order to determine the cause of the fault corresponding to the alarm information.

[0004] The above methods, which rely solely on alarm information for fault diagnosis, have low accuracy. Therefore, it is urgent to address the issue of how to efficiently and accurately determine the corresponding handling strategies for alarms. Summary of the Invention

[0005] This invention provides an alarm processing method, apparatus, electronic device, and readable storage medium to solve the problem that when an alarm event occurs, it is impossible to efficiently and accurately determine a suitable alarm processing strategy, which leads to the inability to quickly repair the system or device and reduces the stability of the system or device.

[0006] To solve the above-mentioned technical problems, the present invention is implemented as follows: In a first aspect, the present invention provides an alarm processing method, the method comprising: Obtain alarm information corresponding to the alarm event, and obtain scenario information corresponding to the alarm event; the alarm information is used to characterize the alarm situation when the alarm event occurs; the scenario information is used to characterize the state of the running scenario when the alarm event occurs. The alarm information and the context information are combined to obtain a synthesized text. The synthesized text is input into the trained continuous learning model to obtain the target alarm handling strategy corresponding to the alarm event output by the continuous learning model. Based on the target alarm handling strategy corresponding to each alarm event, the correlation degree between the alarm event and other alarm events is calculated, and a dynamic correlation degree table of the alarm events is constructed based on the correlation degree. The dynamic correlation degree table includes: the subject of each alarm event, the correlation degree between the alarm event and other alarm events, and the target alarm handling strategy corresponding to each alarm event.

[0007] Secondly, the present invention provides a method for training a continuous learning model, comprising: Obtain alarm information sample data, scenario information sample data, and corresponding alarm handling strategy sample tags and alarm handling strategy sample success rate tags corresponding to multiple sample alarm events; The composite text is obtained by combining the alarm information sample data and the context information sample data of the same alarm event. The synthesized text is input into the initial continuous learning model to obtain the predicted probability distribution of the synthesized text corresponding to each alarm processing strategy, as well as the prediction success rate of each processing strategy. Based on the predicted probability distribution and the prediction success rate of each processing strategy, the initial continuous learning model loss value is calculated using the alarm processing strategy sample label and the alarm processing strategy sample success rate label. The model parameters of the initial continuous learning model are adjusted based on the loss value to obtain the continuous learning model.

[0008] Thirdly, the present invention provides an alarm processing device, the device comprising: The acquisition module is used to acquire alarm information corresponding to the alarm event and to acquire scenario information corresponding to the alarm event; the alarm information is used to characterize the alarm situation when the alarm event occurs; the scenario information is used to characterize the state of the running scenario when the alarm event occurs. The generation module is used to combine the alarm information and the context information to obtain synthesized text; The output module is used to input the synthesized text into the trained continuous learning model to obtain the target alarm processing strategy corresponding to the alarm event output by the continuous learning model. The construction module is used to calculate the correlation degree between each alarm event and other alarm events based on the target alarm handling strategy corresponding to each alarm event, and to construct a dynamic correlation degree table for the alarm events based on the correlation degree. The dynamic correlation degree table includes: the subject of each alarm event, the correlation degree between the alarm event and other alarm events, and the target alarm handling strategy corresponding to each alarm event. Fourthly, the present invention provides an electronic device comprising: a processor, a memory, and a computer program stored in the memory and executable on the processor, characterized in that the processor implements the above-described method when executing the program.

[0009] Fifthly, the present invention provides a readable storage medium that, when the instructions in the readable storage medium are executed by a processor of an electronic device, enables the electronic device to perform the above-described method.

[0010] In this embodiment of the invention, alarm information corresponding to an alarm event and context information corresponding to the alarm event are obtained. The alarm information is used to characterize the alarm situation when the alarm event occurs; the context information is used to characterize the state of the operating scenario when the alarm event occurs. Based on the alarm information and context information, text is combined to obtain synthetic text. The synthetic text is input into a trained continuous learning model to obtain the target alarm handling strategy corresponding to the alarm event output by the continuous learning model. In this way, on the one hand, the alarm information and context information generated when the alarm event occurs are combined, effectively aggregating the alarm information and context state information. Then, targeted predictions can be made from both the alarm information and context information through the continuous learning model. Since predictions can be made based on a combination of alarm information and context information, the situation of misjudgment that is easy to occur when relying on a single alarm information can be effectively avoided, thereby improving the prediction accuracy of the alarm handling strategy, thereby improving the fault repair speed of the system or equipment, and ensuring the stability and availability of the equipment or system. On the other hand, based on the target alarm handling strategy corresponding to each alarm event, the correlation between the alarm event and other alarm events can be calculated, and a dynamic correlation table of alarm events can be constructed based on the correlation. The dynamic correlation table includes: the subject of each alarm event, the correlation between the alarm event and other alarm events, and the target alarm handling strategy corresponding to each alarm event. Then, based on the constructed correlation relationship of alarm events, alarm events can be quickly classified and deduplicated, improving the management efficiency of alarm events, thereby further improving the resolution efficiency of alarm events. Attached Figure Description

[0011] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0012] Figure 1 This is a flowchart of the alarm processing method provided in an embodiment of the present invention; Figure 2 This is a flowchart of another alarm processing method provided in an embodiment of the present invention. Figure 3 This is a flowchart of an alarm processing method provided in an embodiment of the present invention; Figure 4 This is a flowchart illustrating the steps of a continuous learning model training method provided in an embodiment of the present invention. Figure 5This is a structural diagram of an alarm processing method provided in an embodiment of the present invention; Figure 6 This is a schematic diagram of the structure of an alarm processing device provided in an embodiment of the present invention; Figure 7 This is a structural diagram of a model training device provided in an embodiment of the present invention; Figure 8 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention. Detailed Implementation The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0013] like Figure 1 As shown, Figure 1 This is a flowchart illustrating the steps of an alarm processing method provided in an embodiment of the present invention. This embodiment is applicable to any device or system that can generate alarm information when malfunctions or failures occur, such as servers, computer equipment, operating systems, etc., and the present invention does not impose any limitations on this. The method may include: Step 101: Obtain alarm information corresponding to the alarm event, and obtain scenario information corresponding to the alarm event; the alarm information is used to characterize the alarm situation when the alarm event occurs; the scenario information is used to characterize the state of the running scenario when the alarm event occurs.

[0014] In this step, an alarm event will be generated when the equipment or system malfunctions or operates abnormally. The alarm event is automatically generated by the monitoring platform and is a record containing key information such as the description of the abnormality, the time of occurrence, and the location of the equipment.

[0015] The monitoring and diagnostic modules built into alarm devices or alarm systems can collect abnormal states in real time and integrate them to generate alarm information containing timestamps, fault types, severity levels, and resource identifiers. After being cached locally, the alarm information is actively reported to the centralized management platform through a predetermined log interface and / or written to the audit log in a non-volatile storage medium. The operation and maintenance terminal can retrieve the alarm information from the management platform or local logs by calling the corresponding query command or interface according to the permission level. The alarm information can characterize the alarm situation when the alarm event occurred.

[0016] Furthermore, at the same time an alarm event is generated, the alarm device or alarm system can use the timestamp of the alarm event as a benchmark to start a sliding time window retrieval based on three types of logs: operation audit, configuration change, and session recording. The window length can be configured according to requirements. Through parallel querying of the pre-built time-series index, the scenario information within the same time period as the alarm resource can be obtained. The scenario information can characterize the state of the running scenario corresponding to the alarm event.

[0017] Step 102: Combine the alarm information and the context information to obtain the synthesized text.

[0018] In this step, the alarm information generated when the alarm event occurs, as well as the corresponding operational scenario information, can be combined to obtain text information that can represent the aggregation of alarm information and scenario information. This aggregated information of alarm information and scenario information facilitates more targeted prediction of alarm handling strategies in the future.

[0019] Step 103: Input the synthesized text into the trained continuous learning model to obtain the target alarm processing strategy corresponding to the alarm event output by the continuous learning model.

[0020] In this step, the continuous learning model is a machine learning paradigm that can continuously update its parameters and accumulate new knowledge without excessively forgetting old knowledge while receiving new data. It achieves "learning while running" through mechanisms such as dynamically expanding the network structure, replaying historical samples, or introducing regularization constraints, so that the system can always maintain its ability to adapt to new patterns throughout its life cycle, while maintaining the stability of historical patterns.

[0021] Furthermore, by inputting the synthesized text into the trained continuous learning model, the target alarm handling strategy corresponding to the alarm event can be stably obtained based on the continuous learning model, which can effectively ensure the predictive stability and accuracy of the alarm handling strategy.

[0022] Step 104: Calculate the correlation degree between the alarm event and other alarm events according to the target alarm handling strategy corresponding to each alarm event, and construct a dynamic correlation degree table for the alarm events based on the correlation degree. The dynamic correlation degree table includes: the subject of each alarm event, the correlation degree between the alarm event and other alarm events, and the target alarm handling strategy corresponding to each alarm event.

[0023] In this step, the trained continuous learning model can predict the alarm handling strategy for each of the multiple alarm events, thereby obtaining the target alarm handling strategy corresponding to each alarm event.

[0024] Furthermore, the correlation between the target alarm event and other alarm events can be calculated. These other alarm events are those excluding the target alarm event. A dynamic correlation table can then be constructed based on the correlation between the target alarm event and these other alarm events. This table includes the ontology of each alarm event, the correlation between the target alarm event and these other alarm events, and the target alarm handling strategy for each alarm event. The alarm event ontology is the smallest set of data uniquely describing the occurrence of an anomaly. It may include information such as alarm event identifier, resource object identifier, anomaly type, severity level, occurrence timestamp, and lifecycle status. Based on this alarm event ontology, alarm event identification, correlation lookup, and matching of handling strategies are achieved. Similarly, a corresponding dynamic correlation table can be constructed for each alarm event using the same method described above, which will not be elaborated further here. In this way, different alarm events can be efficiently managed based on their correlation.

[0025] In summary, in this embodiment of the invention, alarm information corresponding to an alarm event and context information corresponding to the alarm event are obtained. The alarm information is used to characterize the alarm situation when the alarm event occurs; the context information is used to characterize the state of the operating scenario when the alarm event occurs. Based on the alarm information and context information, text is combined to obtain synthetic text. The synthetic text is input into a trained continuous learning model to obtain the target alarm handling strategy corresponding to the alarm event output by the continuous learning model. Thus, on the one hand, by combining the alarm information and context information generated when the alarm event occurs, the alarm information and context state information are effectively aggregated. This allows for targeted prediction from both the alarm information and context information aspects through the continuous learning model. Since prediction can be based on a combination of alarm information and context information, it effectively avoids the possibility of misjudgment that can easily occur when relying solely on a single alarm information, thereby improving the prediction accuracy of the alarm handling strategy, thus increasing the fault repair speed of the system or device, and ensuring the stability and availability of the device or system.

[0026] On the other hand, based on the target alarm handling strategy corresponding to each alarm event, the correlation between the alarm event and other alarm events can be calculated, and a dynamic correlation table of alarm events can be constructed based on the correlation. The dynamic correlation table includes: the subject of each alarm event, the correlation between the alarm event and other alarm events, and the target alarm handling strategy corresponding to each alarm event. Then, based on the constructed correlation relationship of alarm events, alarm events can be quickly classified and deduplicated, improving the management efficiency of alarm events, thereby further improving the resolution efficiency of alarm events.

[0027] like Figure 2As shown, Figure 2 This is a flowchart of another alarm processing method provided by an embodiment of the present invention, which may include: Step 201: Obtain alarm information corresponding to the alarm event, and obtain scenario information corresponding to the alarm event; the alarm information is used to characterize the alarm situation when the alarm event occurs; the scenario information is used to characterize the state of the running scenario when the alarm event occurs.

[0028] In this step, the method in step 201 is similar to that in step 101, and will not be described again here.

[0029] Step 202: Combine the alarm information and the context information to obtain a composite text. The alarm information includes: device name information, alarm level information, alarm occurrence time information, and alarm description information; the context information includes alarm occurrence location information, operator permission information, and operation instruction information.

[0030] The method in step 202 is similar to that in step 102, and will not be described again here.

[0031] Optionally, step 202 may also include: Sub-step 2021: Combine the alarm location information, the operator permission information, and the operation instruction information to obtain the scenario text.

[0032] In this step, the acquired alarm location information, operator permission information, and operation instruction information corresponding to the alarm event are synthesized into a contextual text for the aggregation of contextual information. The alarm location information represents the geographical location of the alarm device or alarm system at the time the alarm event occurs. Operator permissions represent the set of all "roles-permissions" that can perform operations on the faulty resource within a preset time range before and after the alarm event. This preset time range can be flexibly set according to actual needs, and this embodiment does not impose any restrictions. The operation instruction information refers to the set of a preset number of operation instructions that the alarm device or alarm system has already executed within the preset time range before the alarm event occurs. This preset number can be flexibly set according to actual needs, and this embodiment does not impose any restrictions.

[0033] For example, the location where the alarm occurred is indicated as Operator permissions are represented as follows Operation instructions are represented as The contextual information corresponding to the alarm event is combined into a contextual text. and will As the scenario number corresponding to the scenario text.

[0034] For example, the alarm occurs at the location of The operator's permissions are The operation instructions are First, combine the texts to obtain the contextual text. This facilitates the subsequent concatenation of contextual text and alarm information to obtain composite text.

[0035] Sub-step 2022: Combine the scenario text with at least one piece of information from the alarm information to obtain a composite text.

[0036] In this step, the alarm information includes device name, alarm level, alarm occurrence time, and alarm description. The device name is a unique identifier indicating the physical or logical device that generated the alarm, used to locate the alarm source. It can be a hostname, asset number, IP address, serial number, etc. The alarm level indicates the severity or urgency of the fault. The alarm occurrence time indicates the precise timestamp of the alarm event recorded by the system, facilitating time-series analysis. The alarm description includes a textual description of the fault phenomenon, including the abnormal object, error code, parameter values, etc., so that maintenance personnel can quickly understand the fault.

[0037] Furthermore, the composite text generated in sub-step 2021 can be combined with at least one of the following: device name information, alarm level information, alarm occurrence time information, and alarm description information, to obtain a composite text of scenario text and alarm information. For example, scenario text and alarm description information can be combined to obtain a composite text of scenario text and alarm description information. .

[0038] For example, the alarm description is: [DESC] 2002-06-25 14:23:10 Interface Ten-GigabitEthernet1 / 0 / 1 DOWN. The alarm description information is combined with the context text in sub-step 2021 to obtain the composite text X, which is ( [DESC] 2002-06-25 14:23:10 Interface Ten-GigabitEthernet1 / 0 / 1 DOWN).

[0039] Step 203: Input the synthesized text into the trained continuous learning model to obtain the target alarm handling strategy corresponding to the alarm event output by the continuous learning model. The method in step 203 is similar to that in step 103, and will not be described again here.

[0040] Optionally, step 203 may also include: Sub-step 2031: Preprocess the synthesized text to obtain preprocessed text.

[0041] In this step, preprocessing may include pre-screening and vectorization.

[0042] Because the same fault or abnormal situation can be detected and reported by multiple detection paths at the same time, multiple duplicate alarm records will appear within a continuous period of time. For such duplicate concurrent alarms, it is not necessary to resolve each alarm event one by one. Only the first alarm event that occurs when the concurrent alarm occurs needs to be resolved, thereby improving alarm processing efficiency.

[0043] Therefore, after generating the synthesized text, key fields can be extracted from each synthesized text using pre-designed regular expressions to generate normalized strings. These strings are then precisely compared; if they match exactly, it can be determined as a concurrent duplicate alarm event. Multiple duplicate concurrent alarms are grouped into the same concurrent alarm event group and sorted according to the occurrence time of each alarm event.

[0044] Alternatively, the average start and end times of each alarm event in a concurrent alarm event group can be used as the timestamp for that group, with different concurrent alarm event groups corresponding to different timestamps. These concurrent alarm event groups can then be sorted according to their timestamps. Furthermore, duplicate alarm events are filtered and removed, retaining only the composite text corresponding to the first alarm event in each concurrent alarm event group.

[0045] Since the synthesized text is text information, it cannot be directly used as input to the continuous learning model. Therefore, the filtered synthesized text needs to be vectorized. For example, algorithms such as ELMo can be used to vectorize the synthesized text. This embodiment does not impose any restrictions.

[0046] Sub-step 2032: Input the preprocessed text into the continuous learning model and extract the text features of the preprocessed text.

[0047] In this step, the preprocessed text can be fed into the encoding layer of the continuous learning model. The model parameters are used to perform forward computation on the text sequence to obtain a fixed-dimensional vector representation. This vector can be used as a text feature that summarizes the semantics and contextual information of the text. This text feature can then be used for computation by the continuous learning model.

[0048] Sub-step 2033: Based on the text features, obtain multiple initial alarm processing strategies.

[0049] In this step, text features can be mapped to query vectors in a unified semantic space, and then a retrieval is performed in a dynamically expandable policy memory to determine multiple initial alarm handling policies corresponding to the alarm event.

[0050] Sub-step 2034: Determine the target alarm processing strategy from the multiple initial alarm processing strategies.

[0051] In this step, multiple initial alarm handling strategies can be obtained based on the synthesized text and using a continuous learning model. Then, the target alarm handling strategy that is more compatible with the alarm event can be further selected from the multiple initial alarm handling strategies and output, which ensures that the target alarm handling strategy can effectively resolve the alarm event.

[0052] In this embodiment of the invention, a contextual text consisting of alarm location information, operator permission information, and operation instruction information can be flexibly synthesized with at least one of the following in the alarm information: device name information, alarm level information, alarm occurrence time information, and alarm description information. This results in a composite text that aggregates both contextual and alarm information. Based on this composite text, alarm handling strategies can be predicted from both alarm and contextual information perspectives. This effectively avoids the risk of misjudging alarm strategies when relying solely on alarm information, thereby improving the accuracy of alarm handling strategy prediction. Furthermore, by further filtering from multiple initial alarm handling strategies to obtain the target alarm handling strategy, the effectiveness of the target handling strategy is further improved.

[0053] Optionally, sub-step 2034 may also include the following steps: Sub-step 20341: The continuous learning model is further used to output a first success rate for each initial alarm handling strategy. The first success rate characterizes the success rate of the initial alarm handling strategy in resolving alarm events. Furthermore, the initial alarm handling strategies with the first success rate falling within a preset success rate range are determined as the target alarm handling strategies; the target alarm handling strategies are output in descending order according to the first success rate; or... The initial alarm processing strategies are sorted in descending order according to the first success rate, and the top n initial alarm processing strategies in descending order are determined as the target alarm processing strategies and output, where n is a positive integer greater than or equal to 1.

[0054] In this step, the continuous learning model can output the first success rate of each initial alarm handling strategy. That is, it can determine the first success rate p of each initial alarm handling strategy in resolving alarm events. Then, according to a preset probability range, such as [b, a], the initial alarm handling strategies with a first success rate within this preset probability range are determined as the target alarm handling strategies. Where b (b is greater than 60%) is the lowest threshold supported by this invention. Below this threshold, the alarm handling strategy configuration may be inappropriate. a is a maximum of 100%. The values ​​of b and a can be flexibly set by the user according to actual needs. It is only necessary to ensure that b is greater than 60% and a is less than or equal to 100%. This embodiment does not impose any restrictions.

[0055] Furthermore, the target alarm handling strategies can be output in descending order of success rate. For example, if the preset probability range is [60%, 100%], and the three initial alarm handling strategies are determined as follows: initial alarm handling strategy 1 (first success rate of 65%), initial alarm handling strategy 2 (first success rate of 70%), and initial alarm handling strategy 3 (first success rate of 50%), then initial alarm handling strategy 1 and initial alarm handling strategy 2 are determined as the target alarm handling strategies, and the two target alarm handling strategies are output in the order of initial alarm handling strategy 2 and initial alarm handling strategy 1.

[0056] In one possible scenario, if none of the determined initial alarm strategies meet the pre-defined probability value range, it can be determined that there is no matching alarm handling strategy for the target alarm event. That is, the continuous learning model outputs 0 alarm strategies for the target alarm event. In other words, the continuous learning model in this invention can support outputting 0, 1, or more target alarm handling strategies.

[0057] or, Multiple initial alarm handling strategies can be sorted in descending order according to their success rate. Based on a preset threshold n, the top n initial alarm handling strategies in descending order are selected as the target alarm handling strategies and output. The threshold n can be flexibly set by the user according to actual needs; for example, n can be set to values ​​of 9, 10, 20, etc. This embodiment does not impose any restrictions.

[0058] In this embodiment of the invention, by flexibly setting the filtering method of target alarm handling strategies, matching alarm handling strategies can be output as needed for different types of alarm devices or systems, thereby optimizing the accuracy and applicability of alarm handling strategy recommendations, reducing invalid candidates, shortening operation and maintenance decision-making time, and improving the efficiency of alarm handling and the prediction accuracy of alarm handling strategies.

[0059] Step 204: Calculate the correlation degree between the alarm event and other alarm events according to the target alarm handling strategy corresponding to each alarm event, and construct a dynamic correlation degree table of the alarm events based on the correlation degree.

[0060] Step 204 is similar to step 104, and will not be described again here.

[0061] Optionally, step 204 may also include: Sub-step 2041: Obtain N target alarm processing strategies corresponding to each alarm event, and obtain the second success rate of the N target alarm processing strategies; the second success rate is used to characterize the success rate of the target alarm processing strategies in resolving the alarm event; N is a positive integer greater than or equal to 1.

[0062] In this step, the target alarm handling strategy corresponding to each alarm event can be obtained based on the trained continuous learning model, as well as the second success rate of each target alarm handling strategy output by the continuous learning model in resolving the corresponding alarm event. Then, N strategies are selected from the target alarm handling strategies for calculating the correlation between two alarm events. N can be selected according to actual needs; this application does not impose any restrictions on it. It should be noted that the value of N must be less than or equal to the number of target alarm handling strategies output by the continuous learning model for the alarm event.

[0063] For example, the continuous learning model targets alarm events. Output 10 target alarm handling strategies and the corresponding second success rate for each strategy, and continuously learn the model for alarm events. Output 10 target alarm handling strategies and the corresponding second success rate for each target alarm handling strategy, starting from the alarm event. The top 8 of the 10 target alarm handling strategies are selected, along with the alarm events. The first 8 of the 10 target alarm handling strategies will be selected for use in subsequent alarm events. and alarm events The correlation degree is calculated.

[0064] Sub-step 2042: Determine the number of matching N target alarm processing strategies corresponding to the alarm event and the number of matching N target alarm processing strategies corresponding to the other alarm events.

[0065] In this step, the alarm events identified in sub-step 2041 can be... The corresponding N target alarm handling strategies, and alarm events The corresponding N target alarm handling strategies are matched and compared to determine which of the N target alarm handling strategies can resolve the alarm event. It can also resolve alarm events. The target number of alarm handling strategies.

[0066] Sub-step 2043: Based on the number of matched entries and the second success rate of the matched target alarm processing strategy, calculate the correlation between the alarm event and the other alarm events using the following formula.

[0067]

[0068] in, Indicates an alarm event and alarm events The degree of correlation between them; u represents the alarm event. The N target alarm handling strategies in the data, and the alarm events The number of target alarm handling strategies that match among the N target alarm handling strategies; Indicates the target alarm handling strategy Resolve the alarm event The success rate; Indicates the target alarm handling strategy Resolve the alarm event The success rate.

[0069] In this step, the correlation between the two alarm events can be accurately determined by using multiple alarm handling strategies that match both alarm events and the second success rate of each matching alarm handling strategy to resolve the two alarm events.

[0070] For example, alarm events There are five target alarm handling strategies: Target Alarm Handling Strategy 1 (second success rate 80%), Target Alarm Handling Strategy 2 (second success rate 80%), Target Alarm Handling Strategy 3 (second success rate 80%), Target Alarm Handling Strategy 4 (second success rate 90%), and Target Alarm Handling Strategy 5 (second success rate 100%); Alarm Event There are five target alarm handling strategies: Target Alarm Handling Strategy 1 (second success rate 70%), Target Alarm Handling Strategy 6 (second success rate 70%), Target Alarm Handling Strategy 7 (second success rate 80%), Target Alarm Handling Strategy 8 (second success rate 90%), and Target Alarm Handling Strategy 9 (second success rate 100%). It is evident that Target Alarm Handling Strategy 1 can resolve alarm events. It can also resolve alarm events. Therefore, target alarm handling strategy 1 is used as the alarm event. and alarm events The matching alarm handling strategy can then be used to calculate alarm events based on the above formula. and alarm events The degree of correlation.

[0071] Sub-step 2044: Construct a dynamic correlation table for the alarm event based on the correlation between the alarm event and the other alarm events.

[0072] In this step, by calculating the correlation between the alarm event and each other alarm event, a dynamic correlation table corresponding to each alarm event can be constructed based on the ontology, correlation information, and target alarm handling strategy of each alarm event.

[0073] In this embodiment of the invention, the target alarm handling strategy corresponding to each alarm event obtained by the continuous learning model, and the second success rate corresponding to the target alarm handling strategy, can be used to determine the number of target alarm handling strategies that match different alarm events. This allows the correlation between each alarm event and other alarm events to be calculated, and a dedicated dynamic correlation table can be constructed for each alarm event, achieving efficient aggregation of similar alarms and thus improving the management efficiency of alarm events.

[0074] Step 205: Construct a knowledge graph based on the scenario number corresponding to the scenario text and the dynamic correlation table; the knowledge graph includes nodes and edges between nodes, the nodes are used to represent alarm events, target alarm processing strategies and scenario numbers in the dynamic correlation table, and the edges are used to represent the correlation relationships between different nodes.

[0075] In this step, while synthesizing the alarm location information, operator permission information, and operation instruction information into a scenario text, a scenario number corresponding to the scenario text is also generated. Then, a knowledge graph can be constructed based on the scenario number, the alarm events recorded in the dynamic correlation table, the correlation degree, and the target alarm handling strategy corresponding to the alarm events.

[0076] In this knowledge graph, nodes represent alarm events, target alarm handling strategies, and scenario numbers, while edges represent the relationships between different nodes. For example, an edge between alarm event nodes represents the correlation between alarm events; an edge between an alarm event node and a target alarm handling strategy node represents the success rate of the target alarm handling strategy in resolving the alarm event; and an edge between an alarm event node and a scenario number node represents that the scenario state of the alarm event belongs to the scenario state represented by that scenario number.

[0077] Optionally, the frequency of alarm events can be displayed in the knowledge graph by counting the number of alarms generated by alarm events.

[0078] Step 206: When no alarm handling strategy matching the alarm event is found in the knowledge graph, the alarm event is marked as a new alarm event, and the continuous learning model is trained and updated based on the new alarm event.

[0079] In this step, the constructed knowledge graph can be used to find the alarm handling strategy corresponding to the alarm event. If no alarm handling strategy can be found in the knowledge graph, it indicates that the alarm event is a newly generated alarm event, and it can be marked as a new alarm event. After the operations and maintenance personnel handle the new alarm event and resolve it using the new solution strategy, they can also use the newly generated alarm event and the corresponding solution strategy to train and update the continuous learning model to obtain the updated continuous learning model.

[0080] In one feasible embodiment, the continuous learning model can also be updated and trained according to a preset time period T. The preset time period T can be set according to actual needs, such as 1 day or 1 week. This invention does not limit this.

[0081] Step 207: Determine the target alarm handling strategy for the new alarm event based on the trained and updated continuous learning model, and update the knowledge graph.

[0082] In this step, the newly generated alarm event can be predicted using the trained and updated continuous learning model to obtain multiple target alarm handling strategies corresponding to the new alarm event. Then, the knowledge graph is updated based on the target alarm handling strategies corresponding to the new alarm event to obtain a more information-rich knowledge graph, thereby further improving the query efficiency of alarm handling strategies.

[0083] like Figure 3 As shown, Figure 3 This is a flowchart of an alarm processing method provided in an embodiment of the present invention.

[0084] Reference Figure 3 In this application, the handling of alarm events is implemented through the following process: First, the alarm information and context information corresponding to the alarm event are combined into a single text to obtain a composite text that represents the aggregation of alarm information and context information. The specific synthesis method is described above and will not be repeated here.

[0085] Then, based on the synthesized text, it is determined whether there are concurrent or duplicate alarms. If so, concurrent and duplicate alarm processing is performed to remove duplicate alarms. The specific methods for handling concurrent and duplicate alarms can be found in the aforementioned description and will not be repeated here.

[0086] Then, set the probability value range [b, a] or the threshold n according to actual needs to configure the number of target processing strategies predicted by the continuous learning model. Specific threshold settings can be found in the aforementioned description and will not be repeated here.

[0087] The synthesized text information can then be input into a continuous learning model for prediction, thereby obtaining the target alarm handling strategy corresponding to the alarm event. The specific method for generating the target alarm handling strategy can be found in the aforementioned description and will not be repeated here.

[0088] Furthermore, based on the target alarm handling strategy output by the continuous learning model, a corresponding dynamic correlation table can be constructed for each alarm event. The specific method for constructing the dynamic correlation table can be found in the aforementioned description and will not be repeated here.

[0089] Furthermore, a knowledge graph can be constructed by combining a dynamic correlation table. The specific methods for constructing a knowledge graph can be found in the aforementioned descriptions and will not be repeated here.

[0090] like Figure 4 As shown, the present invention also provides a training method for a continuous learning model to obtain the continuous learning model in the foregoing embodiments. Specifically, the training method includes: Step 301: Obtain alarm information sample data, scenario information sample data, and corresponding alarm handling strategy sample tags and alarm handling strategy sample success rate tags corresponding to multiple sample alarm events.

[0091] In this step, historical alarm logs of the device or system can be obtained to extract multiple historical alarm events, along with corresponding alarm information and context information. Duplicate alarm events are then removed using regular expression matching to obtain multiple sample alarm events, along with sample alarm information and context information data corresponding to each sample alarm event. Simultaneously, alarm handling strategy sample labels and alarm handling strategy sample success rate labels are determined for each sample alarm event. For example, these labels can be determined by combining alarm logs and historical work order information, and then having domain experts review and correct the results based on the root cause of the fault, handling records, and on-site evidence.

[0092] Step 302: Combine the alarm information sample data and the context information sample data of the same alarm event into a composite text.

[0093] In this step, for a sample alarm event, the corresponding alarm information sample data and context information sample data are combined to obtain text information that can represent the aggregation of alarm information and context information.

[0094] Step 303: Input the synthesized text into the initial continuous learning model to obtain the predicted probability distribution of the synthesized text corresponding to each alarm processing strategy, as well as the prediction success rate of each processing strategy.

[0095] In this step, the synthesized text can be input into the initial continuous learning model. The initial continuous learning model can then process the synthesized text to obtain the predicted probability distribution of the synthesized text for each alarm handling strategy and the prediction success rate of each strategy. The predicted probability distribution represents the matching probability between each alarm handling strategy and the synthesized text.

[0096] Step 304: Based on the predicted probability distribution and the prediction success rate of each processing strategy, calculate the initial continuous learning model loss value with the alarm processing strategy sample label and the alarm processing strategy sample success rate label.

[0097] In this step, the predicted probability distribution output by the initial continuous learning model can be compared with the alarm handling strategy sample labels to obtain the alarm handling strategy classification loss; and the predicted success rate of each processing strategy can be compared with the alarm handling strategy sample success rate labels to obtain the success rate regression loss; and corresponding weight coefficients can be assigned to the alarm handling strategy classification loss and the success rate regression loss, thereby calculating the initial continuous learning model loss value = α × strategy classification loss + β × success rate regression loss, where α is the weight coefficient of the strategy classification loss and β is the weight coefficient of the success rate regression loss. The values ​​of α and β can be set according to actual needs, and are not limited in this embodiment of the invention.

[0098] Furthermore, when calculating the initial loss value of the continuous learning model, a preset loss function can also be used. Specifically, the loss function can be the cross-entropy loss function, the multi-class cross-entropy loss function, the contrastive loss function related to metric learning, or the triplet loss function, etc. Any possible loss function can be selected to calculate the loss value; this application embodiment does not impose any limitations on this.

[0099] Step 305: Adjust the model parameters of the initial continuous learning model based on the loss value to obtain the continuous learning model.

[0100] In this step, the loss value can be used as reference information to adjust the model parameters of the initial continuous learning model through the backpropagation algorithm. Specifically, by calculating the gradient of the total loss value relative to the parameters of each layer in the initial continuous learning model, and using gradient descent or its variant optimization algorithm to iteratively update the parameters, the performance of the initial continuous learning model on the two tasks of alarm handling strategy classification and success rate regression prediction is improved until the initial continuous learning model converges or reaches the preset training termination condition. Thus, a continuous learning model applicable to the alarm handling method proposed in this application is obtained.

[0101] In one possible implementation, during the training of the initial continuous learning model, if the change in the loss value obtained in multiple consecutive training iterations is less than or equal to a preset target value, the continuous learning model can be considered to have been obtained. Alternatively, during the training of the initial continuous learning model, if the loss value obtained during training is less than or equal to a preset value, the loss value of the initial continuous learning model can be considered small, and the continuous learning model can be considered to have been obtained.

[0102] In summary, in this embodiment of the invention, alarm information sample data and context information sample data corresponding to sample alarm events can be obtained from historical alarm logs. Then, based on the sample data and label data, an initial continuous learning model is trained to obtain a trained continuous learning model. Furthermore, because the continuous learning model can consistently adapt to new patterns while maintaining stability with historical patterns, the predictive accuracy and stability of the alarm handling strategy can be effectively guaranteed.

[0103] Optionally, in some embodiments, the training method of the above-described continuous learning model may further include the following steps.

[0104] Step 306: Update and train the continuous learning model.

[0105] In this step, the predictive performance of the continuous learning model can be improved by further updating and training the model.

[0106] Specifically, step 306 also includes: Step 3061: Obtain alarm information sample data, scenario information sample data, and corresponding alarm handling strategy sample labels and alarm handling strategy sample success rate labels corresponding to the new sample alarm events to form an updated training set.

[0107] In this step, a new sample alarm event refers to a newly generated or first-time occurrence of an alarm event. For example, if no target alarm handling strategy corresponding to the current alarm event is found in the aforementioned constructed knowledge graph, the current alarm event can be marked as a new alarm event. This new alarm event can then be used as a new sample alarm event, and alarm information sample data and scenario information sample data corresponding to the new alarm event can be obtained based on the alarm logs. Furthermore, the alarm handling strategy sample label and alarm handling strategy sample success rate label corresponding to the new alarm event can be determined. The specific method for determining the label data is similar to that in step 301 and will not be repeated here.

[0108] Furthermore, by following the above method, multiple new sample alarm events can be obtained to form an updated training set, which can then be used to update and train the continuous learning model.

[0109] Step 3062: Merge the updated training set and the historical training set according to a preset ratio to form a hybrid training set.

[0110] In this step, the historical training set refers to a training set consisting of multiple historical alarm events and their corresponding alarm information, context information, and label data. For example, the historical training set can be constructed by searching historical alarm logs and extracting multiple historical alarm events and their corresponding alarm information and context information from the historical alarm logs.

[0111] Furthermore, the sample data can be mixed based on the historical training set and the newly generated updated training set according to a preset ratio to obtain a hybrid training set composed of historical samples and new samples. The specific preset ratio can be adapted to actual needs, and this embodiment of the invention does not impose any limitations on it.

[0112] In this way, mixing new sample data and historical sample data for model training allows the model to optimize both new and old objectives during the updated training process. This maintains the continuous learning model's ability to identify and handle historical alarm events and ensures that the updated continuous learning model has stable and balanced performance on both new and old tasks, thereby improving the predictive stability of the continuous learning model.

[0113] Step 3063: Calculate the joint loss of the continuous learning model for the mixed training set, the joint loss including the new task loss and the anti-forgetting loss for maintaining the performance of the old tasks.

[0114] In this step, multiple sample data from the mixed training set can be preprocessed and then input into the continuous learning model. Based on the predicted probability distribution output by the continuous learning model and the sample label data, the new task loss and the anti-forgetting loss are calculated respectively. The new task loss represents the prediction error of the continuous learning model for new sample alarm events during this updated training. The anti-forgetting loss represents the prediction accuracy of the continuous learning model for old task samples (historical sample alarm events) during this updated training. If the anti-forgetting loss value is too large, it indicates that the prediction results of the continuous learning model deviate further from the standard results of old task samples (historical sample alarm events). In this case, gradient correction is needed to suppress catastrophic forgetting by the continuous learning model, ensuring that the prediction performance of the continuous learning model for historical tasks (historical alarm events) is not compromised.

[0115] Furthermore, the joint loss of the continuous learning model can be calculated based on the new task loss and the anti-forgetting loss. For example, corresponding weight coefficients can be assigned to the new task loss and the anti-forgetting loss, and the joint loss = η × new task loss + λ × anti-forgetting loss, where η is the weight coefficient of the new task loss and λ is the weight coefficient of the anti-forgetting loss. The values ​​of η and λ can be set according to actual needs, and are not limited in this embodiment of the invention.

[0116] Furthermore, when calculating the joint loss value of the continuous learning model, a preset loss function can also be used. Specifically, the loss function can be the cross-entropy loss function, the multi-class cross-entropy loss function, the contrastive loss function related to metric learning, or the triplet loss function, etc. Any possible loss function can be selected to calculate the loss value; this application embodiment does not impose any limitations on this.

[0117] Step 3064: Based on the joint loss, selectively update the model parameters of the continuous learning model.

[0118] In this step, to ensure that the continuous learning model can maintain its predictive performance on historical alarm events after incremental updates, when adjusting model parameters based on joint loss, it is necessary to fix or impose elastic weight constraints on some parameters of the continuous learning model that were trained in the previous stage. This allows for selective updates of model parameters, ensuring that the updated continuous learning model retains its predictive ability on historical alarm events. For example, globally trained parameters of the continuous learning model that were deemed critical to the old task by importance assessment in the previous stage are fixed or subject to elastic weight constraints, so that these globally trained parameters do not participate in the current gradient update or are updated only slightly.

[0119] Figure 5 A structural diagram of an alarm processing method provided by an embodiment of the present invention is shown.

[0120] Reference Figure 5 The alarm data processing in this embodiment of the invention includes a process of combining alarm information and context information, as well as an alarm pre-screening process. The methods for combining alarm information and context information, and the alarm pre-screening methods, can be implemented as described above and will not be repeated here.

[0121] The continuous learning model training and prediction process includes continuous learning model training and continuous learning model prediction methods. The continuous learning model training and prediction methods can be implemented in accordance with the methods described above, and will not be repeated here.

[0122] The alarm handling strategy recommendation process includes constructing a dynamic correlation table and constructing a knowledge graph. The specific methods for constructing the dynamic correlation table and constructing the knowledge graph can be referred to the methods described above, and will not be repeated here.

[0123] Figure 6 This is a structural diagram of an alarm processing device provided in an embodiment of the present invention. The alarm processing device 50 may include: The acquisition module 501 is used to acquire alarm information corresponding to the alarm event and to acquire scenario information corresponding to the alarm event; the alarm information is used to characterize the alarm situation when the alarm event occurs; the scenario information is used to characterize the state of the running scenario when the alarm event occurs. The generation module 502 is used to combine the alarm information and the context information to obtain synthesized text; The output module 503 is used to input the synthesized text into the trained continuous learning model to obtain the target alarm processing strategy corresponding to the alarm event output by the continuous learning model. The construction module 504 is used to calculate the correlation degree between the alarm event and other alarm events according to the target alarm handling strategy corresponding to each alarm event, and construct a dynamic correlation degree table of the alarm events based on the correlation degree. The dynamic correlation degree table includes: the subject of each alarm event, the correlation degree between the alarm event and other alarm events, and the target alarm handling strategy corresponding to each alarm event.

[0124] In this embodiment of the invention, an alarm processing device is provided. It acquires alarm information corresponding to an alarm event and context information corresponding to the alarm event. The alarm information characterizes the alarm situation when the alarm event occurs; the context information characterizes the state of the operating scenario when the alarm event occurs. Based on the alarm information and context information, text is combined to obtain synthetic text. The synthetic text is input into a trained continuous learning model to obtain the target alarm processing strategy corresponding to the alarm event output by the continuous learning model. Thus, by combining the alarm information and context information generated when the alarm event occurs, the alarm information and context state information are effectively aggregated. This allows for targeted prediction based on both alarm information and context information through the continuous learning model. Since prediction can be based on a combination of alarm information and context information, it effectively avoids misjudgments that are easily made based on a single alarm information, thereby improving the prediction accuracy of the alarm processing strategy, thus increasing the fault repair speed of the system or equipment, and ensuring the stability and availability of the equipment or system. On the other hand, based on the target alarm handling strategy corresponding to each alarm event, the correlation between the alarm event and other alarm events can be calculated, and a dynamic correlation table of alarm events can be constructed based on the correlation. The dynamic correlation table includes: the subject of each alarm event, the correlation between the alarm event and other alarm events, and the target alarm handling strategy corresponding to each alarm event. Then, based on the constructed correlation relationship of alarm events, alarm events can be quickly classified and deduplicated, improving the management efficiency of alarm events, thereby further improving the resolution efficiency of alarm events.

[0125] Optionally, the alarm information includes: device name information, alarm level information, alarm occurrence time information, and alarm description information; the scenario information includes alarm occurrence location information, operator permission information, and operation instruction information; the generation module 502 further includes: The first generation submodule 5021 is used to synthesize the alarm location information, the operator permission information and the operation instruction information into a context text.

[0126] The second generation submodule 5022 is used to combine the scenario text with at least one piece of information in the alarm information to obtain a synthesized text.

[0127] Optionally, the output module 503 further includes: The first output submodule 5031 is used to preprocess the synthesized text to obtain preprocessed text.

[0128] The second output submodule 5032 is used to input the preprocessed text into the continuous learning model and extract the text features of the preprocessed text.

[0129] The third output submodule 5033 is used to obtain multiple initial alarm processing strategies based on the text features.

[0130] The fourth output submodule 5034 is used to determine the target alarm processing strategy from the multiple initial alarm processing strategies.

[0131] In this embodiment of the invention, a contextual text consisting of alarm location information, operator permission information, and operation instruction information can be flexibly synthesized with at least one of the following in the alarm information: device name information, alarm level information, alarm occurrence time information, and alarm description information. This results in a composite text that aggregates both contextual and alarm information. Based on this composite text, alarm handling strategies can be predicted from both alarm and contextual information perspectives. This effectively avoids the risk of misjudging alarm strategies when relying solely on alarm information, thereby improving the accuracy of alarm handling strategy prediction. Furthermore, by further filtering from multiple initial alarm handling strategies to obtain the target alarm handling strategy, the effectiveness of the target handling strategy is further improved.

[0132] Optionally, the continuous learning model is further used to output a first success rate for each initial alarm handling strategy, wherein the first success rate is used to characterize the success rate of the initial alarm handling strategy in resolving the alarm event.

[0133] The fourth output submodule 5034 includes: The first output unit is configured to determine the initial alarm processing strategy with a success rate within a preset success rate range as the target alarm processing strategy; and output the target alarm processing strategies in descending order of the first success rate; or... The initial alarm processing strategies are sorted in descending order according to the first success rate. The top n initial alarm processing strategies in descending order are determined as the target alarm processing strategies and output, where n is a positive integer greater than or equal to 1. In this embodiment of the invention, by flexibly setting the filtering method of target alarm handling strategies, matching alarm handling strategies can be output as needed for different types of alarm devices or systems, thereby optimizing the accuracy and applicability of alarm handling strategy recommendations, reducing invalid candidates, shortening operation and maintenance decision-making time, and improving the efficiency of alarm handling and the prediction accuracy of alarm handling strategies.

[0134] Optionally, the building module 504 includes: The first construction submodule 5041 is used to obtain N target alarm processing strategies corresponding to each alarm event, and to obtain the second success rate of the N target alarm processing strategies; the second success rate is used to characterize the success rate of the target alarm processing strategies in resolving the alarm event; N is a positive integer greater than or equal to 1.

[0135] The second construction submodule 5042 is used to determine the number of matching N target alarm processing strategies corresponding to the alarm event and the number of matching N target alarm processing strategies corresponding to other alarm events.

[0136] The third construction submodule 5043 is used to calculate the correlation degree between the alarm event and the other alarm events based on the number of matching entries and the second success rate of the matched target alarm processing strategy using the following formula; and to construct a corresponding dynamic correlation degree table for the alarm event based on the correlation degree between the alarm event and the other alarm events.

[0137] in, Indicates an alarm event and alarm events The degree of correlation between them; u represents the alarm event. The N target alarm handling strategies in the data, and the alarm events The number of target alarm handling strategies that match among the N target alarm handling strategies; Indicates the target alarm handling strategy Resolve the alarm event The success rate; Indicates the target alarm handling strategy Resolve the alarm event The success rate.

[0138] In this embodiment of the invention, the target alarm handling strategy corresponding to each alarm event obtained by the continuous learning model, and the second success rate corresponding to the target alarm handling strategy, can be used to determine the number of target alarm handling strategies that match different alarm events. This allows the correlation between each alarm event and other alarm events to be calculated, and a dedicated dynamic correlation table can be constructed for each alarm event, achieving efficient aggregation of similar alarms and thus improving the management efficiency of alarm events.

[0139] Optionally, the device 50 further includes: The knowledge graph construction module 505 is used to construct a knowledge graph based on the scenario number corresponding to the scenario text and the dynamic correlation table. The knowledge graph includes nodes and edges between nodes. The nodes are used to represent alarm events, target alarm handling strategies, and scenario numbers in the dynamic correlation table, and the edges are used to represent the association relationships between different nodes.

[0140] The search module 506 is used to mark the alarm event as a new alarm event when no alarm handling strategy matching the alarm event is found in the knowledge graph, and to train and update the continuous learning model based on the new alarm event.

[0141] The update module 507 is used to determine the target alarm handling strategy for the new alarm event based on the trained and updated continuous learning model, and to update the knowledge graph.

[0142] In this embodiment of the invention, the newly generated alarm event can be predicted using a trained and updated continuous learning model to obtain multiple target alarm handling strategies corresponding to the new alarm event. Then, the knowledge graph can be updated based on the target alarm handling strategies corresponding to the new alarm event to obtain a more information-rich knowledge graph, thereby further improving the query efficiency of alarm handling strategies.

[0143] Figure 7 This is a structural diagram of a model training device provided in an embodiment of the present invention. The model training device 60 may include: The sample acquisition module 601 is used to acquire alarm information sample data, scenario information sample data, and corresponding alarm handling strategy sample tags and alarm handling strategy sample success rate tags corresponding to multiple sample alarm events.

[0144] The sample synthesis module 602 is used to combine alarm information sample data and context information sample data of the same sample alarm event into a synthesized text.

[0145] The sample prediction module 603 is used to input the synthesized text into the initial continuous learning model to obtain the predicted probability distribution of the synthesized text corresponding to each alarm processing strategy, and the prediction success rate of each processing strategy.

[0146] The loss calculation module 604 is used to calculate the initial continuous learning model loss value based on the predicted probability distribution and the prediction success rate of each processing strategy, along with the alarm processing strategy sample label and the alarm processing strategy sample success rate label.

[0147] The parameter adjustment module 605 is used to adjust the model parameters of the initial continuous learning model based on the loss value.

[0148] In this embodiment of the invention, alarm information sample data and context information sample data corresponding to sample alarm events can be obtained from historical alarm logs. Then, based on the sample data and label data, an initial continuous learning model is trained to obtain a trained continuous learning model. Furthermore, because the continuous learning model can always adapt to new patterns while maintaining stability with historical patterns, the predictive accuracy and stability of the alarm handling strategy can be effectively guaranteed.

[0149] Optionally, the training device 60 may further include an update training module 606, which includes: The first update submodule 6061 is used to obtain alarm information sample data, scenario information sample data, and corresponding alarm handling strategy sample labels and alarm handling strategy sample success rate labels corresponding to new sample alarm events, so as to form an updated training set.

[0150] The second update submodule 6062 is used to merge the updated training set with the historical training set according to a preset ratio to form a hybrid training set.

[0151] The third update submodule 6063 is used to calculate the joint loss of the continuous learning model for the mixed training set, the joint loss including the new task loss and the anti-forgetting loss for maintaining the performance of the old tasks.

[0152] The fourth update submodule 6064 is used to selectively update the model parameters of the continuous learning model based on the joint loss.

[0153] The present invention also provides an electronic device, see [link to relevant documentation]. Figure 8 It includes: a processor 701, a memory 702, and a computer program 7021 stored in the memory and executable on the processor. When the processor executes the program, it implements the alarm processing method and the training method of the continuous learning model of the foregoing embodiments.

[0154] The present invention also provides a readable storage medium, wherein when the instructions in the readable storage medium are executed by the processor of an electronic device, the electronic device is able to execute the alarm processing method and the training method of the continuous learning model of the foregoing embodiments.

[0155] As the device embodiment is basically similar to the method embodiment, the description is relatively simple, and relevant parts can be found in the description of the method embodiment.

[0156] The algorithms and displays provided herein are not inherently related to any particular computer, virtual system, or other device. Various general-purpose systems can also be used in conjunction with the teachings herein. The required structure for constructing such systems is apparent from the above description. Furthermore, this invention is not directed to any particular programming language. It should be understood that the contents of the invention described herein can be implemented using various programming languages, and the above description of specific languages ​​is for the purpose of disclosing the best mode of implementation of the invention.

[0157] Numerous specific details are set forth in the specification provided herein. However, it will be understood that embodiments of the invention may be practiced without these specific details. In some instances, well-known methods, structures, and techniques have not been shown in detail so as not to obscure the understanding of this specification.

[0158] Similarly, it should be understood that, in order to simplify the invention and aid in understanding one or more of the various inventive aspects, in the above description of exemplary embodiments of the invention, various features of the invention are sometimes grouped together in a single embodiment, figure, or description thereof. However, this disclosure should not be construed as reflecting an intention that the claimed invention requires more features than expressly recited in each claim. Rather, as reflected in the following claims, inventive aspects lie in fewer than all features of the single embodiment disclosed above. Therefore, the claims following the detailed description are hereby expressly incorporated into this detailed description, wherein each claim itself is a separate embodiment of the invention.

[0159] Those skilled in the art will understand that modules in the device of the embodiments can be adaptively changed and placed in one or more devices different from that embodiment. Modules, units, or components in the embodiments can be combined into a single module, unit, or component, and further, they can be divided into multiple sub-modules, sub-units, or sub-components. Except where at least some of such features and / or processes or units are mutually exclusive, any combination can be used to combine all features disclosed in this specification (including the accompanying claims, abstract, and drawings) and all processes or units of any method or device so disclosed. Unless expressly stated otherwise, each feature disclosed in this specification (including the accompanying claims, abstract, and drawings) may be replaced by an alternative feature that serves the same, equivalent, or similar purpose.

[0160] The various component embodiments of the present invention can be implemented in hardware, or as software modules running on one or more processors, or a combination thereof. Those skilled in the art will understand that microprocessors or digital signal processors (DSPs) can be used in practice to implement some or all of the functions of some or all of the components in the sorting device according to the present invention. The present invention can also be implemented as a device or apparatus program for performing part or all of the methods described herein. Such a program implementing the present invention can be stored on a computer-readable medium, or can be in the form of one or more signals. Such signals can be downloaded from an Internet website, provided on a carrier signal, or provided in any other form.

[0161] It should be noted that the above embodiments are illustrative of the invention and not restrictive, and that those skilled in the art can devise alternative embodiments without departing from the scope of the appended claims. In the claims, any reference signs placed between parentheses should not be construed as limiting the claims. The word "comprising" does not exclude the presence of elements or steps not listed in the claims. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. The invention can be implemented by means of hardware comprising several different elements and by means of a suitably programmed computer. In the unit claims enumerating several means, several of these means may be embodied by the same item of hardware. The use of the words first, second, and third, etc., does not indicate any order. These words can be interpreted as names.

[0162] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0163] It should be noted that all actions involving the acquisition of signals, information, or data in this application are carried out in compliance with the relevant data protection laws and policies of the country where the application is located, and with the authorization granted by the owner of the relevant device.

[0164] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

[0165] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. An alarm processing method, characterized in that, The method includes: Obtain alarm information corresponding to the alarm event, and obtain scenario information corresponding to the alarm event; the alarm information is used to characterize the alarm situation when the alarm event occurs; the scenario information is used to characterize the state of the running scenario when the alarm event occurs. The alarm information and the context information are combined to obtain a synthesized text. The synthesized text is input into the trained continuous learning model to obtain the target alarm handling strategy corresponding to the alarm event output by the continuous learning model. Based on the target alarm handling strategy corresponding to each alarm event, the correlation degree between the alarm event and other alarm events is calculated, and a dynamic correlation degree table of the alarm events is constructed based on the correlation degree. The dynamic correlation degree table includes: the subject of each alarm event, the correlation degree between the alarm event and other alarm events, and the target alarm handling strategy corresponding to each alarm event.

2. The method according to claim 1, characterized in that, The alarm information includes: device name information, alarm level information, alarm occurrence time information, and alarm description information; the scenario information includes alarm occurrence location information, operator permission information, and operation instruction information. The process of combining the alarm information and the context information to obtain synthetic text includes: The alarm location information, the operator permission information, and the operation instruction information are combined to obtain the context text. The context text is combined with at least one of the alarm information to obtain a composite text. The step of inputting the synthesized text into a trained continuous learning model to obtain the target alarm handling strategy corresponding to the alarm event output by the continuous learning model includes: The synthesized text is preprocessed to obtain preprocessed text; The preprocessed text is input into the continuous learning model to extract the text features of the preprocessed text; Based on the aforementioned text features, multiple initial alarm processing strategies are derived. The target alarm processing strategy is determined from the multiple initial alarm processing strategies.

3. The method according to claim 2, characterized in that, The continuous learning model is also used to output a first success rate for each initial alarm handling strategy, the first success rate being used to characterize the success rate of the initial alarm handling strategy in resolving the alarm event; Determining the target alarm handling strategy from the plurality of initial alarm handling strategies includes: The initial alarm processing strategy with a first success rate within a preset success rate range is determined as the target alarm processing strategy; the target alarm processing strategies are output in descending order according to the first success rate; or... The initial alarm processing strategies are sorted in descending order according to the first success rate, and the top n initial alarm processing strategies in descending order are determined as the target alarm processing strategies and output, where n is a positive integer greater than or equal to 1.

4. The method according to claim 1, characterized in that, The step of calculating the correlation degree between the alarm event and other alarm events based on the target alarm handling strategy corresponding to each alarm event, and constructing a dynamic correlation degree table for the alarm events based on the correlation degree, includes: Obtain N target alarm processing strategies corresponding to each alarm event, and obtain the second success rate of the N target alarm processing strategies; the second success rate is used to characterize the success rate of the target alarm processing strategies in resolving the alarm event; N is a positive integer greater than or equal to 1; Determine the number of N target alarm handling strategies corresponding to the alarm event and the number of matching strategies with the N target alarm handling strategies corresponding to the other alarm events; Based on the number of matched entries and the second success rate of the matched target alarm handling strategy, the correlation degree between the alarm event and the other alarm events is calculated using the following formula; a corresponding dynamic correlation degree table is constructed for the alarm event based on the correlation degree between the alarm event and the other alarm events. in, Indicates an alarm event and alarm events The degree of correlation between them; u represents the alarm event. The N target alarm handling strategies in the data, and the alarm events The number of target alarm handling strategies that match among the N target alarm handling strategies; Indicates the target alarm handling strategy Resolve the alarm event The success rate; Indicates the target alarm handling strategy Resolve the alarm event The success rate.

5. The method according to claim 2, characterized in that, The method further includes: A knowledge graph is constructed based on the scenario number corresponding to the scenario text and the dynamic correlation table; the knowledge graph includes nodes and edges between nodes, the nodes are used to represent alarm events, target alarm handling strategies and scenario numbers in the dynamic correlation table, and the edges are used to represent the association relationships between different nodes. When no alarm handling strategy matching the alarm event is found in the knowledge graph, the alarm event is marked as a new alarm event, and the continuous learning model is trained and updated based on the new alarm event. The target alarm handling strategy for the new alarm event is determined based on the continuously learned model after training and updating, and the knowledge graph is updated.

6. A training method for a continuous learning model, characterized in that, include: Obtain alarm information sample data, scenario information sample data, and corresponding alarm handling strategy sample tags and alarm handling strategy sample success rate tags corresponding to multiple sample alarm events; The composite text is obtained by combining the alarm information sample data and the context information sample data of the same alarm event. The synthesized text is input into the initial continuous learning model to obtain the predicted probability distribution of the synthesized text corresponding to each alarm processing strategy, as well as the prediction success rate of each processing strategy. Based on the predicted probability distribution and the prediction success rate of each processing strategy, the initial continuous learning model loss value is calculated using the alarm processing strategy sample label and the alarm processing strategy sample success rate label. The model parameters of the initial continuous learning model are adjusted based on the loss value to obtain the continuous learning model according to any one of claims 1-6.

7. The method according to claim 6, characterized in that, The method further includes: The continuous learning model is updated and trained. The process of updating and training the continuous learning model includes: Obtain alarm information sample data, scenario information sample data, and corresponding alarm handling strategy sample labels and alarm handling strategy sample success rate labels corresponding to new sample alarm events to form an updated training set; The updated training set and the historical training set are merged according to a preset ratio to form a hybrid training set; The joint loss of the continuous learning model is calculated for the hybrid training set, the joint loss including the new task loss and the forgetting prevention loss for maintaining the performance of the old tasks; Based on the joint loss, the model parameters of the continuous learning model are selectively updated.

8. An alarm processing device, characterized in that, The device includes: The acquisition module is used to acquire alarm information corresponding to the alarm event and to acquire scenario information corresponding to the alarm event; the alarm information is used to characterize the alarm situation when the alarm event occurs; the scenario information is used to characterize the state of the running scenario when the alarm event occurs. The generation module is used to combine the alarm information and the context information to obtain synthesized text; The output module is used to input the synthesized text into the trained continuous learning model to obtain the target alarm processing strategy corresponding to the alarm event output by the continuous learning model. The construction module is used to calculate the correlation degree between the alarm event and other alarm events according to the target alarm handling strategy corresponding to each alarm event, and construct a dynamic correlation degree table of the alarm events based on the correlation degree. The dynamic correlation degree table includes: the correlation degree between the alarm event and the other alarm events, and the target alarm handling strategy corresponding to each alarm event.

9. An electronic device, characterized in that, include: A processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the program, implements the method as described in any one of claims 1-7.

10. A readable storage medium, characterized in that, When the instructions in the readable storage medium are executed by the processor of the electronic device, the electronic device is able to perform the method of any one of claims 1-7.

Images