Alarm grading method and device, storage medium and electronic equipment

Abstract

The invention relates to an alarm grading method and device, a storage medium and electronic equipment, in particular to the technical field of operation and maintaining.The method comprises the steps that in response to received initial alarm information of a system, based on monitoring data of the system, a multi-mode signal corresponding to the system is extracted; carrying out signal processing on a risk trend signal in the multi-mode signal, and obtaining a risk trend coefficient within the duration corresponding to the initial alarm information; fusing the risk trend coefficient with the multi-modal signal to obtain a dynamic risk assessment index of the system; and according to the alarm interval corresponding to the dynamic risk assessment index, determining the real-time alarm level of the system, and dynamically adjusting the real-time alarm level according to the multi-modal signal acquired in real time within the duration. Dynamic processing of system alarm is realized by fusing multi-modal signals, the alarm severity level of the system at the current moment is dynamically displayed within the duration of initial alarm, the overall risk level of the system is quantified in real time, and the accuracy and operability of alarm are improved.

Description

Technical Field

[0001] This application relates to the field of operation and maintenance technology, and in particular to an alarm classification method, device, storage medium and electronic device. Background Technology

[0002] In the field of IT operations and maintenance, alarm management is a key aspect of ensuring system stability. Existing mainstream alarm classification methods are usually based on predefined static rules to generate static alarms.

[0003] Currently, in related technologies, when the monitoring system detects that a certain indicator (such as CPU utilization, memory utilization, request error rate, etc.) exceeds a preset fixed threshold, an alarm will be triggered. However, this method cannot be adjusted according to changes in the system state during the alarm period. Summary of the Invention

[0004] In view of this, this application provides an alarm classification method, apparatus, storage medium and electronic device, the main purpose of which is to improve the technical problem in the related art that when the monitoring system detects that a certain indicator exceeds a preset fixed threshold, an alarm will be triggered. However, this method cannot be adjusted according to the changes in the system state during the alarm period.

[0005] Firstly, this application provides an alarm classification method, the method comprising: In response to receiving the initial alarm information from the system, the multimodal signal corresponding to the system is extracted based on the system's monitoring data; Signal processing is performed on the risk trend signal in the multimodal signal to obtain the risk trend coefficient within the duration corresponding to the initial alarm information; The risk trend coefficient is fused with the multimodal signal to obtain the dynamic risk assessment index of the system; The real-time alarm level of the system is determined based on the alarm interval corresponding to the dynamic risk assessment index, and the real-time alarm level is dynamically adjusted according to the multimodal signals collected in real time during the duration.

[0006] Secondly, this application provides an alarm classification device, the device comprising: The receiving module is configured to extract the corresponding multimodal signal of the system based on the system's monitoring data in response to receiving the initial alarm information of the system. The acquisition module is configured to perform signal processing on the risk trend signal in the multimodal signal to acquire the risk trend coefficient within the duration corresponding to the initial alarm information; and to fuse the risk trend coefficient with the multimodal signal to acquire the dynamic risk assessment index of the system. The determination module is configured to be the alarm interval corresponding to the dynamic risk assessment index, and determines the real-time alarm level of the system. The real-time alarm level is dynamically adjusted according to the real-time collected multimodal signals during the duration.

[0007] Thirdly, this application provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the alarm rating method described in the first aspect.

[0008] Fourthly, this application provides an electronic device, including a storage medium, a processor, and a computer program stored on the storage medium and executable on the processor, wherein the processor executes the computer program to implement the alarm rating method described in the first aspect.

[0009] Fifthly, this application provides a computer program product, including a computer program that, when executed by a processor, implements the alarm rating method described in the first aspect.

[0010] By employing the above technical solutions, this application provides an alarm rating method, apparatus, storage medium, and electronic device. Compared with existing related technologies, this application can first respond to the initial alarm information received from the system, extract the multimodal signal corresponding to the system based on the system's monitoring data; perform signal processing on the risk trend signal in the multimodal signal to obtain the risk trend coefficient within the duration corresponding to the initial alarm information; fuse the risk trend coefficient with the multimodal signal to obtain the dynamic risk assessment index of the system; and determine the real-time alarm level of the system according to the alarm interval corresponding to the dynamic risk assessment index, wherein the real-time alarm level is dynamically adjusted within the duration based on the real-time collected multimodal signals. By applying the technical solution of this application, after receiving the initial alarm from the system, this application can extract multimodal signals based on monitoring data, perform signal processing on the risk trend signals in the multimodal signals, obtain the risk trend coefficient within the duration corresponding to the initial alarm information, and use it to judge the intensity of the deterioration trend of the abnormal state of the system. Then, the risk trend coefficient is fused with the multimodal signals to obtain a dynamic risk assessment index that comprehensively reflects the potential impact of system failure, real-time risk changes, and the global state of the system. Finally, the real-time alarm level of the current system is determined according to the alarm interval, and the alarm severity level of the system at the current moment is dynamically displayed within the duration of the initial alarm, thereby quantifying the overall risk level of the system in real time, improving the accuracy and operability of alarms, and accurately focusing the attention of operation and maintenance.

[0011] The above description is only an overview of the technical solution of this application. In order to better understand the technical means of this application and to implement it in accordance with the contents of the specification, and to make the above and other objects, features and advantages of this application more obvious and understandable, the following are specific embodiments of this application. Attached Figure Description

[0012] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0013] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0014] Figure 1 A flowchart illustrating an alarm classification method provided in an embodiment of this application is shown. Figure 2 A flowchart illustrating an example provided in an embodiment of this application is shown; Figure 3 A schematic diagram of an alarm rating device provided in an embodiment of this application is shown. Detailed Implementation

[0015] To better understand the above-mentioned objectives, features, and advantages of this application, the solution of this application will be further described below. It should be noted that, unless otherwise specified, the embodiments and features described in these embodiments can be combined with each other.

[0016] In some embodiments, the alarm level of the system (e.g., urgent, important, warning, alert) is usually determined during the configuration phase based on the type of alarm event. For example, a database failure is usually classified as "urgent," while a slightly high disk usage may be classified as "warning." This static rule system has clear logic and is simple to configure, and it is the core method widely adopted by many commercial and open-source monitoring systems (such as Prometheus, Zabbix, Nagios, etc.).

[0017] However, despite the widespread application of existing static alarm rating methods, in complex cloud and distributed environments, the alarm level determined by this method is merely a static label, failing to comprehensively reflect the potential impact of faults, real-time risk changes, and the overall system status. Its inherent shortcomings are becoming increasingly apparent, as detailed below: 1. Excessive alarm noise and a proliferation of inefficient alarms: Static thresholds cannot perceive system context. For example, a brief period of full CPU usage for a non-core business and a sustained, slow increase in CPU usage for a core payment service database may trigger alarms of the same level. The former alarm generally does not require immediate attention, while the latter represents a potentially significant hidden danger. Static methods cannot distinguish between the two, causing operations personnel to be overwhelmed by a large number of low-value alarms, while truly important issues are masked. 2. Rigid rating mechanism, unable to be dynamically adjusted: The alarm level is fixed at the moment it is generated and cannot be adjusted according to changes in the system state during the alarm period. For example, a disk space shortage alarm initially rated as "warning" may actually increase in danger level dynamically if its usage continues to rise rapidly over time, but the alarm level will not change accordingly. 3. Ignoring overall system health and capacity: Existing methods view individual metrics in isolation, lacking consideration of macro-level factors such as the overall importance of the system, service redundancy (e.g., the number of remaining healthy instances in the current cluster), and load growth trends. An abnormal metric can have drastically different impacts on a system with or without redundancy, but static methods cannot reflect this difference. 4. Distracting the attention of operations and maintenance personnel, leading to alarm fatigue: The above-mentioned defects ultimately require the operations and maintenance team to spend a lot of time manually screening and judging the priority of alarms, which leads to a distraction of their attention, low response efficiency, and easy "alarm fatigue", thus ignoring truly critical alarms.

[0018] To address the issue in related technologies where monitoring systems trigger alarms when a certain indicator exceeds a preset fixed threshold, but this approach fails to adjust for changes in system state during the alarm duration, this embodiment provides an alarm classification method, such as... Figure 1 As shown, the method includes: Step 101: In response to receiving the initial alarm information from the system, extract the corresponding multimodal signals from the system based on the system's monitoring data.

[0019] Initial alarm information can include alarm events generated when the system (such as a cluster) first detects an abnormal state. For example, when a system experiences performance degradation or service anomalies, the monitoring system typically issues alarms (such as "high CPU utilization"), which can serve as initial alarm information. However, these initial alarm messages often lack context, requiring operations and maintenance personnel to manually check logs, metrics, call chains, and other multi-source data, resulting in low operational efficiency.

[0020] Correspondingly, the system's monitoring data may include various observable data continuously collected during system operation, including but not limited to: time-series data such as CPU, memory, QPS, and latency; text logs output by the application or system; complete path records of distributed call chains; and discrete events such as service releases, Pod restarts, and configuration changes.

[0021] In some embodiments of this invention, multimodal signals can be extracted based on initial alarm information and monitoring data. These multimodal signals may include dynamic signals with time-series and quantifiable characteristics extracted from different types of monitoring data. This transforms the raw monitoring data into a computable, modelable, and reasonable dynamic feature representation. Multimodal signals can be used for system alarm rating and also for machine learning or rule engine analysis. For example, multimodal signals may include: indicator signals, such as the magnitude of sudden changes in CPU utilization and the linear slope of memory growth; log signals, such as the frequency of error logs per unit time and changes in entropy at the log level; link signals, such as the P99 value of critical interface call latency and changes in the number of hops in the call path; event signals: the time interval between the publication of an event and an alarm; and topology signals: the criticality score of dependent services, etc.

[0022] This alarm classification method, which extracts multimodal signals based on monitoring data after receiving an initial alarm from the system, is suitable for complex environments such as cloud computing, microservice architecture, and distributed systems. It facilitates system fault diagnosis and root cause localization for operations and maintenance personnel. After an alarm is triggered, it automatically extracts multimodal signals related to the anomaly as input for subsequent root cause analysis, cluster attribution, or prediction models.

[0023] Step 102: Perform signal processing on the risk trend signal in the multimodal signal to obtain the risk trend coefficient within the duration corresponding to the initial alarm information.

[0024] The duration corresponding to the initial alarm information can be a time window from the time the initial alarm occurred to the current analysis time. For example, if the alarm response time is 14:00 and the current time is 14:05, the duration is 5 minutes. Monitoring data during this time period can be continuously collected, multimodal signals can be extracted, and dynamic analysis of the system's risk trend coefficient can be performed.

[0025] In specific application scenarios, multimodal signals may include risk trend signals that reflect the health status and deterioration trend of the system. Risk trend signals may be time series data that are continuously rising, periodically oscillating, or growing abruptly. Risk trend coefficients may be evaluation indicators for assessing the strength of risk trends. For example, if the risk trend coefficient is less than 0, it means that the current risk trend of the system is in a stable or recovery phase. If the risk trend coefficient is greater than or equal to 0, it means that the current risk trend of the system is in a deterioration phase and the risk continues to increase.

[0026] Specifically, mathematical or statistical operations can be performed on risk trend signals, such as signal denoising based on moving averages, fitting the trend slope of the signal based on linear regression, calculating its rate of change based on difference operations, and detecting abrupt change points. These methods can be used to extract the trend characteristics of multimodal signals within the duration corresponding to the initial alarm information, determine the intensity of the deterioration trend of the abnormal state of the system, and determine the risk trend coefficient within that duration.

[0027] Step 103: Fuse the risk trend coefficient with the multimodal signal to obtain the system's dynamic risk assessment index.

[0028] In some embodiments, risk trend coefficients and multimodal signals can be fused based on a preset fusion formula, and the overall risk assessment of the system can be performed based on various risk assessment features of different types to generate a comprehensive index as the dynamic risk assessment index of the system. The dynamic risk assessment index can be a comprehensive score that is updated in real time, such as a dynamic risk score, which is used to comprehensively reflect the potential impact of system failures, real-time risk changes and the global state of the system. The larger the value of the dynamic risk assessment index, the more unstable the system is and the higher the risk.

[0029] Correspondingly, risk trend coefficients and multimodal signals can be fused and processed based on linear weighted average, weighted linear fusion model, machine learning model (such as random forest, neural network), rule engine (such as: if A and B then C), etc., to output the current dynamic risk assessment index of the system.

[0030] For example, a dynamic rating algorithm can be used to take contextual signals from multiple dimensions as input, and through a multi-stage signal processing and fusion model, output a dynamic risk score within a specified range (e.g., 0-100) to quantify the overall risk level of the system in real time, so as to facilitate decision-making and root cause localization.

[0031] Step 104: Determine the real-time alarm level of the system based on the alarm intervals corresponding to the dynamic risk assessment indicators.

[0032] The real-time alarm level is dynamically adjusted based on the real-time collected multimodal signals over the duration. This allows the system to display the alarm severity level at the current moment, which changes dynamically over the duration of the initial alarm, rather than being a fixed level corresponding to the initial alarm information.

[0033] In some embodiments, for example, the value range of the dynamic risk assessment indicator can be divided into several continuous intervals, each interval corresponding to an alarm level.

[0034] For example, the dynamic risk assessment index has a value range of (0-100). (0-39) can be classified as low risk level and output prompt information; (40-59) can be classified as medium risk level and output warning information; (60-79) can be classified as high risk level and output important alarm information; and (80-100) can be classified as severe risk level and output emergency alarm information. In this way, dynamic values ​​that comprehensively reflect the potential impact of system failures, real-time risk changes and the global status of the system are obtained, thereby significantly reducing alarm noise, improving the accuracy and operability of alarms, and accurately focusing the attention of operation and maintenance.

[0035] By applying the technical solution of this application embodiment, this embodiment can extract multimodal signals based on monitoring data after receiving the initial system alarm, perform signal processing on the risk trend signal in the multimodal signal, obtain the risk trend coefficient within the duration corresponding to the initial alarm information, and use it to judge the intensity of the deterioration trend of the abnormal system state. Then, the risk trend coefficient is fused with the multimodal signal to obtain a dynamic risk assessment index that comprehensively reflects the potential impact of system failure, real-time risk changes and the global state of the system. Finally, the real-time alarm level of the current system is determined according to the alarm interval, and the alarm severity level of the system at the current moment is dynamically displayed within the duration of the initial alarm, thereby quantifying the overall risk level of the system in real time, improving the accuracy and operability of the alarm, and accurately focusing the attention of operation and maintenance.

[0036] To further illustrate, as Figure 1 The specific implementation process of the method shown may optionally involve obtaining the risk trend signal corresponding to the initial alarm information, including: obtaining the risk trend slope of the risk trend signal corresponding to the initial alarm information; if the risk trend slope is positive, it is determined that the dynamic risk of the system is deteriorating; if the risk trend slope is negative, it is determined that the dynamic risk of the system is decreasing.

[0037] Optionally, the multimodal signal may include, but is not limited to, initial alarm severity, alarm source weight, service vulnerability factor, and duration factor. In response to receiving the initial alarm information from the system, based on the system's monitoring data, the corresponding multimodal signal is extracted. Specifically, this may include: determining the initial alarm severity in the multimodal signal according to the alarm event type corresponding to the initial alarm information and the preset initial scores corresponding to different alarm event types; obtaining the alarm source corresponding to the initial alarm information and determining the alarm source weight in the multimodal signal according to the business system to which the alarm source belongs; determining the service vulnerability factor in the multimodal signal according to the number of healthy instances and the total number of instances in the cluster corresponding to the initial alarm information; and determining the duration factor in the multimodal signal according to the alarm duration corresponding to the initial alarm information.

[0038] For example, such as Figure 2As shown, a multimodal signal contains at least the following input factors: 1) Initial alarm severity (base severity S_base): Determined based on a predefined initial score (0-100) for the alarm event type; 2) Alarm source weight (business importance weight W_importance): can be a coefficient greater than 0, determined according to the importance of the business or system module to which the alarm source belongs. For example, the weight of the core payment system can be set to 2.0, and the weight of the internal test system can be set to 0.5, which is lower than the weight of the core payment system. 3) Service Vulnerability Factor (F_vulnerability): This can be a coefficient greater than or equal to 1, calculated based on the proportion of unhealthy instances in the currently affected service cluster. The formula is: F_vulnerability = 1 + (1 - number of healthy instances / total number of instances). The lower the proportion of healthy instances, the larger the factor, indicating a more vulnerable system. If all instances are healthy, the factor is 1 (the base value, representing all healthy instances). 4) Risk Trend Signal (Growth Trend Signal T_trend): This can be a single numerical value, obtained by linearly fitting the time series of the indicator that triggered the alarm (e.g., data from the past 10 minutes). A positive slope indicates that the system indicator is deteriorating, while a negative slope indicates that the system is recovering. This signal can be normalized. 5) Duration factor (D_duration): can be a function that increases with time, such as max(1.0, log10(duration_in_minutes + 1)), where duration_in_minutes can be the alarm duration. The longer the alarm duration, the larger this factor becomes, but the growth rate gradually slows down.

[0039] Optionally, step 102 may specifically include: performing linear fitting on the indicator time series within the duration corresponding to the initial alarm information to obtain the risk trend signal corresponding to the initial alarm information; filtering the risk trend signal using a filter to obtain the risk filtered signal corresponding to the risk trend signal; and performing interval mapping on the risk filtered signal based on the nonlinear activation function corresponding to the risk filtered signal to obtain the risk trend coefficient within the duration corresponding to the initial alarm information.

[0040] Optionally, the risk trend signal can be filtered using a filter to obtain a risk-filtered signal corresponding to the risk trend signal. Specifically, this may include: smoothing the risk trend signal using a low-pass filter; obtaining the risk-filtered signal corresponding to the smoothed risk trend signal, whereby the risk-filtered signal is used to determine the trend direction of the smoothed risk trend signal.

[0041] In some embodiments, risk trend signals can be trend filtered and enhanced, as follows: (1) Apply a first-order low-pass filter (such as exponential weighted moving average) to the T_trend signal to smooth short-term jitter, capture the continuous trend direction, and obtain the smoothed trend value T_trend_smooth; (2) Transform T_trend_smooth using a non-linear activation function (such as the Tanh function) to map it to the interval [-1, 1], and convert it into a trend enhancement coefficient K_trend = 1 + α × transform(T_trend_smooth), which serves as the risk trend coefficient for the duration corresponding to the initial alarm information, where α is a configurable gain coefficient. When the trend continues to deteriorate, K_trend > 1, which can amplify the overall risk score.

[0042] Optionally, the risk trend coefficient can be fused with multimodal signals to obtain dynamic risk assessment indicators for the system. This includes fusing the initial alarm severity, alarm source weight, service vulnerability factor, duration factor, and risk trend coefficient to obtain dynamic risk assessment indicators for the system.

[0043] In some embodiments, a preset fusion formula can be used to fuse the filtered and enhanced risk trend coefficient with other factors in the multimodal signal. The preset fusion formula can be expressed as: Score_dynamic = S_base × W_importance × F_vulnerability × K_trend × D_duration; Here, Score_dynamic can be a dynamic risk score based on the risk trend coefficient and multimodal signal fusion. This formula reflects the multiplicative effect of each factor, rather than the additive effect. For example, even if the base severity S_base is high, if F_vulnerability is low (takes 1) and the system importance is low, the final score will not be significantly improved; conversely, if a moderate severity alarm (moderate S_base) occurs in a core system (high W_importance) and (high F_vulnerability), its risk will be multiplicatively amplified.

[0044] Optionally, fusing the risk trend coefficient with multimodal signals to obtain the system's dynamic risk assessment indicators may also include: using a preset risk prediction model to generate the system's dynamic risk assessment indicators based on the initial alarm severity, alarm source weight, service vulnerability factor, duration factor, and risk trend coefficient; or, constructing a fuzzy inference rule base corresponding to the multimodal signals and generating the system's dynamic risk assessment indicators based on the fuzzy inference rule base.

[0045] As one possible implementation, the initial alarm severity, alarm source weight, service vulnerability factor, duration factor, and risk trend coefficient corresponding to business importance, redundancy capability, growth trend, and duration can be used as features and input into a lightweight machine learning model (such as gradient boosting tree GBDT or small neural network) for regression or classification, directly outputting a dynamic risk score or real-time alarm level.

[0046] As another possible implementation, a fuzzy set (e.g., "high", "medium", "low") can be defined for each input factor (e.g., "IF business importance is high AND redundancy is low THEN risk is extremely high"). Finally, a precise risk score is output by defuzzification. This can generate a more accurate risk score that is more in line with human expert thinking during the system alarm response process.

[0047] Further optional features include dynamically adjusting the threshold ranges for each alarm level based on historical alarm data; calculating performance, security, and availability levels for multiple alarm levels; and configuring automated response actions for different alarm levels. For example, when the alarm level is classified as "severe risk," the system can trigger an automatic rollback to a previous version and send an operation prompt message such as "System risk is extremely high, automatic rollback has been performed." The system can also update the display color of the service status panel, such as red for severe system risk and blue for high risk.

[0048] In a specific application scenario, such as a transaction-based system where the "Housing Provident Fund Contribution Information Inquiry Service" microservice (defined as a "general" business, with a weight W_importance=0.8) consists of 10 instances, the monitoring system detected that the average response time of this service was continuously rising, exceeding the 800ms threshold (S_base=60 for this event type). The dynamic alarm classification process for this scenario is as follows: 1. Initial moment (t0): Alarm triggered; The input factors corresponding to multimodal signals include: S_base=60; W_importance=0.8; F_vulnerability: All 10 instances are healthy, F_vulnerability = 1.0 (Calculation method: 1 + (1 - number of healthy instances / total number of instances)). K_trend: The data in the past 5 minutes just exceeded the threshold. The trend slope T_trend is a slightly positive slope. After filtering and transformation, K_trend≈1.05. D_duration=max(1.0,log10(0+1))=1; Calculate the dynamic risk score Score_dynamic at time t0: 60×0.8×1×1.05×1≈50.4; Rating: The score ∈ [40, 60) is mapped to the real-time alarm level corresponding to the score as "Warning".

[0049] 2. After 5 minutes (t1): The alarm continues and the situation worsens; The input factors corresponding to multimodal signals include: F_vulnerability: One instance was kicked out by the load balancer due to slow response, leaving 9 healthy instances. F_vulnerability = 1 + (1 - 9 / 10) = 1.1; K_trend: Response time is still steadily increasing, K_trend ≈ 1.25; D_duration = max(1.0,log10(5+1))=1; Calculate the dynamic risk score Score_dynamic at time t1: 60×0.8×1.1×1.25×1≈66; Rating: If the score is in the range [60, 80), the real-time alarm level corresponding to that score is "important".

[0050] 3. 10 minutes later (t2): The situation continues to deteriorate; The input factors corresponding to multimodal signals include: F_vulnerability: One more instance has failed, leaving 8 healthy instances. F_vulnerability = 1 + (1 - 8 / 10) = 1.2; K_trend: Response time spikes dramatically, K_trend≈1.8; D_duration =max(1.0,log10(10+1))≈1.0; Calculate the dynamic risk score Score_dynamic at time t2: 60 × 0.8 × 1.2 × 1.8 × 1.0 ≈ 103.68 -> Clamp 100; Rating: Score = 100, the real-time alarm level corresponding to this score is "emergency".

[0051] Compared to static methods in related technologies that only generate a single, fixed "important" alarm, the method in this embodiment can linearly fit the time series of indicators within the duration corresponding to the initial alarm information to obtain the risk trend signal corresponding to the initial alarm information. Then, a filter is used to filter the risk trend signal to obtain the corresponding risk-filtered signal. Next, based on the nonlinear activation function corresponding to the risk-filtered signal, interval mapping is performed on the risk-filtered signal to obtain the risk trend coefficient within the duration corresponding to the initial alarm information. Based on this coefficient and multimodal signal fusion, a dynamic risk assessment index is obtained, enabling real-time alarm classification of system risks. This dynamically reflects changes in risk and accurately alerts maintenance personnel to escalating risks based on factors such as cluster health, importance, and duration, avoiding premature escalation of risks. It truly obfuscates urgent alarms, enabling dynamic and intelligent alarm grading. Alarm grades can be dynamically calculated and adjusted based on the real-time operating context of the system (such as redundancy, trends, and importance), making alarm priorities more closely aligned with actual risks. It significantly reduces alarm noise by introducing multi-dimensional factors and filtering, effectively suppressing excessive alarms for non-critical and transient anomalies, freeing operations personnel from massive amounts of low-value alarms. It highlights genuine risks and accelerates fault response by weighting and amplifying faults in core businesses, non-redundant services, and continuously deteriorating faults, ensuring that high-priority issues receive the highest priority. It improves operational efficiency by providing the operations team with intelligently sorted and categorized alarm information, reducing the cost of manual judgment, avoiding alarm fatigue, and improving overall operational efficiency and system stability.

[0052] Furthermore, embodiments of this application provide an alarm rating device, such as... Figure 3 As shown, the device includes: a receiving module 31, an acquisition module 32, and a determining module 33.

[0053] The receiving module 31 is configured to extract the corresponding multimodal signal of the system based on the system's monitoring data in response to receiving the initial alarm information of the system. The acquisition module 32 is configured to perform signal processing on the risk trend signal in the multimodal signal to obtain the risk trend coefficient within the duration corresponding to the initial alarm information; and to fuse the risk trend coefficient with the multimodal signal to obtain the dynamic risk assessment index of the system. The determination module 33 is configured as the alarm interval corresponding to the dynamic risk assessment indicator, and determines the real-time alarm level of the system. The real-time alarm level is dynamically adjusted according to the real-time collected multimodal signals during the duration.

[0054] In some embodiments, the acquisition module 32 is specifically configured to perform linear fitting on the index time series within the duration corresponding to the initial alarm information to obtain the risk trend signal corresponding to the initial alarm information; filter the risk trend signal using a filter to obtain the risk filtered signal corresponding to the risk trend signal; and perform interval mapping on the risk filtered signal based on the nonlinear activation function corresponding to the risk filtered signal to obtain the risk trend coefficient within the duration corresponding to the initial alarm information.

[0055] In some embodiments, the acquisition module 32 is specifically configured to smooth the risk trend signal using a low-pass filter; and based on the smoothed risk trend signal, acquire the risk filter signal corresponding to the risk trend signal, wherein the risk filter signal is used to determine the trend direction of the risk trend signal.

[0056] In some embodiments, the acquisition module 32 is specifically configured to acquire the risk trend slope of the risk trend signal corresponding to the initial alarm information; if the risk trend slope is positive, it is determined that the dynamic risk of the system is deteriorating; if the risk trend slope is negative, it is determined that the dynamic risk of the system is decreasing.

[0057] In some embodiments, the multimodal signal includes at least an initial alarm severity, an alarm source weight, a service vulnerability factor, and a duration factor. The receiving module 31 is specifically configured to: determine the initial alarm severity in the multimodal signal based on the alarm event type corresponding to the initial alarm information and the preset initial scores corresponding to different alarm event types; obtain the alarm source corresponding to the initial alarm information; determine the alarm source weight in the multimodal signal based on the business system to which the alarm source belongs; determine the service vulnerability factor in the multimodal signal based on the number of healthy instances and the total number of instances in the cluster corresponding to the initial alarm information; and determine the duration factor in the multimodal signal based on the alarm duration corresponding to the initial alarm information.

[0058] In some embodiments, the acquisition module 32 is specifically configured to fuse the initial alarm severity, alarm source weight, service vulnerability factor, duration factor and risk trend coefficient to obtain the system's dynamic risk assessment indicators.

[0059] In some embodiments, the acquisition module 32 is further configured to use a preset risk prediction model to generate dynamic risk assessment indicators for the system based on initial alarm severity, alarm source weight, service vulnerability factor, duration factor and risk trend coefficient; or to construct a fuzzy inference rule base corresponding to multimodal signals and generate dynamic risk assessment indicators for the system based on the fuzzy inference rule base.

[0060] It should be noted that other corresponding descriptions of the functional units involved in the alarm rating device provided in this application embodiment can be found by referring to... Figure 1 The corresponding descriptions in [the document] will not be repeated here.

[0061] Based on the above, Figure 1 As illustrated in the example, correspondingly, embodiments of this application also provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the above-described... Figure 1 The example method shown.

[0062] Based on the above, Figure 1 As illustrated, correspondingly, embodiments of this application also provide a computer program product, including a computer program that, when executed by a processor, implements the above-described... Figure 1 The example method shown.

[0063] Based on this understanding, the technical solutions of the embodiments of this application can be embodied in the form of a software product. The software product can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, mobile hard drive, etc.) and includes several instructions to cause a computer device (such as a personal computer, server, or network device, etc.) to execute the methods of various implementation scenarios of this application.

[0064] Based on the above, Figure 1 The method shown, and Figure 3 To achieve the above objectives, the present application also provides an electronic device, comprising a storage medium and a processor; the storage medium for storing a computer program; and the processor for executing the computer program to implement the above-described virtual device embodiments. Figure 1 The method shown.

[0065] Optionally, the aforementioned electronic device may also include a user interface, a network interface, a camera, radio frequency (RF) circuitry, sensors, audio circuitry, a Wi-Fi module, etc. The user interface may include a display screen, an input unit, etc.

[0066] Those skilled in the art will understand that the physical device structure provided in this embodiment does not constitute a limitation on the physical device, and may include more or fewer components, or combine certain components, or have different component arrangements.

[0067] The storage medium may also include an operating system and a network communication module. The operating system is a program that manages the hardware and software resources of the aforementioned physical device, supporting the operation of information processing programs and other software and / or programs. The network communication module is used to enable communication between the various components within the storage medium, as well as communication with other hardware and software in the information processing physical device.

[0068] Through the above description of the implementation methods, those skilled in the art can clearly understand that this application can be implemented by means of software plus necessary general-purpose hardware platforms, or it can be implemented by hardware. The embodiments of this application can linearly fit the time series of indicators within the duration corresponding to the initial alarm information to obtain the risk trend signal corresponding to the initial alarm information. Then, a filter is used to filter the risk trend signal to obtain the risk filtered signal corresponding to the risk trend signal. Then, based on the nonlinear activation function corresponding to the risk filtered signal, interval mapping is performed on the risk filtered signal to obtain the risk trend coefficient within the duration corresponding to the initial alarm information. Based on this coefficient and multimodal signal fusion, a dynamic risk assessment index is obtained, which is used to classify system risks in real time, dynamically reflecting changes in risk. It accurately alerts maintenance personnel to the escalation of risk based on factors such as cluster health, importance, and duration, avoiding confusion with other truly urgent alarms in the early stages. This achieves dynamic and intelligent alarm levels, where alarm levels can be dynamically calculated and adjusted according to the real-time operating context of the system (such as redundancy, trend, and importance), making alarm priorities more closely aligned with actual risks.

[0069] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the term "comprising" or any other variations thereof is intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes the element.

[0070] The above are merely specific embodiments of this application, enabling those skilled in the art to understand or implement this application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this application. Therefore, this application is not to be limited to these embodiments, but is to be accorded the widest scope consistent with the principles and novel features claimed herein.

Claims

1. An alarm classification method, characterized in that, include: In response to receiving the initial alarm information from the system, the multimodal signal corresponding to the system is extracted based on the system's monitoring data; Signal processing is performed on the risk trend signal in the multimodal signal to obtain the risk trend coefficient within the duration corresponding to the initial alarm information; The risk trend coefficient is fused with the multimodal signal to obtain the dynamic risk assessment index of the system; The real-time alarm level of the system is determined based on the alarm interval corresponding to the dynamic risk assessment index, and the real-time alarm level is dynamically adjusted according to the multimodal signals collected in real time during the duration.

2. The method according to claim 1, characterized in that, The step of processing the risk trend signal in the multimodal signal to obtain the risk trend coefficient within the duration corresponding to the initial alarm information includes: Linear fitting is performed on the time series of indicators within the duration corresponding to the initial alarm information to obtain the risk trend signal corresponding to the initial alarm information; The risk trend signal is filtered using a filter to obtain the risk filtered signal corresponding to the risk trend signal. Based on the nonlinear activation function corresponding to the risk filtering signal, the risk filtering signal is interval mapped to obtain the risk trend coefficient within the duration corresponding to the initial alarm information.

3. The method according to claim 2, characterized in that, The step of filtering the risk trend signal using a filter to obtain the risk-filtered signal corresponding to the risk trend signal includes: The risk trend signal is smoothed using a low-pass filter; Obtain the risk filter signal corresponding to the smoothed risk trend signal, and the risk filter signal is used to determine the trend direction of the smoothed risk trend signal.

4. The method according to claim 2, characterized in that, The step of obtaining the risk trend signal corresponding to the initial alarm information includes: Obtain the risk trend slope of the risk trend signal corresponding to the initial alarm information; If the slope of the risk trend is positive, then it is determined that the dynamic risk of the system is deteriorating; If the slope of the risk trend is negative, it is determined that the dynamic risk of the system is decreasing.

5. The method according to claim 1, characterized in that, The multimodal signal includes at least the initial alarm severity, alarm source weight, service vulnerability factor, and duration factor; In response to receiving the initial alarm information from the system, based on the system's monitoring data, the corresponding multimodal signal of the system is extracted, including: Based on the alarm event type corresponding to the initial alarm information and the preset initial score corresponding to different alarm event types, the initial alarm severity in the multimodal signal is determined; Obtain the alarm source corresponding to the initial alarm information, and determine the alarm source weight in the multimodal signal according to the business system to which the alarm source belongs; Based on the number of healthy instances and the total number of instances in the system corresponding to the initial alarm information, the service vulnerability factor in the multimodal signal is determined; The duration factor in the multimodal signal is determined based on the alarm duration corresponding to the initial alarm information.

6. The method according to claim 5, characterized in that, The step of fusing the risk trend coefficient with the multimodal signal to obtain the dynamic risk assessment index of the system includes: The initial alarm severity, alarm source weight, service vulnerability factor, duration factor, and risk trend coefficient are fused together to obtain the dynamic risk assessment index of the system.

7. The method according to claim 6, characterized in that, The step of fusing the risk trend coefficient with the multimodal signal to obtain the dynamic risk assessment index of the system further includes: Using a pre-defined risk prediction model, dynamic risk assessment indicators for the system are generated based on the initial alarm severity, alarm source weight, service vulnerability factor, duration factor, and risk trend coefficient; or, A fuzzy inference rule base corresponding to the multimodal signals is constructed, and a dynamic risk assessment index for the system is generated based on the fuzzy inference rule base.

8. An alarm rating device, characterized in that, include: The receiving module is configured to extract the corresponding multimodal signal of the system based on the system's monitoring data in response to receiving the initial alarm information of the system. The acquisition module is configured to perform signal processing on the risk trend signal in the multimodal signal to acquire the risk trend coefficient within the duration corresponding to the initial alarm information; The risk trend coefficient is fused with the multimodal signal to obtain the dynamic risk assessment index of the system; The determination module is configured to be the alarm interval corresponding to the dynamic risk assessment index, and determines the real-time alarm level of the system. The real-time alarm level is dynamically adjusted according to the real-time collected multimodal signals during the duration.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method of any one of claims 1 to 7.

10. An electronic device comprising a storage medium, a processor, and a computer program stored on the storage medium and executable on the processor, characterized in that, When the processor executes the computer program, it implements the method of any one of claims 1 to 7.

Images