Method for recommending alarm processing sequence based on alarm correlation

Abstract

The invention discloses a method for recommending an alarm processing sequence based on alarm correlation, which comprises the following steps of: S1, screening historical alarm transaction data according to a configured rule, and taking the historical alarm transaction data as an analysis object; s2, performing scanning grouping on alarms in combination with an FP-growth algorithm, and storing alarm frequent items; s3, taking each alarm as a node, calculating a condition mode base of the alarm, introducing a confidence coefficient formula, and removing the alarm lower than a confidence coefficient threshold value; s4, when batch alarms occur in the system, performing ascending processing according to support degrees of the alarms in historical data, calculating associated alarm items of the current alarm through the alarm frequent item set, performing grouping matching on the alarm associated items, and calculating a score of current matching according to confidence; and S5, recommending a frequent alarm set according to the score, and promoting an alarm processing sequence according to an alarm set sequence. The problem that the processing sequence cannot be rapidly judged when operation and maintenance personnel trigger a large number of alarms at the same time is solved.

Description

Technical Field

[0001] This invention relates to a method for batch alarm processing in a system, and more particularly to a method for recommending the order of alarm processing based on alarm correlation. Background Technology

[0002] With the widespread adoption of monitoring platforms, corresponding alarm monitoring is added to various levels of software systems, resulting in an increasing number of alarm messages that operations and maintenance personnel need to handle daily. Simultaneously, as service architectures become more complex, system problems can trigger simultaneous alarm messages from all related services and upper-layer applications. Therefore, identifying key alarms amidst this complexity and providing the most reasonable order for handling existing alarms to save operations and maintenance personnel time in troubleshooting and locating invalid alarms has become a key task in improving their operational efficiency.

[0003] The following are the recommended technical solutions for alarms: Option 1: Priority sorting method based on alarm association rules; This solution categorizes alarm association rules, recognizing the implicit relationships between alarms within these rules. When applying rules, sub-alarms within a successfully matched alarm association rule are not included in subsequent matching. After obtaining the pre-configured alarm association rules to be sorted, an alarm association graph is constructed based on the implicit relationships between alarms within the rules. Then, following the principle of maximizing alarm compression, the matching priority of the obtained alarm association rules is sorted according to the hierarchical relationship reflected in the alarm association graph, prioritizing lower-level alarm association rules over higher-level ones.

[0004] This solution primarily uses preset alarm association rules to obtain all current alarm information and match it with these rules. Based on the preset relationships, an alarm association graph is constructed, and the obtained alarms are prioritized according to the hierarchical relationships in the graph. However, this solution relies on the preset alarm association rules. For newly occurring alarms that are not included in the rules, it cannot automatically generate corresponding matching rules. Alarm priority matching depends on expert experience and cannot fully utilize existing alarm information to automatically generate alarm matching rules.

[0005] Option 2: A method for determining alarm handling priority; This solution establishes a first mapping relationship, a second mapping relationship, and a third mapping relationship. Upon receiving an alarm message, it extracts network element information and alarm codes from the alarm message. Based on the extracted network element information and the established first mapping relationship, it determines the geographical impact of the current alarm. Based on the extracted alarm codes and the established second mapping relationship, it determines the service impact of the current alarm. Based on the determined geographical impact, service impact, and the third mapping relationship (the relationship between geographical impact, service impact, and alarm processing priority), it determines the processing priority of the current alarm.

[0006] This solution primarily relies on alarm information to extract alarm network element information to determine the affected region and services. By using pre-set first and second mapping relationships and generating a third mapping relationship, it determines the size of the current alarm's impact range and prioritizes the processing of the alarm based on the impact range. However, this method is mainly used to determine the size of the alarm's impact range and cannot confirm whether the current alarm is a related alarm. The processing order is not strongly correlated with the impact range, and it cannot effectively advance the processing priority for related alarms caused by underlying alarms.

[0007] As can be seen from the above, existing technical solutions mainly rely on preset alarm association rules or the alarm impact range to determine the alarm processing priority when sorting the software alarm processing order. This processing method is mainly unable to effectively recommend the processing order for a large number of alarms occurring at the same time, and it mainly relies on preset information, and cannot fully explore and utilize historical alarm processing experience. Summary of the Invention

[0008] The technical problem to be solved by this invention is to provide a method for recommending the order of alarm processing based on alarm correlation. When a large number of alarm messages appear in the monitoring system and there are correlations between the alarms, the method can intelligently recommend the order of alarm processing based on the alarm content and asset relationships, thus solving the problem that maintenance personnel cannot quickly determine the processing order when a large number of alarms are triggered at the same time.

[0009] To address the aforementioned technical problems, this invention provides a method for recommending alarm processing order based on alarm correlation, comprising the following steps: S1. Filtering historical alarm transaction data according to configured rules, using historical alarm data as the analysis object; S2. Scanning and grouping alarms using the FP-growth algorithm, and storing frequent alarm items in FP-TREE format; S3. Calculating the conditional pattern base of each alarm as a node, and introducing a confidence formula to remove alarms below the confidence threshold; S4. When a batch of alarms occurs in the system, processing them in ascending order according to their support in historical data, calculating the associated alarm items of the current alarm through the frequent alarm itemset, grouping and matching the associated alarm items, and calculating the score of the current match based on the confidence; S5. Recommending frequent alarm sets according to the scores, and advancing the alarm processing order according to the order of the alarm sets.

[0010] Furthermore, the rules configured in step S1 include the start time of historical alarm analysis, the time range related to alarms, the minimum number of alarms to be analyzed, and the asset-related range of alarms; step S1 groups existing historical alarms according to specified rules and counts all alarm sets that meet the filtering rules as the analysis objects.

[0011] Further, in step S1, the historical alarm start time and recovery time are used as the X-axis and Y-axis respectively, and a time period is specified as the configured alarm-related time range. Alarms with alarm start time less than the first alarm start time plus the specified alarm time period are filtered by the alarm start time as the dimension. At the same time, based on the alarm set filtered by the start time, alarms with the first recovery alarm start time plus the specified alarm time period are filtered by the alarm recovery time as the dimension to generate the current alarm set M.

[0012] Further, in step S1, it is determined whether the current alarm set M meets the minimum number of alarms to be analyzed. If it does, the alarm set M is stored as the original transaction data related to alarms. If it does not meet the minimum number of alarms to be analyzed, the alarm time period on the X-axis is shifted again to find the next first alarm. At the same time, the alarm time period on the Y-axis is shifted to the alarm first recovery start time that meets the conditions. The alarm information is then filtered again until the latest data is analyzed.

[0013] Furthermore, in step S1, the distance from the origin to the alarm point is used as a recommended reference value for the alarm processing order. Specifically, all P values ​​in the current calculation time period are divided by the smallest P value to obtain the recommended reference value for the alarm processing order. , where st is the difference between the alarm time and the origin time, and et is the difference between the alarm recovery time and the alarm origin time.

[0014] Further, step S2 performs a first scan on the selected historical alarm transaction data to obtain the support of each alarm and filter out data that does not meet the minimum support; and performs a second sort on the filtered original alarm relevance data; based on the sorted alarm data, an FP-tree is constructed, the sorted alarm dataset is scanned, the root node is defaulted to root, and alarm items are inserted into the FP-tree in sequence; if the path already exists, the count is incremented; otherwise, a new path is created, and all relevant alarm information is stored in the FP-tree manner.

[0015] Furthermore, the confidence threshold in step S3 is 0.6.

[0016] Further, step S4 includes: using the current alarm as a condition, matching the alarm frequent item set generated by the mining module, which includes the current alarm frequent item set as N, where W is the confidence score of the alarm frequent item set set. Using the confidence score as the weight, the current alarm set is compared with the alarm frequent item set. The number of identical alarm sets is n=M∩N, and the proportion of identical alarms in the frequent items is R=n / N×100%; the proportion of matching alarms in all current alarms is Q=n / M×100%, and the matching rate between the current alarm and the mined alarm frequent item set is PV=(2×Q×R) / (Q+R)×100%; calculating the matching score of each frequent item set as SCORE = PV×W, take the intersection n of the alarms with the highest current alarm score, and perform a second calculation on the unmatched alarms (Mn) and alarm items. Similarly, find the corresponding frequent itemsets of alarms. For alarms that do not match a frequent itemset, the score is set to 100 as the highest processing priority. For alarms that have matched a frequent itemset, the alarms are processed in order according to the processing order reference value P in the frequent itemset.

[0017] Compared with existing technologies, the present invention has the following advantages: The method for recommending alarm processing order based on alarm correlation provided by the present invention, when a large number of alarm messages occur simultaneously, filters historical alarms according to the filtering rules configured in the filtering module to obtain the original data for judging the correlation of historical alarms. At the same time, the FP-growth algorithm is used to mine historical alarms and construct an FP tree. Meanwhile, a frequent set of related alarms is generated for each alarm. The reliability of the correlation rules is judged by the confidence level. The existing alarms are grouped according to the frequent set of alarms. Based on the historical alarm recovery order, a more reasonable alarm processing order is provided for operation and maintenance personnel, thereby improving the processing efficiency of operation and maintenance personnel. Attached Figure Description

[0018] Figure 1 This is a flowchart illustrating the alarm processing sequence recommendation based on alarm correlation according to the present invention. Figure 2 This is a schematic diagram of the coordinates for the historical alarm analysis of this invention; Figure 3This is an example diagram of the FP-TREE alarm item in the sample data of this invention. Detailed Implementation

[0019] The present invention will now be further described with reference to the accompanying drawings and embodiments.

[0020] Figure 1 This is a flowchart illustrating the alarm processing order recommendation based on alarm correlation according to the present invention.

[0021] Please see Figure 1 The method for recommending alarm processing order based on alarm correlation provided by the present invention includes the following steps: S1. Filter historical alarm transaction data according to the configured rules, and use historical alarm data as the analysis object; S2. Combine the FP-growth algorithm to scan and group alarms, and store frequent alarm items in FP-TREE format; S3. Using each alarm as a node, calculate the conditional pattern basis of the alarm, and introduce a confidence formula to remove alarms that are below the confidence threshold. S4. When a batch of alarms occur in the system, the alarms are processed in ascending order according to their support in historical data. The related alarm items of the current alarm are calculated through the frequent alarm itemset. The related alarm items are grouped and matched, and the score of the current match is calculated based on the confidence level. S5. Recommend frequent alarm sets according to scores, and advance the alarm processing order according to the alarm set order, saving maintenance personnel time to troubleshoot invalid alarms and improving the efficiency of fault and alarm handling.

[0022] The historical alarm filtering module of this invention is mainly used to configure historical alarm filtering set rules, including information such as the start time of historical alarm analysis, the relevant time range of alarms, the minimum number of alarms to be analyzed, and the relevant asset range of alarms. It is used to group existing historical alarms according to specified rules, thereby statistically analyzing all alarm sets that meet the filtering rules.

[0023] like Figure 2 As shown, the historical alarm start time and recovery time are used as the X-axis and Y-axis, respectively. The specified time period is the configured alarm-related time range. Alarms with alarm start time less than the first alarm start time plus the specified time period are filtered by the alarm start time as the dimension. At the same time, the alarm set filtered based on the start time is further filtered by the alarm recovery time as the dimension, and alarms with the first recovery alarm start time plus the specified time period are filtered to generate the current alarm set M.

[0024] For the selected set M, it is determined whether it meets the minimum number of alarms for analysis. If it does, set M is stored as the original transaction data for alarm correlation. If it does not meet the minimum number of alarms for analysis, the alarm time period on the X-axis is shifted again to find the next first alarm. Similarly, the alarm time period on the Y-axis is shifted to the first recovery start time of the alarm that meets the conditions. Following the above logic, the alarm information is filtered again until the latest data is analyzed. Similarly, when a new alarm occurs and has been recovered, the alarm data is updated to the original transaction data for alarm correlation for subsequent alarm correlation mining.

[0025] The alarm start and recovery times are recorded to determine the alarm start time and recovery time. The judgment logic of this invention is based on the fact that if the alarm times are the same, the alarm with the earlier recovery time is given priority. If the recovery times are the same, the alarm with the earlier recovery time is given priority. As can be seen from the coordinate graph, for alarms within a specified time period, the reference value is the straight-line distance from the origin to the alarm point. The shorter the distance, the higher the priority level.

[0026] Reference values ​​for calculation and processing order: Where st is the difference between the alarm time and the origin time, and et is the difference between the alarm recovery time and the alarm origin time. All P-values ​​for the current calculation period are divided by the smallest P-value. This is used for alarm sequence reference value convergence and stored in the original transaction data of alarm correlation for subsequent alarm processing.

[0027] The alarm correlation mining module of this invention scans and mines historical alarm data, generates FP-trees from related alarm data, and generates corresponding frequent alarm itemsets based on conditional pattern bases. Through frequent alarm itemsets, it generates all possible correlation judgment rules, and filters usability correlation rules by calculating the confidence of each correlation rule. These rules are used as reference rules for alarm grouping recommendations when generating alarms.

[0028] The following is a data mining example, where A represents host IO alarms, B represents host CPU alarms, C represents Tomcat thread count alarms, D represents BES thread count alarms, E represents system request response time alarms, F represents system error rate alarms, and G represents system request volume alarms.

[0029] Table 1. Sample Historical Alarm Data The original transaction data of historical alarm relevance is obtained through the rule configuration module. The data is scanned for the first time to obtain the support of each alarm (i.e., the frequency of the alarm in the original dataset). Data that does not meet the minimum support (default is 2, which can be customized) is filtered out. Alarm G does not meet the minimum support, so this alarm is filtered out. The original alarm relevance data is sorted a second time according to the alarm information support, where the alarm support is A:4, E:4, F:3, B:2, C:2, D:2.

[0030] Table 2 Sample data reordered by support Based on the sorted alarm support, the head pointer table is first initialized, then corresponding transactions are inserted one by one, and finally the chain table of the head pointer table is updated to construct an FP-tree. The sorted alarm dataset is scanned, with the root node being the default root, and alarm items are inserted into the FP-tree sequentially. If a path already exists, the count is incremented; otherwise, a new path is created, and all relevant alarm information is stored using the FP-tree. Each conditional pattern base is generated, and the confidence of each conditional pattern set is filtered, with a default filtering threshold of 0.6 (customizable), generating a set of all conditional pattern bases that meet the conditions.

[0031] The FP-growth algorithm is used to construct frequent itemsets for alarms. Taking alarm item C (Tomcat thread count alarm) as an example, the corresponding frequent itemset is calculated as follows:

[0032] Table 3 Frequent itemsets after alarm item C was mined Taking frequent itemset 1 as an example, we can derive 7 derivation rules: {A}->{C}, {E}->{C}, {F}->{C}, {A、E}->{C}, {A、F}->{C}, {E、F}->{C}, and {A、E、F}->{C}. The confidence calculation formula is as follows: ; The confidence scores for the example rules are: {A}->{C}=1, {E}->{C}=0.25, {F}->{C}≈0.67, {A、E}->{C}≈0.33, {A、F}->{C}=1, {E、F}->{C}=0.5, {A、E、F}->{C}=1; For rules with a confidence level less than 0.6, frequent itemset 1 yields associated alarm sets {A}, {A,F}, and {A,E,F}. Similarly, the intersection of the frequent itemset derivation rule for set 2 and set 1 is {A,F}. The frequent itemsets for each alarm node can be calculated similarly, except for the first node, which has no frequent itemsets.

[0033] The alarm recommendation module of this invention mainly performs statistics on all unrecovered alarms when a batch of alarms occur, and sorts the existing alarms according to the processing priority based on the relevant rules generated by the mining module, and prioritizes the alarm triggering points to improve alarm processing efficiency.

[0034] During the fault, the alarm information is M. Based on the current alarm, the alarm frequent item set generated by the matching mining module is used. This set includes the current alarm frequent item set N, where W is the set confidence of the alarm frequent item set. Using the confidence as the weight, the current alarm set is compared with the alarm frequent item set. The set of the same alarm is n (n=M∩N), and the proportion of the same alarm among the frequent items is R (R=n / N×100%).

[0035] The percentage of matching alarms in all current alarms is Q (Q=n / M×100%), and the matching rate between current alarms and frequently accessed alarm itemsets is PV (PV=(2×Q×R) / (Q+R)×100%). The matching score for each frequently accessed itemset is calculated as SCORE = PV×W. The intersection n of the alarms with the highest current alarm score is taken. Simultaneously, the unmatched alarms (Mn) and alarm items are recalculated. Similarly, the corresponding frequently accessed alarm itemsets are found. For alarms that do not match any frequently accessed itemsets, the score is set to 100, which is the highest processing priority. For alarms with matched frequently accessed itemsets, processing is advanced according to the reference value P, which indicates the processing order within the frequently accessed itemsets. The smaller the value, the higher the processing priority.

[0036] When a new alarm is triggered, all currently unrecovered alarms are reordered according to the above steps, and the processing order of the latest alarms and the current alarms is updated in real time. This provides a reliable reference for the alarm processing order when dealing with a batch of alarms, thereby improving alarm processing efficiency.

[0037] The method for recommending alarm processing order based on alarm correlation provided by this invention has the following substantial features and effects: 1) This invention introduces the alarm initial time and time range, counts the number of alarms, combines the alarm first recovery and time range to obtain the alarm set, calculates the alarm processing recommendation value P by the alarm response time and alarm occurrence time, and adds processing advancement value tags to the alarms in the frequent itemset.

[0038] 2) This invention analyzes and mines historical alarm data based on the FP-growth algorithm to construct frequent itemsets of historical alarms. At the same time, it calculates the confidence of each alarm rule, filters frequent itemsets of alarms through confidence thresholds, and automatically generates frequent itemsets of alarms for related alarms based on historical alarms, thus fully mining the value of historical alarms and improving the accuracy of related alarm classification.

[0039] 3) This invention introduces alarm coordinates for the first time and uses the distance from the origin to the alarm point as a recommended reference value for alarm processing order. Combined with the frequent itemsets and confidence scores generated from the mined data, the current alarm is scored for the frequent matching set. Based on the score, the current alarm is matched with the most similar alarm set. Combined with the alarm processing recommendation value, the accuracy of alarm processing order is improved.

[0040] Although the present invention has been disclosed above with reference to preferred embodiments, it is not intended to limit the present invention. Any person skilled in the art can make some modifications and improvements without departing from the spirit and scope of the present invention. Therefore, the scope of protection of the present invention shall be defined by the claims.

Claims

1. A method for recommending alarm processing order based on alarm correlation, characterized in that, Includes the following steps: S1. Filter historical alarm transaction data according to the configured rules, and use historical alarm data as the analysis object; S2. Combine the FP-growth algorithm to scan and group alarms, and store frequent alarm items in FP-TREE format; S3. Using each alarm as a node, calculate the conditional pattern basis of the alarm, and introduce a confidence formula to remove alarms that are below the confidence threshold. S4. When a batch of alarms occur in the system, the alarms are processed in ascending order according to their support in historical data. The related alarm items of the current alarm are calculated through the frequent alarm itemset. The related alarm items are grouped and matched, and the score of the current match is calculated based on the confidence level. S5. Recommend frequently triggered alarm sets based on scores, and proceed with the alarm processing order according to the order of the alarm sets.

2. The method for recommending alarm processing order based on alarm correlation as described in claim 1, characterized in that, The rules configured in step S1 include the start time of historical alarm analysis, the time range of alarms, the minimum number of alarms to be analyzed, and the asset-related range of alarms. Step S1 groups existing historical alarms according to the specified rules and counts all alarm sets that meet the filtering rules as the analysis objects.

3. The method for recommending alarm processing order based on alarm correlation as described in claim 2, characterized in that, Step S1 uses the historical alarm start time and recovery time as the X-axis and Y-axis respectively, and specifies the time period as the configured alarm-related time range. It filters alarms whose alarm start time is less than the first alarm start time plus the specified alarm time period based on the alarm start time. At the same time, based on the alarm set filtered by the start time, it filters alarms whose alarm start time is less than the first recovery alarm start time plus the specified alarm time period based on the alarm recovery time, and generates the current alarm set M.

4. The method for recommending alarm processing order based on alarm correlation as described in claim 3, characterized in that, Step S1 determines whether the current alarm set M meets the minimum number of alarms to be analyzed. If it does, the alarm set M is stored as the original transaction data related to alarms. If it does not meet the minimum number of alarms to be analyzed, the alarm time period on the X-axis is shifted again to find the next first alarm. At the same time, the alarm time period on the Y-axis is shifted to the alarm first recovery start time that meets the conditions. The alarm information is then filtered again until the latest data is analyzed.

5. The method for recommending alarm processing order based on alarm correlation as described in claim 3, characterized in that, Step S1 uses the distance from the origin to the alarm point as a recommended reference value for the alarm processing order. Specifically, it divides all P values ​​in the current calculation time period by the smallest P value to obtain the recommended reference value for the alarm processing order. , where st is the difference between the alarm time and the origin time, and et is the difference between the alarm recovery time and the alarm origin time.

6. The method for recommending alarm processing order based on alarm correlation as described in claim 1, characterized in that, Step S2 involves a first scan of the selected historical alarm transaction data to obtain the support of each alarm and filter out data that does not meet the minimum support. The filtered original alarm relevance data is then sorted a second time. Based on the sorted alarm data, an FP-tree is constructed. The sorted alarm dataset is scanned, with the root node being the default. Alarm items are inserted into the FP-tree sequentially. If a path already exists, the count is incremented; otherwise, a new path is created. All relevant alarm information is stored using the FP-tree method.

7. The method for recommending alarm processing order based on alarm correlation as described in claim 1, characterized in that, The confidence threshold in step S3 is 0.

6.

8. The method for recommending alarm processing order based on alarm correlation as described in claim 1, characterized in that, Step S4 includes: using the current alarm as a condition, matching the alarm frequent item set generated by the mining module, which includes the current alarm frequent item set as N, where W is the confidence score of the alarm frequent item set set, and comparing the current alarm set with the alarm frequent item set using the confidence score as the weight. The number of the same alarm set is n=M∩N, and the proportion of the same alarm in the frequent items is R=n / N×100%. The current percentage of matching alarms among all alarms is Q = n / M × 100%, and the current alarms' frequent itemset matching rate with the discovered alarms is PV = (2 × Q × R) / (Q + R) × 100%. The score for each frequent itemset matching is calculated as SCORE = PV×W. The intersection n of the alarms with the highest current alarm score is taken. At the same time, the unmatched alarms (Mn) and alarm items are recalculated. Similarly, the corresponding frequent itemsets are found. For alarms that do not match a frequent itemset, the score is set to 100 as the highest processing priority. For alarms with matched frequent itemsets, the alarms are processed in order according to the processing order reference value P in the frequent itemset.

Images