Alarm information automatic circulation and tracking system and method based on intelligent research and judgment

Abstract

The invention provides an alarm information automatic circulation and tracking system and method based on intelligent research and judgment, and the system achieves the unified access of heterogeneous data through a multi-mode alarm collection module, and fundamentally solves a data island problem. The intelligent preprocessing module significantly suppresses the alarm storm and improves the data quality by means of semantic understanding and dynamic compression technologies. The alarm correlation analysis module realizes deep insight from isolated alarm to an attack chain by constructing a dynamic knowledge graph, and accurately locates a root cause. The self-evolution research and judgment module is used for fusing a rule engine and machine learning and introducing closed-loop feedback, so that the system can continuously optimize decisions and automatically generate repair plans based on historical treatment experience, and therefore, the safe operation is converted into an active early warning, intelligent decision making and closed-loop tracking model from a passive response and high dependence on manpower mode; the problem of low efficiency of processing, studying and judging a large amount of alarm information is solved.

Description

Technical Field

[0001] This invention relates to the field of network service maintenance technology, and in particular to an automated alarm information flow and tracking system and method based on intelligent analysis. Background Technology

[0002] In the process of enterprise digital transformation, network architecture is often characterized by large scale, complex structure, and numerous heterogeneous devices. To ensure network security, enterprises deploy various types of security devices and monitoring systems, which generate massive amounts of multi-source, heterogeneous raw alarm information and log data every day.

[0003] Currently, the processing and operation of this security data faces problems of alarm overload and low handling efficiency. With the full integration of security devices, the number of alarms generated daily can reach hundreds of millions.

[0004] Existing systems lack effective intelligent preprocessing capabilities, making it impossible to perform semantic normalization and understanding of unstructured alarm texts, and also difficult to dynamically compress continuous and repetitive alarms based on spatiotemporal characteristics. A large number of invalid and repetitive alarms overwhelm real high-risk threats, overwhelming security operations personnel and resulting in low analysis efficiency. Summary of the Invention

[0005] This invention provides an automated alarm information flow and tracking system and method based on intelligent analysis, in order to solve the problem of low efficiency in processing and analyzing large amounts of alarm information in the prior art.

[0006] On the one hand, the present invention provides an automated alarm information flow and tracking system based on intelligent judgment, comprising: The multimodal alarm acquisition module is used to collect raw alarm information from multiple heterogeneous sources, and to standardize and encapsulate the raw alarm information to output an initial alarm event with a unified data structure. The intelligent preprocessing module is used to receive the initial alarm event, and to eliminate duplicate and redundant information by performing semantic normalization and sliding window compression on the initial alarm event, thereby generating standard alarm data carrying semantic vectors and spatiotemporal features. The alarm correlation analysis and root cause localization module is used to receive the standard alarm data, perform graph structure analysis on the spatiotemporal and semantic relationships between multiple standard alarm data, locate the root cause alarm, generate handling requirements based on the fault type and impact range of the root cause alarm, and output correlation analysis results including the root cause alarm and handling requirements. The self-evolving intelligent judgment module is used to receive the correlation analysis results and, in combination with historical work order closed-loop data, analyze the handling priority and response strategy of the standard alarm data, and output judgment instructions including dynamic priority and repair plan. The intelligent work order management module is used to receive the judgment instruction, match the handling requirements with the skill matrix of the handling node, and distribute the judgment instruction to the corresponding handling node.

[0007] Optionally, the multimodal alarm acquisition module includes: The multi-source access unit is used to: receive and parse heterogeneous raw alarm information from monitoring systems, IoT terminals, business logs and user reports, and extract raw fields containing alarm source identifiers and event descriptions; The field validation unit is used to: perform integrity checks on the original fields and complete any missing fields according to preset mapping rules; The standardized encapsulation unit is used to map the fields after verification completion to an initial alarm event with a unified structure and output it to the intelligent preprocessing module.

[0008] Optionally, the intelligent preprocessing module includes a semantic normalization unit, a dynamic compression unit, and a feature fusion unit connected in sequence: The semantic normalization unit is used to: receive the initial alarm event, and use a pre-trained language model to normalize the unstructured description text in the initial alarm event into standard fault terms, while generating the corresponding semantic vector. The dynamic compression unit is used to: identify continuous repeated alarms based on the similarity of the semantic vectors, and dynamically adjust the size of the sliding window and compress the initial alarm event according to the average processing time of similar alarms in historical work order closed-loop data to obtain a merged alarm event. The feature fusion unit is used to: extract spatiotemporal features from the merged alarm event, and fuse the merged alarm event with the semantic vector to generate standard alarm data.

[0009] Optionally, the alarm correlation analysis and root cause localization module includes a map construction unit, a root cause identification unit, and a handling requirement generation unit connected in sequence: The graph construction unit is used to: construct a dynamic knowledge graph based on the semantic associations and spatiotemporal relationships in the standard alarm data; The root cause identification unit uses a graph neural network to calculate the weights of the alarm propagation paths in the dynamic knowledge graph and locates the node with the highest weight as the root cause alarm. The disposal requirement generation unit is used to generate remediation targets and disposal requirements based on the fault type of the root cause alarm and the influence range of the root cause alarm in the dynamic knowledge graph.

[0010] Optionally, the self-evolving intelligent judgment module includes a rule parsing unit, a machine learning correction unit, a dynamic strategy generation unit, and a rule iteration unit: The rule parsing unit is used to: load rules defined based on the domain-specific language, evaluate the received association analysis results, and output a preliminary priority; The machine learning correction unit is used to: make a probabilistic prediction of the validity of the standard alarm data and correct the initial priority; The dynamic strategy generation unit is used to: calculate the dynamic priority by combining the initial priority, historical repair duration and business load, and generate a repair plan; The rule iteration unit is used to dynamically adjust the judgment parameters of the rule parsing unit based on historical work order closed-loop data through a reinforcement learning algorithm.

[0011] Optionally, the intelligent work order management module includes a skill matrix maintenance unit, a matching and distribution unit, a trajectory acquisition unit, and a processing result collection unit. The skill matrix maintenance unit is used to: construct and dynamically update a skill matrix that includes the areas of expertise and load status of the processing nodes based on historical work order closed-loop data; The matching and distribution unit is used to: match the handling requirements in the judgment instructions with the skill matrix, and dispatch work orders that integrate root cause analysis and remediation plans to the handling nodes; The trajectory acquisition unit is used to: record the operational behavior of the processing node and generate operational trajectory data; The processing result collection unit is used to: associate and integrate the operation trajectory data with the processing results fed back by the disposal node to form work order closed-loop data, and output it to the historical work order database.

[0012] Optionally, it also includes an early warning and prediction module; The early warning prediction module is used to: receive the semantic vector, spatiotemporal features of the standard alarm data and similar alarm processing records in the historical work order closed-loop data; extract fault evolution features by combining a time-series prediction model with an attention mechanism; predict the probability of occurrence and impact range of similar root cause alarms within a preset time window in the future; and obtain the prediction result. The prediction results are synchronized to the intelligent preprocessing module to dynamically adjust the compression threshold, and the prediction results are pushed to the self-evolving intelligent judgment module as a reference factor for priority determination.

[0013] Optionally, the intelligent work order management module further includes a cross-domain collaborative processing unit, which is connected to the matching and distribution unit and the processing result collection unit; The cross-domain collaborative processing unit is used to: when the processing requirement involves multiple business domains, based on the dependency relationships of the business domains in the dynamic knowledge graph, break down the processing requirement into several sub-requirements. The matching and distribution unit is used to: match the processing nodes of the business domain through the skill matrix; and dispatch the sub-requirements to the processing nodes.

[0014] Optionally, the alarm correlation analysis and root cause localization module further includes a knowledge graph self-evolution unit; The knowledge graph self-evolution unit is used to: extract handling operations from the work order closed-loop data, and transform the handling operations into new fault handling edge relationships in the dynamic knowledge graph; The weights assigned to the treatment operations are calculated using confidence levels; Outdated relationships without effective handling records are marked with a decay flag, and the weight decreases as the outdated relationship decreases by a preset decay coefficient; By combining a federated learning framework, incremental updates of the knowledge graph are received from operation and maintenance systems in the same industry or heterogeneous alarm management systems across business domains. The dynamic knowledge graph is then updated through the parameter exchange mechanism of federated learning.

[0015] On the other hand, the present invention also provides a method for automated flow and tracking of alarm information based on intelligent judgment, including: Collect raw alarm information from multiple heterogeneous sources, standardize and encapsulate the raw alarm information, and output an initial alarm event with a unified data structure. By performing semantic normalization and sliding window compression on the initial alarm events, duplicate and redundant information is eliminated, and standard alarm data carrying semantic vectors and spatiotemporal features is generated. By performing graph structure analysis on the spatiotemporal and semantic relationships among multiple standard alarm data, the root cause alarm is located, and the handling requirements are generated based on the fault type and impact range of the root cause alarm. The correlation analysis results containing the root cause alarm and the handling requirements are output. By combining historical work order closed-loop data and correlation analysis results, the processing priority and response strategy of the standard alarm data are analyzed, and judgment instructions including dynamic priority and repair plan are output. The judgment instructions are distributed to the corresponding processing nodes by matching the processing requirements with the skill matrix of the processing nodes.

[0016] On the other hand, the present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, it implements the method for automated flow and tracking of alarm information based on intelligent judgment as described above.

[0017] On the other hand, the present invention also provides a non-transitory computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the method for automated flow and tracking of alarm information based on intelligent judgment as described above.

[0018] On the other hand, the present invention also provides a computer program product, including a computer program, which, when executed by a processor, implements the method for automated flow and tracking of alarm information based on intelligent judgment as described above.

[0019] This invention provides an automated alarm information flow and tracking system and method based on intelligent analysis. The system achieves unified access to heterogeneous data through a multimodal alarm acquisition module, fundamentally solving the data silo problem. The intelligent preprocessing module, leveraging semantic understanding and dynamic compression technology, significantly suppresses alarm storms and improves data quality. The alarm correlation analysis module, by constructing a dynamic knowledge graph, achieves deep insight into the attack chain from isolated alarms, accurately locating the root cause. The self-evolving analysis module, by integrating a rule engine and machine learning and introducing closed-loop feedback, enables the system to continuously optimize decisions based on historical handling experience and automatically generate remediation plans. This transforms security operations from a passive, highly manual response model to a proactive, intelligent decision-making, and closed-loop tracking model, addressing the problem of low efficiency in handling and analyzing large volumes of alarm information. Attached Figure Description

[0020] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0021] Figure 1 This is one of the schematic diagrams of the automated flow and tracking system for alarm information based on intelligent judgment provided in the embodiments of the present invention; Figure 2 This is the second schematic diagram of the structure of the automated alarm information flow and tracking system based on intelligent judgment provided in the embodiments of the present invention; Figure 3 This is a schematic diagram of the structure of the multimodal alarm acquisition module provided in an embodiment of the present invention; Figure 4 This is a schematic diagram of the intelligent preprocessing module structure provided in an embodiment of the present invention; Figure 5 This is a schematic diagram of the alarm correlation analysis and root cause localization module provided in an embodiment of the present invention; Figure 6This is a schematic diagram of the self-evolving intelligent judgment module structure provided in an embodiment of the present invention; Figure 7 This is a schematic diagram of the intelligent work order management module structure provided in an embodiment of the present invention; Figure 8 This is a schematic diagram of the structure of the electronic device provided in an embodiment of the present invention. Detailed Implementation

[0022] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0023] Figure 1 This is one of the schematic diagrams of the automated flow and tracking system for alarm information based on intelligent judgment provided in the embodiments of the present invention.

[0024] like Figure 1 As shown in the figure, the automated alarm information flow and tracking system based on intelligent analysis provided in this embodiment of the invention includes: The multimodal alarm acquisition module 110 is used to collect raw alarm information from multiple heterogeneous sources, standardize and encapsulate the raw alarm information, and output the initial alarm event with a unified data structure.

[0025] Among them, the multimodal alarm acquisition module 110 can simultaneously receive raw alarm data from different sources through built-in multiple protocol adaptation interfaces, including but not limited to firewall system logs, cloud security platform HTTP alarms, and business monitoring system database records.

[0026] In its implementation, the multimodal alarm acquisition module 110 first performs preliminary parsing of various input alarms through a protocol parsing layer, extracting key information fields from each alarm type. For example, it extracts timestamps and event descriptions from system logs, parses source IP addresses and threat types from JSON format alarms, and retrieves error codes and occurrence times from database records. Next, through field mapping, the extracted heterogeneous fields are transformed and reorganized according to a predefined standardized data model, ensuring that all raw alarm data has a unified field structure and naming convention.

[0027] To ensure reliable data transmission, the multimodal alarm acquisition module 110 also integrates a message queue mechanism to buffer and shape alarm data during processing. Ultimately, all processed alarms are encapsulated into event objects with a unified structure. Each event contains standardized fields such as event ID, source type, threat level, and occurrence time, forming initial alarm events that can be directly used by other modules.

[0028] The intelligent preprocessing module 120 is used to receive initial alarm events, and to eliminate duplicate and redundant information by performing semantic normalization and sliding window compression on the initial alarm events, thereby generating standard alarm data carrying semantic vectors and spatiotemporal features.

[0029] Among them, the intelligent preprocessing module 120 will start the semantic normalization processing flow when it receives the initial alarm event. By using natural language processing technology, it will perform in-depth analysis on the text description in the initial alarm event, extract the semantic information in the initial alarm event, and map the semantic information to a predefined semantic space to achieve a unified representation of semantics.

[0030] Meanwhile, to effectively handle the large influx of duplicate or similar alarms within a short period, the intelligent preprocessing module 120 also introduces a sliding window compression mechanism. This mechanism sets a time window, aggregates and analyzes alarm events within that window, identifies and eliminates duplicate and redundant information, retaining only the most representative alarm data. After this processing, the initial alarm events are transformed into standard alarm data carrying semantic vectors and spatiotemporal features, providing a more accurate and efficient data foundation for subsequent analysis and judgment.

[0031] The alarm correlation analysis and root cause localization module 130 is used to receive standard alarm data, perform graph structure analysis on the spatiotemporal and semantic relationships between multiple standard alarm data, locate the root cause alarm, generate handling requirements based on the fault type and impact range of the root cause alarm, and output correlation analysis results including the root cause alarm and handling requirements.

[0032] The alarm correlation analysis and root cause localization module 130 receives standard alarm data output by the intelligent preprocessing module 120, constructs a dynamic knowledge graph containing alarm events, device nodes, and business components, and uses a graph neural network to traverse the propagation path of alarms in the dynamic knowledge graph and calculate the influence weight of each node, thereby locating the core fault point with the highest weight as the root cause alarm. Based on this, it combines the standard fault type of the root cause alarm and the range of affected business components marked in the knowledge graph to generate handling requirements that include specific repair targets, necessary pre-check items, and business recovery indicators. Finally, it outputs correlation analysis results that integrate the root cause alarm details and handling requirements, providing a basis for the subsequent priority determination and response strategy planning of the self-evolving intelligent judgment module 140.

[0033] The self-evolving intelligent judgment module 140 is used to receive correlation analysis results and, in conjunction with historical work order closed-loop data, analyze the handling priority and response strategy of standard alarm data, and output judgment instructions including dynamic priority and repair plan.

[0034] Upon receiving the correlation analysis results, the self-evolving intelligent judgment module 140 first extracts cases similar to the current alarm event from historical work order closed-loop data. These similar cases include the handling priorities, response strategies, and final processing effects of similar alarms in the past. Through deep learning and analysis of these similar cases, the self-evolving intelligent judgment module 140 can identify key factors affecting handling priorities, such as the severity of the alarm, its scope of impact, frequency of occurrence, and the differences in the effectiveness of different response strategies in practical applications.

[0035] Next, the self-evolving intelligent judgment module 140 uses an algorithm model to dynamically evaluate the handling priority of the current standard alarm data. The dynamic evaluation process not only considers the characteristics of the alarm event itself, but also combines the current system operating status, resource allocation, and historical processing experience to ensure the accuracy and practicality of the evaluation results.

[0036] After determining the handling priorities, the module further analyzes and formulates corresponding remediation plans. These plans include specific handling steps, required resources, expected processing time, and potential risks and countermeasures. By outputting judgment instructions containing dynamic priorities and remediation plans, the self-evolving intelligent judgment module 140 can provide operations and maintenance personnel with comprehensive, accurate, and actionable guidance, thereby helping them to handle alarm events more efficiently and reduce the impact of system failures on business operations.

[0037] The intelligent work order management module 150 is used to receive analysis instructions and distribute the analysis instructions to the corresponding processing nodes by matching the processing requirements with the skill matrix of the processing nodes.

[0038] The intelligent work order management module 150 allocates tasks based on multi-dimensional data, including the skill strengths of the processing nodes, their current load, and historical processing efficiency. This task allocation method not only ensures that each processing node receives tasks that match its capabilities but also dynamically adjusts task allocation to prevent some processing nodes from being overloaded while others are idle, thereby improving overall processing efficiency and resource utilization.

[0039] In some embodiments, such as Figure 3 As shown, the multimodal alarm acquisition module 110 includes: The multi-source access unit 1101 is used to receive and parse heterogeneous raw alarm information from monitoring systems, IoT terminals, business logs and user reports, and extract raw fields containing alarm source identifiers and event descriptions.

[0040] The multi-source access unit 1101 serves as the data entry point for the multimodal alarm acquisition module 110, enabling comprehensive access and preliminary analysis of heterogeneous alarm data sources. The multi-source access unit 1101 is equipped with an access protocol library adapted to monitoring systems, IoT terminals, business log systems, and user reporting channels, supporting dynamic identification and loading of HTTP, MQTT, SNMP, and Syslog protocols.

[0041] When the multi-source access unit 1101 receives raw alarm information, it calls the corresponding parser according to the data transmission protocol. For example, for sensor fault data transmitted via the MQTT protocol, the parser extracts the device number and sensor type as alarm source identifiers; for Syslog format system logs, the parser extracts the fault description text as an event description. Finally, the multi-source access unit 1101 uniformly extracts the raw fields, including alarm source identifiers and event descriptions, from various heterogeneous data.

[0042] The field validation unit 1102 is used to perform integrity checks on the original fields and to complete any missing fields according to preset mapping rules.

[0043] The field verification unit 1102 is responsible for ensuring the completeness and validity of the original alarm fields. Based on a preset list of necessary fields, the field verification unit 1102 verifies whether any of the original fields output by the multi-source access unit 1101 are missing. For example, if an alarm reported by a user only contains an event description but no alarm source identifier, it is determined to be a missing field. Then, when performing missing field completion, a preset mapping rule base is called to match the completion logic according to different data source types: if the alarm source identifier is missing and the data comes from a network device using the SNMP protocol, the device ID in the protocol can be mapped to the IP address in the preset device list as the alarm source identifier; if the event occurrence timestamp is missing, the system timestamp of the alarm received by the multi-source access unit 1101 is directly used for completion. After completion, the field verification unit 1102 also performs a standardization verification of the field format to ensure that the output fields are both complete and meet the format requirements of subsequent processing.

[0044] The standardized encapsulation unit 1103 is used to map the fields after verification and completion into initial alarm events with a unified structure and output them to the intelligent preprocessing module 120.

[0045] The standardized encapsulation unit 1103 can transform the original fields after verification and completion into an initial alarm event with a unified structure, realizing the transformation of heterogeneous data into standardized data and providing a consistent input format for the intelligent preprocessing module 120. For example, firstly, an initial alarm event structure containing a fixed set of fields is predefined. The field set specifically includes a unique event ID, alarm source type code, alarm source identifier, standardized event description, collection timestamp, and original alarm level. Then, the standardized encapsulation unit 1103 establishes a mapping table between the verified fields and the initial alarm event fields. For example, the verified alarm source identifier is directly mapped to the alarm source identifier field, and the data source type is mapped to the alarm source type code. Finally, according to the mapping table between the verified fields and the initial alarm event fields, each piece of verified and completed raw data is encapsulated into an initial alarm event with a unified structure and output to the intelligent preprocessing module 120 to eliminate the structural differences between different data sources.

[0046] In some embodiments, such as Figure 4 As shown, the intelligent preprocessing module 120 includes a semantic normalization unit 1201, a dynamic compression unit 1202, and a feature fusion unit 1203 connected in sequence. The semantic normalization unit 1201 is used to: receive the initial alarm event, and use a pre-trained language model to normalize the unstructured description text in the initial alarm event into standard fault terms, while generating the corresponding semantic vector.

[0047] The semantic normalization unit 1201 extracts a standardized event description field from the initial alarm event. The standardized event description field contains unstructured natural language text. Therefore, the unstructured text can be semantically parsed by calling a pre-trained language model based on Transformer. Through the word embedding and contextual semantic understanding capabilities of the pre-trained language model, synonyms, near-synonyms, abbreviations, or colloquial expressions can be uniformly mapped into standard fault terms.

[0048] Meanwhile, the pre-trained language model will transform the standardized text into a fixed-dimensional semantic vector. The semantic vector can quantitatively represent the semantic connotation of the alarm, providing a calculable similarity basis for the identification of repeated alarms by the dynamic compression unit 1202.

[0049] Finally, the semantic normalization unit 1201 outputs alarm intermediate data including standard fault terms and semantic vectors, which is directly sent to the dynamic compression unit 1202.

[0050] The dynamic compression unit 1202 is used to: identify continuous repeated alarms based on the similarity of semantic vectors, and dynamically adjust the size of the sliding window and compress the initial alarm event according to the average processing time of similar alarms in historical work order closed-loop data to obtain merged alarm events.

[0051] The dynamic compression unit 1202 is used to identify and compress continuous repetitive alarms, reduce invalid data transmission and storage resource occupation, and at the same time ensure a balance between compression accuracy and data integrity by dynamically adjusting the sliding window.

[0052] For example, the dynamic compression unit 1202 calculates the semantic vector similarity of intermediate data of adjacent alarms. If the semantic vector similarity is ≥90% and the standard fault terms are consistent, it is determined to be a continuous duplicate alarm. After obtaining the connected duplicate alarms, the dynamic compression unit 1202 retrieves the average processing time of alarms with similar standard fault terms from the historical work order closed-loop database. If the processing time is greater than 15 minutes, the sliding window size is set to 5 minutes, that is, duplicate alarms within 5 minutes are merged into 1. If the processing time is ≤15 minutes, the window size is set to 2 minutes to shorten the sliding window to avoid missing key alarm details. The window adjustment cycle is 1 hour to ensure adaptation to changes in historical processing efficiency. Finally, for consecutive duplicate alarms within the sliding window, the complete information of the first alarm is retained, and the repetition frequency and most recent timestamp fields are added to the merged alarm event, while the remaining duplicate data is removed. Ultimately, the dynamic compression unit 1202 outputs the merged alarm event and transmits it to the feature fusion unit 1203.

[0053] The feature fusion unit 1203 is used to: extract spatiotemporal features from the merged alarm events, and fuse the merged alarm events with semantic vectors to generate standard alarm data.

[0054] The feature fusion unit 1203 is used to extract spatiotemporal features and integrate multi-dimensional features to generate standard alarm data. For example, the feature fusion unit 1203 extracts basic attributes from the merged alarm events and further mines spatiotemporal features, which include physical location features, business link features, and time series features. The physical location features are obtained by parsing the data center number, rack location, and equipment deployment area from the alarm source identifier, such as data center A-rack 03-server 12; the business link features are obtained by matching the alarm-related business nodes through a preset alarm source business component mapping table, such as payment service-order database-server 12; and the time series features are obtained by statistically analyzing the alarm occurrence frequency within the sliding window to which the merged alarm event belongs and the frequency difference rate with the same period in history. Subsequently, during the feature fusion process, the extracted spatiotemporal features are transformed into structured fields, which are then integrated with the basic attributes of the merged alarm events and the semantic vector of the semantic normalization unit 1201 to form unified structured data containing unique alarm IDs, alarm source information, standard fault terms, semantic vectors, spatiotemporal features, and repetition frequency.

[0055] Finally, the feature fusion unit 1203 performs field format verification on the integrated data. After confirming that there are no errors, it outputs standard alarm data, which will be directly transmitted to the alarm correlation analysis and root cause localization module 130.

[0056] In some embodiments, such as Figure 5 As shown, the alarm correlation analysis and root cause localization module 130 includes a map construction unit 1301, a root cause identification unit 1302, and a handling requirement generation unit 1303 connected in sequence. The graph construction unit 1301 is used to construct a dynamic knowledge graph based on the semantic associations and spatiotemporal relationships in the standard alarm data.

[0057] The knowledge graph construction unit 1301 can transform discrete alarm data into a structured dynamic knowledge graph. When constructing the dynamic knowledge graph, entities are extracted from standard alarm data and attributes are defined, such as alarm event entities, device / component entities, and business node entities. Secondly, edge relationships between entities are generated based on the semantic associations and spatiotemporal relationships of the standard alarm data: if the semantic vector of an alarm event matches a database connection failure, and the associated business node is a payment service, then an impact edge between the alarm event and the business node is established; if the business node's payment service depends on the device entity database server A, then a dependency edge between the business node and the device entity is established; all edge relationships are assigned initial weights; finally, the knowledge graph construction unit 1301 collects newly input standard alarm data and updates the dynamic knowledge graph every preset time interval to ensure that the dynamic knowledge graph reflects the fault association status, and finally outputs the completed dynamic knowledge graph to the root cause identification unit 1302.

[0058] The root cause identification unit 1302 uses a graph neural network to calculate the weights of alarm propagation paths in the dynamic knowledge graph and locates the node with the highest weight as the root cause alarm.

[0059] The root cause identification unit 1302 can analyze alarm propagation paths and calculate node weights through graph neural networks to locate the core root cause alarms that trigger cascading alarms. Specifically, the root cause identification unit 1302 calls the message passing mechanism of the GNN, starting from all alarm event entities, traversing the influence and dependency relationships in the knowledge graph to generate a complete alarm propagation path. For example, database server A - disk full → payment service - database connection failure → client - payment timeout.

[0060] After obtaining the alarm propagation path, multi-dimensional weighting factors are introduced to calculate the weight of alarm event entities in each path. For example, weight = time decay factor × 0.4 + influence range factor × 0.3 + semantic association factor × 0.3. The time decay factor is related to the alarm occurrence time; the earlier the alarm occurs, the higher the time decay factor. The influence range factor is related to the number of business nodes associated with the alarm; the semantic association factor is related to the average semantic vector similarity of downstream alarm events. The weights are calculated using the time decay factor, influence range factor, and semantic association factor.

[0061] Finally, the entities involved in all alarm events are sorted in descending order of their combined weights, and the entity with the highest weight is selected as the root cause alarm.

[0062] The disposal requirement generation unit 1303 is used to generate remediation targets and disposal requirements based on the fault type of the root cause alarm and the impact range of the root cause alarm in the dynamic knowledge graph.

[0063] The handling requirement generation unit 1303 can formulate targeted remediation plans based on the specific circumstances of the root cause alarm. First, the handling requirement generation unit 1303 analyzes the fault type of the root cause alarm, such as hardware failure, software configuration error, or network problem, to determine the basic direction of remediation.

[0064] Next, by querying the dynamic knowledge graph, the scope of the root cause alarm's impact within the graph is clarified, that is, other business nodes and device entities affected by the root cause alarm are identified. The handling requirement generation unit 1303 will then generate specific repair targets, such as restoring the normal operation of a device, adjusting software configuration parameters, or repairing network connectivity. Simultaneously, corresponding handling requirements will be formulated, including the necessary repair tools, operating procedures, estimated repair time, and possible spare parts, to ensure that the repair work can be carried out efficiently and systematically.

[0065] In some embodiments, such as Figure 6 As shown, the self-evolving intelligent judgment module 140 includes a rule parsing unit 1401, a machine learning correction unit 1402, a dynamic strategy generation unit 1403, and a rule iteration unit 1404. The rule parsing unit 1401 is used to: load rules defined based on the domain-specific language, evaluate the received association analysis results, and output preliminary priorities.

[0066] When evaluating the received correlation analysis results, the rule parsing unit 1401 meticulously compares and analyzes various indicators and characteristics in the correlation analysis results. For example, it matches the source device type, occurrence time, and severity of alarm information with the thresholds and conditions set in the rules one by one. If a certain indicator exceeds the normal range set by the rules, or meets a specific combination of conditions, the rule parsing unit 1401 will determine that the alarm corresponding to the correlation analysis result has a corresponding preliminary priority.

[0067] The machine learning correction unit 1402 is used to: make probabilistic predictions on the validity of standard alarm data and correct the initial priority.

[0068] Specifically, the initial priority correction involves re-evaluating and adjusting the initial priority output by the rule parsing unit 1401 using a predictive model. The machine learning correction unit 1402 constructs a predictive model using historical alarm data and actual repair results as training samples. The predictive model can learn the complex relationship between different alarm features and the final repair priority, thereby correcting the initial priority given by the new correlation analysis results and improving the accuracy of priority determination.

[0069] The dynamic strategy generation unit 1403 is used to: calculate dynamic priority and generate a repair plan by combining the initial priority, historical repair duration and business load.

[0070] The calculation of dynamic priority takes into account multiple factors. The initial priority reflects the urgency of the alarm itself. Historical repair time reflects the time spent processing similar alarms in the past, providing a basis for estimating alarm processing time. Business load indicates workload; if the business load is heavy, the priority order of alarm processing may need to be adjusted. The dynamic policy generation unit 1403 derives the dynamic priority through comprehensive analysis and calculation. Simultaneously, based on the dynamic priority and the specific circumstances of the alarm, it generates a targeted repair plan.

[0071] The rule iteration unit 1404 is used to dynamically adjust the judgment parameters of the rule parsing unit 1401 based on historical work order closed-loop data through a reinforcement learning algorithm.

[0072] The adjustment of judgment parameters is primarily based on the analysis of historical work order processing results. The reinforcement learning algorithm continuously evaluates the effectiveness of the judgment parameters set by the rule parsing unit 1401 in actual work order processing. For example, a certain judgment parameter setting may improve work order processing efficiency and accuracy. By mining a large amount of historical work order closed-loop data, the reinforcement learning algorithm can identify the optimal combination of judgment parameters in different scenarios. Then, based on the analysis results, the current judgment parameters of the rule parsing unit 1401 are dynamically adjusted to ensure that the rule parsing unit 1401 can more accurately analyze and judge alarm information, further improving the performance and reliability of the entire automated alarm information flow and tracking system.

[0073] In some embodiments, such as Figure 7 As shown, the intelligent work order management module 150 includes a skill matrix maintenance unit 1501, a matching and distribution unit 1502, a trajectory acquisition unit 1503, and a processing result collection unit 1504. The skill matrix maintenance unit 1501 is used to: construct and dynamically update a skill matrix that includes the areas of expertise and load status of the processing nodes based on historical work order closed-loop data.

[0074] The skill matrix is ​​constructed by meticulously recording the expertise of each processing node, such as whether it handles network faults, maintains system security, or recovers data. It also records the node's current load status, including the number of work orders being processed and their estimated completion time. Dynamic updates adjust the skill matrix based on work order processing status and node status changes, ensuring the matrix accurately reflects the actual capabilities and status of each processing node and providing a reliable basis for precise work order matching and distribution.

[0075] The matching and distribution unit 1502 is used to match the handling requirements in the analysis instructions with the skill matrix, and to dispatch work orders that integrate root cause analysis and remediation plans to the handling nodes.

[0076] During the matching process, the matching and distribution unit 1502 first analyzes the handling requirements in the judgment instruction to clarify the business area and urgency level to be handled. Then, it compares the business area and urgency level with the areas of expertise and load status of the handling nodes recorded in the skill matrix to find the handling node that best meets the handling requirements. When dispatching a work order, the matching and distribution unit 1502 not only dispatches the work order to the selected handling node, but also integrates the root cause analysis and remediation plan derived from the alarm information into the work order, so that the handling node can quickly understand the problem and take corresponding measures.

[0077] The trajectory acquisition unit 1503 is used to record the operation behavior of the disposal node and generate operation trajectory data.

[0078] The operation trajectory data includes detailed records of every key action and decision point of the handling node during the work order processing process. This includes, but is not limited to, the work order receipt time, the start time of processing, the operation steps during processing, the tools or methods used, and the final processing result. Through the trajectory acquisition unit 1503, comprehensive monitoring and traceability of the handling node's work behavior can be achieved.

[0079] The processing result collection unit 1504 is used to: associate and integrate the operation trajectory data with the processing results fed back by the disposal node to form work order closed-loop data, and output it to the historical work order database.

[0080] When integrating data, the processing result collection unit 1504 matches the various actions and decision point information in the operation trajectory data with the processing results fed back by the disposal node according to the work order number. After forming complete work order closed-loop data, the processing result collection unit 1504 sends the work order closed-loop data to the historical work order database according to the preset data format and storage rules for subsequent data analysis.

[0081] In some embodiments, such as Figure 2 As shown, the alarm information automated flow and tracking system based on intelligent analysis also includes an early warning prediction module 160; The early warning prediction module 160 is used to: receive the semantic vector and spatiotemporal features of standard alarm data and the similar alarm processing records in historical work order closed-loop data; extract fault evolution features by combining a time series prediction model with an attention mechanism; predict the probability of occurrence and impact range of similar root cause alarms within a preset time window in the future; and obtain the prediction results. The prediction results are synchronized to the intelligent preprocessing module 120 to dynamically adjust the compression threshold, and the prediction results are pushed to the self-evolving intelligent judgment module 140 as a reference factor for priority determination.

[0082] The early warning prediction module 160 uses a time-series prediction model combined with an attention mechanism to extract fault evolution features from standard alarm data. The time-series prediction model can capture the pattern of data changes over time, while the attention mechanism can focus on features that have a significant impact on fault evolution. Then, based on the extracted fault evolution features, it predicts the probability of occurrence and the scope of impact of similar root cause alarms within a preset time window in the future, and obtains the prediction results. Finally, the prediction results are synchronized to the intelligent preprocessing module 120 to dynamically adjust the compression threshold, and the prediction results are pushed to the self-evolving intelligent judgment module 140 as a reference factor for priority determination.

[0083] In some embodiments, such as Figure 7As shown, the intelligent work order management module 150 also includes a cross-domain collaborative processing unit 1505, which is connected to the matching and distribution unit 1502 and the processing result collection unit 1504.

[0084] The cross-domain collaborative processing unit 1505 is used to: when a processing requirement involves multiple business domains, break down the processing requirement into several sub-requirements based on the dependency relationships of business domains in the dynamic knowledge graph.

[0085] The matching and distribution unit 1502 is used to: match the processing nodes of the business domain through the skill matrix; and dispatch the sub-requirements to the processing nodes.

[0086] Specifically, the cross-domain collaborative processing unit 1505 first analyzes the scope of business domains involved in the processing requirements, uses a dynamic knowledge graph to clarify the dependencies between business domains, and then reasonably breaks down the overall processing requirements into multiple sub-requirements based on the dependencies.

[0087] After receiving the sub-requirements split by the cross-domain collaborative processing unit 1505, the matching and distribution unit 1502 will accurately match the processing nodes with processing capabilities corresponding to each business domain based on its stored skill matrix information, and then accurately dispatch the sub-requirements to the corresponding processing nodes to ensure that each sub-requirement can be processed professionally and efficiently.

[0088] In some embodiments, such as Figure 5 As shown, the alarm correlation analysis and root cause localization module 130 also includes a knowledge graph self-evolution unit 1304.

[0089] The knowledge graph self-evolution unit 1304 is used to: extract handling operations from work order closed-loop data and transform the handling operations into new fault handling edge relationships in the dynamic knowledge graph.

[0090] The weights assigned to the handling operations are calculated based on the confidence level; Outdated relationships without effective handling records are marked with attenuation, where the weight decreases with each outdated relationship according to a preset attenuation coefficient; By combining the federated learning framework, it receives incremental updates of the knowledge graph from the same industry's operation and maintenance systems or heterogeneous alarm management systems across business domains, and updates the dynamic knowledge graph through the parameter exchange mechanism of federated learning.

[0091] Specifically, the handling operations are transformed into new fault handling edge relationships in the dynamic knowledge graph. For example, the parameter adjustment operation will be transformed into a new edge relationship in the graph connecting the fault node and the handling method node according to the construction rules of the knowledge graph, indicating that the parameter adjustment operation is a way to deal with network faults.

[0092] The weights assigned to handling operations are calculated by confidence level. Taking network fault handling as an example, if parameter adjustment operations have been successfully used to resolve the same type of network fault multiple times in historical data, then parameter adjustment operations will be assigned a high weight, indicating that parameter adjustment operations are highly reliable; conversely, if they are only used occasionally and the effect is not good, the weight will be low.

[0093] Outdated relationships without valid handling records are marked with decay, where the weight decreases with each outdated relationship according to a preset decay coefficient. For example, in a dynamic knowledge graph, there might be a fault handling method for older equipment. However, as equipment is upgraded, this method is rarely used and there are no new valid handling records. Therefore, the weight of the associated edge relationships will be gradually reduced according to the preset decay coefficient, and the relationships will be marked with decay.

[0094] By integrating a federated learning framework, the system receives incremental updates to the knowledge graph from industry-specific operations and maintenance (O&M) systems or heterogeneous alarm management systems across business domains. For example, an O&M system connects with other industry systems via the federated learning framework, and when other systems have knowledge graph information about handling new equipment faults, it transmits it over. Upon receiving these external knowledge graph updates, the system utilizes the parameter exchange mechanism of federated learning to integrate useful external information into the dynamic knowledge graph, thereby achieving dynamic knowledge graph updates and optimization.

[0095] The knowledge graph self-evolution unit 1304 also has the function of verifying the rationality of newly added edge relationships and weight adjustments. By analyzing the correlation between the historical work order handling effects and the newly added edge relationships, it ensures the accuracy and effectiveness of the dynamic knowledge graph. For example, if a new fault handling edge relationship for a new type of server is added, the knowledge graph self-evolution unit 1304 will analyze the effects of similar fault handling in the past to determine whether the newly added edge relationship is reasonable.

[0096] Meanwhile, when receiving incremental updates to the external knowledge graph, a data compatibility check is performed to avoid graph structure conflicts caused by differences in data from heterogeneous systems, ensuring the stable operation and continuous optimization of the dynamic knowledge graph. For example, when receiving knowledge graph updates from a heterogeneous alarm management system across business domains, the knowledge graph self-evolution unit 1304 checks whether the data format and node definitions are compatible with the dynamic knowledge graph to prevent structural conflicts from affecting the normal use of the graph.

[0097] Based on the same general inventive concept, this invention also protects an automated alarm information flow and tracking method based on intelligent judgment. The automated alarm information flow and tracking method based on intelligent judgment provided by this invention will be described below. The automated alarm information flow and tracking method based on intelligent judgment described below can be referred to in correspondence with the automated alarm information flow and tracking system based on intelligent judgment described above.

[0098] This invention also provides a method for automated flow and tracking of alarm information based on intelligent analysis, including: Collect raw alarm information from multiple heterogeneous sources, standardize and encapsulate the raw alarm information, and output initial alarm events with a unified data structure; By performing semantic normalization and sliding window compression on the initial alarm events, duplicate and redundant information is eliminated, and standard alarm data carrying semantic vectors and spatiotemporal features is generated. By performing graph structure analysis on the spatiotemporal and semantic relationships among multiple standard alarm data, the root cause alarm is located, and the handling requirements are generated based on the fault type and impact scope of the root cause alarm. The output includes the correlation analysis results containing the root cause alarm and the handling requirements. By combining historical work order closed-loop data and correlation analysis results, the handling priority and response strategy of standard alarm data are analyzed, and judgment instructions including dynamic priority and remediation plan are output. By matching the handling requirements with the skill matrix of the handling nodes, the analysis instructions are distributed to the corresponding handling nodes.

[0099] Figure 8 This is a schematic diagram of the structure of the electronic device provided in an embodiment of the present invention.

[0100] like Figure 8 As shown, the electronic device may include a processor 810, a communications interface 820, a memory 830, and a communication bus 840. The processor 810, communications interface 820, and memory 830 communicate with each other via the communication bus 840. The processor 810 can call logical instructions from the memory 830 to execute an automated alarm information flow and tracking method based on intelligent analysis.

[0101] Furthermore, the logical instructions in the aforementioned memory 830 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0102] On the other hand, the present invention also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the intelligent judgment-based automatic flow and tracking method for alarm information provided by the above methods.

[0103] In another aspect, the present invention also provides a non-transitory computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the method for automated flow and tracking of alarm information based on intelligent judgment provided by the above methods.

[0104] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0105] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0106] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. An automated alarm information flow and tracking system based on intelligent analysis, characterized in that, include: The multimodal alarm acquisition module is used to collect raw alarm information from multiple heterogeneous sources, and to standardize and encapsulate the raw alarm information to output an initial alarm event with a unified data structure. The intelligent preprocessing module is used to receive the initial alarm event, and to eliminate duplicate and redundant information by performing semantic normalization and sliding window compression on the initial alarm event, thereby generating standard alarm data carrying semantic vectors and spatiotemporal features. The alarm correlation analysis and root cause localization module is used to receive the standard alarm data, perform graph structure analysis on the spatiotemporal and semantic relationships between multiple standard alarm data, locate the root cause alarm, generate handling requirements based on the fault type and impact range of the root cause alarm, and output correlation analysis results including the root cause alarm and handling requirements. The self-evolving intelligent judgment module is used to receive the correlation analysis results and, in combination with historical work order closed-loop data, analyze the handling priority and response strategy of the standard alarm data, and output judgment instructions including dynamic priority and repair plan. The intelligent work order management module is used to receive the judgment instruction, match the handling requirements with the skill matrix of the handling node, and distribute the judgment instruction to the corresponding handling node.

2. The automated alarm information flow and tracking system based on intelligent analysis according to claim 1, characterized in that, The multimodal alarm acquisition module includes: The multi-source access unit is used to receive and parse heterogeneous raw alarm information from monitoring systems, IoT terminals, business logs and user reports, and extract raw fields containing alarm source identifiers and event descriptions. The field validation unit is used to perform integrity checks on the original fields and to complete any missing fields according to preset mapping rules. A standardized encapsulation unit is used to map the fields after verification and completion into initial alarm events with a unified structure, and output them to the intelligent preprocessing module.

3. The automated alarm information flow and tracking system based on intelligent analysis according to claim 1, characterized in that, The intelligent preprocessing module includes a semantic normalization unit, a dynamic compression unit, and a feature fusion unit connected in sequence: The semantic normalization unit is used to: receive the initial alarm event, and use a pre-trained language model to normalize the unstructured description text in the initial alarm event into standard fault terms, while generating the corresponding semantic vector. The dynamic compression unit is used to: identify continuous repeated alarms based on the similarity of the semantic vectors, and dynamically adjust the size of the sliding window and compress the initial alarm event according to the average processing time of similar alarms in historical work order closed-loop data to obtain a merged alarm event. The feature fusion unit is used to: extract spatiotemporal features from the merged alarm event, and fuse the merged alarm event with the semantic vector to generate standard alarm data.

4. The automated alarm information flow and tracking system based on intelligent analysis according to claim 1, characterized in that, The alarm correlation analysis and root cause localization module includes a map construction unit, a root cause identification unit, and a handling requirement generation unit connected in sequence: The graph construction unit is used to: construct a dynamic knowledge graph based on the semantic associations and spatiotemporal relationships in the standard alarm data; The root cause identification unit uses a graph neural network to calculate the weights of the alarm propagation paths in the dynamic knowledge graph and locates the node with the highest weight as the root cause alarm. The disposal requirement generation unit is used to generate remediation targets and disposal requirements based on the fault type of the root cause alarm and the influence range of the root cause alarm in the dynamic knowledge graph.

5. The automated alarm information flow and tracking system based on intelligent analysis according to claim 1, characterized in that, The self-evolving intelligent judgment module includes a rule parsing unit, a machine learning correction unit, a dynamic strategy generation unit, and a rule iteration unit: The rule parsing unit is used to: load rules defined based on the domain-specific language, evaluate the received association analysis results, and output a preliminary priority; The machine learning correction unit is used to: make a probabilistic prediction of the validity of the standard alarm data and correct the initial priority; The dynamic strategy generation unit is used to: calculate the dynamic priority by combining the initial priority, historical repair duration and business load, and generate a repair plan; The rule iteration unit is used to dynamically adjust the judgment parameters of the rule parsing unit based on historical work order closed-loop data through a reinforcement learning algorithm.

6. The automated alarm information flow and tracking system based on intelligent analysis according to claim 1, characterized in that, The intelligent work order management module includes a skill matrix maintenance unit, a matching and distribution unit, a trajectory acquisition unit, and a processing result collection unit. The skill matrix maintenance unit is used to: construct and dynamically update a skill matrix containing the areas of expertise and load status of processing nodes based on historical work order closed-loop data; The matching and distribution unit is used to: match the handling requirements in the judgment instructions with the skill matrix, and dispatch work orders that integrate root cause analysis and remediation plans to the handling nodes; The trajectory acquisition unit is used to: record the operational behavior of the processing node and generate operational trajectory data; The processing result collection unit is used to: associate and integrate the operation trajectory data with the processing results fed back by the disposal node to form work order closed-loop data, and output it to the historical work order database.

7. The automated alarm information flow and tracking system based on intelligent analysis according to claim 1, characterized in that, It also includes an early warning and prediction module; The early warning prediction module is used to: receive the semantic vector, spatiotemporal features of the standard alarm data and similar alarm processing records in the historical work order closed-loop data; extract fault evolution features by combining a time-series prediction model with an attention mechanism; predict the probability of occurrence and impact range of similar root cause alarms within a preset time window in the future; and obtain the prediction result. The prediction results are synchronized to the intelligent preprocessing module to dynamically adjust the compression threshold, and the prediction results are pushed to the self-evolving intelligent judgment module as a reference factor for priority determination.

8. The automated alarm information flow and tracking system based on intelligent analysis according to claim 6, characterized in that, The intelligent work order management module also includes a cross-domain collaborative processing unit, which is connected to the matching and distribution unit and the processing result collection unit. The cross-domain collaborative processing unit is used to: when the processing requirement involves multiple business domains, split the processing requirement into several sub-requirements based on the dependency relationship of the business domains in the dynamic knowledge graph; The matching and distribution unit is used to: match the processing nodes of the business domain through the skill matrix; and dispatch the sub-requirements to the processing nodes.

9. The automated alarm information flow and tracking system based on intelligent analysis according to claim 1, characterized in that, The alarm correlation analysis and root cause localization module also includes a knowledge graph self-evolution unit. The knowledge graph self-evolution unit is used to: extract handling operations from the work order closed-loop data, and transform the handling operations into new fault handling edge relationships in the dynamic knowledge graph; The weights assigned to the treatment operations are calculated using confidence levels; Outdated relationships without effective handling records are marked with a decay flag, and the weight decreases as the outdated relationship decreases by a preset decay coefficient; By combining a federated learning framework, incremental updates of the knowledge graph are received from operation and maintenance systems in the same industry or heterogeneous alarm management systems across business domains. The dynamic knowledge graph is then updated through the parameter exchange mechanism of federated learning.

10. A method for automated flow and tracking of alarm information based on intelligent analysis, characterized in that, include: Collect raw alarm information from multiple heterogeneous sources, standardize and encapsulate the raw alarm information, and output an initial alarm event with a unified data structure. By performing semantic normalization and sliding window compression on the initial alarm events, duplicate and redundant information is eliminated, and standard alarm data carrying semantic vectors and spatiotemporal features is generated. By performing graph structure analysis on the spatiotemporal and semantic relationships among multiple standard alarm data, the root cause alarm is located, and the handling requirements are generated based on the fault type and impact range of the root cause alarm. The correlation analysis results containing the root cause alarm and the handling requirements are output. By combining historical work order closed-loop data and correlation analysis results, the processing priority and response strategy of the standard alarm data are analyzed, and judgment instructions including dynamic priority and repair plan are output. The judgment instructions are distributed to the corresponding processing nodes by matching the processing requirements with the skill matrix of the processing nodes.

Images