Self-adaptive intelligent alarm processing method and system

Abstract

The invention belongs to the field of cloud computing, and provides a self-adaptive intelligent alarm processing method and system. The method comprises the following steps: acquiring original alarm data; performing grouping de-duplication processing on the original alarm data according to a service identifier and a severity level, and screening to obtain alarm data to be processed based on a preset routing rule; preprocessing the alarm data to be processed to obtain standardized alarm data and storing the standardized alarm data in a database; querying a historical alarm record related to the current alarm event from the database, and constructing multi-dimensional context information through time sequence correlation analysis and a service dependency relationship graph to obtain a context analysis result; and inputting the standardized alarm data and the context analysis result into an intelligent analysis model, and outputting a root cause positioning result and a processing suggestion. According to the invention, the alarm processing efficiency and accuracy are improved, the system reliability is enhanced, and the operation and maintenance cost is reduced.

Description

An Adaptive Intelligent Alarm Processing Method and System Technical Field

[0001] This invention belongs to the field of cloud computing technology, and in particular relates to an adaptive intelligent alarm processing method and system. Background Technology

[0002] With the widespread adoption of cloud computing and distributed architectures, IT infrastructure is growing exponentially, leading to a dramatic increase in the amount of alarm data generated during system operation. To improve the efficiency and accuracy of alarm processing, the industry has begun exploring alarm processing solutions based on intelligent technologies, using automation to reduce manual intervention and achieve rapid alarm identification, analysis, and processing.

[0003] Existing alarm handling technologies primarily rely on static threshold rules for alarm triggering, lacking the ability to dynamically adapt to historical data and business scenarios, resulting in high false alarm and false negative rates. Furthermore, current technologies lack correlation analysis of historical alarm records and service dependencies during alarm analysis, making it difficult to accurately pinpoint the root cause of faults and requiring maintenance personnel to invest significant time in manual troubleshooting. In addition, inconsistent data formats between processing components necessitate multiple data conversions and cleaning processes, hindering the real-time performance of alarm processing and failing to meet the requirements for rapid fault response. Summary of the Invention

[0004] In view of the shortcomings of the prior art, the purpose of the invention is to provide an adaptive intelligent alarm processing method and system.

[0005] This invention provides an adaptive intelligent alarm processing method, comprising: S1, acquiring raw alarm data; S2, grouping and deduplicating the raw alarm data according to service identifier and severity level, and filtering to obtain alarm data to be processed based on preset routing rules; S3, preprocessing the alarm data to be processed to obtain standardized alarm data and storing it in a database; S4, querying historical alarm records related to the current alarm event from the database, constructing multi-dimensional context information through time series correlation analysis and service dependency graph, and obtaining context analysis results; S5, inputting the standardized alarm data and the context analysis results into an intelligent analysis model, and outputting root cause localization results and processing suggestions.

[0006] According to the adaptive intelligent alarm processing method provided by the present invention, step S1 further includes: S11, collecting operating indicators of multiple monitoring instances to obtain a time-series indicator dataset; S12, performing segmented statistics on the time-series indicator dataset according to time windows, calculating the average value and standard deviation within a specified period to obtain statistical feature parameters; S13, calculating an adaptive threshold based on the statistical feature parameters using a dynamic threshold algorithm; S14, comparing the real-time collected indicator data with the adaptive threshold, and generating an alarm event when the indicator data continuously exceeds the threshold for a preset duration to obtain the original alarm data.

[0007] According to the adaptive intelligent alarm processing method provided by the present invention, the operating indicators in step S11 include: CPU utilization, memory usage and network traffic data; the original alarm data in step S14 includes: alarm name, trigger time and tag information.

[0008] According to an adaptive intelligent alarm processing method provided by the present invention, step S2 further includes: S21, extracting the service identifier field and severity level field corresponding to the original alarm data, and constructing a service dependency graph; S22, identifying root cause candidate service nodes in the service dependency graph, and determining the set of downstream service nodes affected by the alarm through a graph traversal algorithm; S23, merging multiple alarm events from the same root cause candidate service node into an initial alarm set, and deduplicating duplicate alarms in the initial alarm set to obtain a simplified alarm set; S24, obtaining alarm data to be processed by filtering the simplified alarm set according to the alarm severity level and target receiver configuration information through a routing distribution algorithm.

[0009] According to an adaptive intelligent alarm processing method provided by the present invention, step S3 further includes: S31, loading a predefined JSONSchema data structure template; S32, based on the JSONSchema data structure template, performing type matching and format verification on each of the multiple fields in the alarm data to be processed, and marking out abnormal fields that do not conform to the specifications; S33, performing anomaly processing and field completion on the abnormal fields to obtain complete alarm data; S34, converting the complete alarm data into a unified JSON format and calculating a data fingerprint as a unique identifier to obtain standardized alarm data; S35, writing the standardized alarm data into a memory cache, a distributed cache, and a persistent database through a multi-level caching architecture to achieve layered data storage.

[0010] According to the adaptive intelligent alarm processing method provided by the present invention, the JSONSchema data structure template in step S31 includes: required fields, field types, and value ranges.

[0011] According to an adaptive intelligent alarm processing method provided by the present invention, step S4 further includes: S41, retrieving similar alarm records within a specified time window in the database based on the alarm name and trigger time of the current alarm event to obtain a historical alarm dataset; S42, calculating the similarity score between each record in the historical alarm dataset and the current alarm event, and obtaining a highly relevant subset of historical alarms by filtering through a similarity threshold; S43, performing weighted processing on the highly relevant subset of historical alarms according to chronological order to obtain a time-weighted alarm sequence; S44, extracting alarm frequency trends, periodic patterns, and anomaly scores from the time-weighted alarm sequence to obtain temporal context features; S45, querying a service topology relationship database to obtain the upstream and downstream dependencies of the service to which the current alarm event belongs to obtain service dependency context features; S46, fusing the temporal context features and the service dependency context features to obtain a context analysis result.

[0012] According to an adaptive intelligent alarm processing method provided by the present invention, step S5 further includes: S51, extracting alarm details, tag information and indicator values ​​from the standardized alarm data into structured feature vectors; S52, converting the context analysis results into text descriptions to obtain text descriptions; S53, constructing analysis prompts based on the structured feature vectors and the text descriptions, wherein the analysis prompts include basic alarm information, historical pattern features, and service dependency information; S54, inputting the analysis prompts into a pre-trained deep learning model, wherein the deep learning model generates root cause localization results through contextual understanding and reasoning; S55, generating tiered processing suggestions based on knowledge base matching using the root cause localization results and the corresponding confidence scores.

[0013] According to the adaptive intelligent alarm processing method provided by the present invention, step S55 specifically includes: generating an automated script execution suggestion when the confidence score is greater than 0.9; generating a manual assisted decision suggestion when the confidence score is greater than or equal to 0.7 and less than or equal to 0.9; and generating a detailed investigation guidance suggestion when the confidence score is less than 0.7.

[0014] This invention also provides an adaptive intelligent alarm processing system, comprising: an acquisition module for acquiring raw alarm data; a filtering module for grouping and deduplicating the raw alarm data according to service identifier and severity level, and filtering to obtain alarm data to be processed based on preset routing rules; a preprocessing module for preprocessing the alarm data to be processed to obtain standardized alarm data and storing it in a database; an analysis module for querying historical alarm records related to the current alarm event from the database, constructing multi-dimensional context information through time series correlation analysis and service dependency graph, and obtaining context analysis results; and a location module configured as an intelligent analysis model for analyzing the standardized alarm data and the context analysis results, and outputting root cause location results and processing suggestions.

[0015] This invention provides an adaptive intelligent alarm processing method and system. Firstly, by employing an adaptive threshold calculation mechanism based on historical statistical characteristics, it dynamically adjusts alarm triggering conditions according to the actual system operation, effectively reducing false alarms and missed alarms caused by improper static threshold settings, thus significantly improving alarm accuracy. Secondly, by constructing a service dependency graph and combining it with time series correlation analysis to build multi-dimensional contextual information, it can comprehensively grasp the historical evolution patterns of alarm events and the influence relationships between services, thereby quickly pinpointing the true root cause of the fault and significantly shortening the fault location time. Thirdly, by standardizing alarm data and using multi-level caching, this invention eliminates data format differences between different components, avoids repetitive data conversion and cleaning operations, and achieves rapid reading and efficient flow of alarm data, significantly improving the system's real-time processing capabilities. Furthermore, this invention automatically generates root cause localization results and processing suggestions through an intelligent analysis model, and determines whether to automatically execute processing operations based on confidence scores, greatly reducing manual intervention and lowering the workload and labor costs for maintenance personnel. Overall, this invention achieves automation, intelligence, and efficiency throughout the entire alarm processing process. Attached Figure Description

[0016] The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. Throughout the drawings, the same reference numerals denote the same parts. It is obvious that the drawings described below are merely some embodiments of the present invention, and those skilled in the art can obtain other drawings based on these drawings.

[0017] Figure 1 is a schematic flowchart of an adaptive intelligent alarm processing method provided by an embodiment of the present invention; Figure 2 is a schematic structural diagram of an adaptive intelligent alarm processing system provided by an embodiment of the present invention. Detailed Implementation

[0018] To enable those skilled in the art to better understand the technical solutions in the embodiments of the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. It should be understood that these descriptions are merely exemplary and are not intended to limit the scope of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0019] Furthermore, descriptions of well-known structures and techniques are omitted in the following description to avoid unnecessarily obscuring the concepts disclosed in this invention.

[0020] In the description of this invention, it should be noted that, unless otherwise explicitly specified and limited, the terms "center," "upper," "lower," "left," "right," "vertical," "horizontal," "inner," and "outer," etc., indicating orientation or positional relationships based on the orientation or positional relationships shown in the accompanying drawings, are only for the convenience of describing the invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation, and therefore should not be construed as a limitation of the invention. Furthermore, the terms "first," "second," and "third" are used for descriptive purposes only and should not be construed as indicating or implying relative importance. The terms "installed," "connected," and "linked" should be interpreted broadly; for example, they can refer to a fixed connection, a detachable connection, or an integral connection; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; and they can refer to the internal communication of two components. Those skilled in the art can understand the specific meaning of the above terms in this invention based on the specific circumstances.

[0021] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numerals in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present invention. Rather, they are merely examples of methods and systems consistent with some aspects of the invention as detailed in the appended claims.

[0022] The embodiments of the present invention are described below with reference to the figures.

[0023] As shown in Figure 1, the present invention provides an adaptive intelligent alarm processing method, including: S1, acquiring raw alarm data.

[0024] Step S1 further includes: S11, collecting operational metrics from multiple monitoring instances to obtain a time-series metric dataset; the operational metrics include: CPU utilization, memory usage, and network traffic data.

[0025] Furthermore, this invention deploys the Prometheus monitoring component on each monitoring instance, continuously capturing system operation metrics through the component's collection interface. Specifically, the Prometheus component initiates HTTP requests to the target instance at preset collection intervals, reading exposed metric data from the instance's metrics endpoint. The collected CPU utilization data is derived by calculating the percentage of CPU time in idle mode; memory usage is calculated by reading the ratio of available system memory to total memory; and network traffic data is obtained by statistically analyzing the byte transmission and reception volume of the network interface. After each collection, Prometheus binds the metric value to the corresponding timestamp, forming time-series data points, and indexes and organizes them according to dimensions such as metric name and instance identifier, ultimately forming a time-series metric dataset containing multiple time series. This dataset, with time as the main axis, records snapshots of the operating status of each monitoring instance at different times.

[0026] S12. Perform segmented statistics on the time series index dataset according to the time window, calculate the average value and standard deviation within the specified period, and obtain statistical characteristic parameters.

[0027] In step S12, after receiving the time-series indicator dataset generated in step S11, the present invention segments the data according to a specified time window length. The time window length is set according to business characteristics; in this embodiment, 7 days is selected as the statistical period. Subsequently, the present invention extracts all data points of a specific indicator (such as CPU utilization) within the time window from the time-series indicator dataset. The values ​​of these data points are summed and divided by the total number of data points to calculate the average value within the window. Then, the present invention calculates the difference between each data point and the average value, sums the squares of all differences, divides by the total number of data points, and takes the square root to obtain the standard deviation. The standard deviation reflects the degree of data fluctuation, while the average value represents the baseline level of normal operation. The present invention saves the calculated average value and standard deviation as a set of statistical characteristic parameters. The obtained statistical characteristic root parameters characterize the operating rules and stability characteristics of the system over a historical period.

[0028] S13. Calculate the adaptive threshold using a dynamic threshold algorithm based on the statistical feature parameters.

[0029] In step S13, based on the statistical characteristic parameters obtained in step S12, the present invention uses a dynamic threshold algorithm to calculate an adaptive threshold, aiming to superimpose several times the standard deviation on the average value as the alarm trigger boundary. Specifically, the present invention first reads a preset adjustable coefficient N (initial value set to 2), then multiplies the standard deviation by this coefficient to obtain an offset, and adds the offset to the average value to obtain the value of the adaptive threshold. The obtained adaptive threshold is higher than the historical average level and takes into account the data fluctuation range, which is more in line with the actual operating characteristics of the system than a fixed threshold. When the system load mode changes, the average value and standard deviation calculated in the new time window will change accordingly, and the adaptive threshold will also be adjusted accordingly, thereby dynamically adapting to different business scenarios and load levels.

[0030] S14. Compare the real-time collected indicator data with the adaptive threshold. When the indicator data continuously exceeds the threshold for a preset duration, an alarm event is generated to obtain the original alarm data. The original alarm data includes: alarm name, trigger time, and tag information.

[0031] In step S14, the present invention continuously collects real-time indicator data and compares each newly collected indicator value with the adaptive threshold calculated in step S13. When an indicator value exceeds the threshold, the present invention starts a timer to record the duration of exceeding the threshold. If the indicator value remains in the state of exceeding the threshold for a preset time (30 seconds in this embodiment), the present invention determines it as an abnormal situation and generates an alarm event.

[0032] When generating an alarm event, this invention extracts the name of the metric that triggered the alarm as the alarm name, records the accurate timestamp of the alarm trigger as the trigger time, and collects metadata information such as instance identifier, service name, and environment identifier associated with the metric and encapsulates it into tag information.

[0033] Ultimately, this invention combines alarm name, trigger time, and tag information to form structured raw alarm data. This data fully records the basic elements of the alarm event, providing input for subsequent alarm processing procedures.

[0034] S2. The original alarm data is grouped and deduplicated according to service identifier and severity level, and the alarm data to be processed is obtained by filtering based on preset routing rules.

[0035] Step S2 further includes: S21, extracting the service identifier field and severity level field corresponding to the original alarm data, and constructing a service dependency graph.

[0036] Furthermore, this invention parses the tag information portion from the raw alarm data generated in step S14, extracts the value of the `service` field as the service identifier field, and extracts the value of the `severity` field as the severity level field. Subsequently, this invention queries the configuration management database and reads the predefined service topology relationship configuration, which records the call dependencies between various services.

[0037] This invention constructs a service dependency graph using service identifiers as nodes and service call relationships as directed edges. Each node in the graph represents a microservice or application component, and the direction of the edges indicates the direction of service calls, with upstream services pointing to downstream services. The completed service dependency graph is stored in memory as a graph data structure. Nodes contain attributes such as service identifier and service name, and edges contain weight information such as call frequency and dependency strength. The resulting graph structure displays the service call topology of the entire system.

[0038] S22. Identify root cause candidate service nodes in the service dependency graph and determine the set of downstream service nodes affected by the alarm through graph traversal algorithm.

[0039] Further, in step S22, the present invention locates the service node corresponding to the current alarm event in the service dependency graph constructed in step S21, and marks this node as a potential source of failure. Specifically, the present invention traverses all original alarm data, counts the number of alarms associated with each service node, calculates the alarm density of each node, and identifies nodes with high alarm density and located upstream in the dependency link as root cause candidate service nodes. After identifying the root cause candidate service nodes, the present invention uses a breadth-first traversal algorithm to traverse the graph structure downwards along the directed edges, starting from the node. During the traversal, the present invention adds each visited node to a set until all reachable downstream nodes have been traversed. The final set of nodes is the set of downstream service nodes affected by the alarm, and the set contains the entire service range that may be affected by the root cause service failure.

[0040] S23. Merge multiple alarm events from the same root cause candidate service node into an initial alarm set, and perform deduplication processing on duplicate alarms in the initial alarm set to obtain a simplified alarm set.

[0041] In step S23, the present invention, based on the root cause candidate service nodes identified in step S22, traverses all the original alarm data, filters out the alarm events whose service identifier field values ​​match the root cause candidate service node identifiers, and merges them into the same initial alarm set, which contains multiple alarm events generated by the same fault source.

[0042] Subsequently, this invention compares each alarm event in the initial alarm set one by one, determining whether there are duplicate alarms by comparing fields such as alarm name, instance identifier, and trigger time. When two alarm events have the same alarm name and instance identifier, and the difference in trigger time is less than a preset deduplication time window (set to 5 minutes in this embodiment), this invention determines them to be duplicate alarms, retains only the alarm event with the earliest trigger time, deletes the remaining duplicates, and obtains a simplified alarm set after deduplication. This set eliminates redundant information and retains representative events for each type of alarm.

[0043] S24. Based on the alarm severity level and target receiver configuration information, obtain alarm data to be processed by filtering the simplified alarm set through a routing distribution algorithm.

[0044] In step S24, the present invention reads the severity level field value of each alarm event from the simplified alarm set and performs a matching query according to the pre-configured routing rule table. The routing rule table defines the target recipient information corresponding to different severity levels. Critical level alarms are routed to the core operation and maintenance team, warning level alarms are routed to ordinary operation and maintenance personnel, and info level alarms are routed to the log system.

[0045] This invention uses the alarm severity level as an index key to retrieve the corresponding target recipient configuration information from the routing rule table, including the recipient's webhook address and notification channel. Subsequently, this invention employs a routing distribution algorithm to bind target recipient information to each alarm event based on the retrieval results, filtering out alarm events that need to be sent to external processing components to form a set of alarm data to be processed, thus completing the preparation for alarm routing distribution.

[0046] S3. Preprocess the alarm data to be processed to obtain standardized alarm data and store it in the database.

[0047] Step S3 further includes: S31, loading a predefined JSONSchema data structure template; the JSONSchema data structure template includes: required fields, field types, and value ranges.

[0048] Furthermore, in step S31, the present invention reads a predefined JSON Schema data structure template from a configuration file or configuration center. The template is written in JSON format and contains key fields such as title, type, required, and properties. The required field lists the names of the fields that must be included in the alarm data, and the properties field defines the data type and constraints of each field. After extraction, the present invention loads the template into memory and parses it into an object structure to provide a standard basis for subsequent data verification.

[0049] S32. Based on the JSONSchema data structure template, perform type matching and format verification on each of the multiple fields in the alarm data to be processed, and mark the abnormal fields that do not conform to the specifications.

[0050] In step S32, the present invention iterates through each field in the alarm data to be processed obtained in step S24 and performs matching and verification with the JSON Schema template loaded in step S31 one by one. The verification process includes checking whether the field exists in the required list. If a required field is missing, it is marked as an abnormal field.

[0051] Subsequently, this invention checks whether the data type of the field value is consistent with the type defined in the properties in the template, for example, verifying whether the value of the severity field is a string type. Next, this invention applies a pattern regular expression to the string type field for format validation, checks whether the value of the enum type field is within the allowed enumeration range, and verifies whether the time string of the date-time format field conforms to the standard format. All fields that fail the validation are added to the abnormal field list, and the specific reason for the validation failure is recorded to provide clear error information for subsequent exception handling.

[0052] S33. Perform exception handling and field completion on the abnormal fields to obtain complete alarm data.

[0053] Furthermore, for missing required fields, this invention first attempts to query supplementary information from the configuration management database, such as querying the corresponding instance identifier, service name, and environment identifier based on the IP address contained in the alarm. If the relevant information cannot be found in the database, this invention applies default value filling rules, assigning reasonable default values ​​according to the field type, such as setting the missing environment field to "unknown" and the missing instance field to the IP address of the alarm source. For fields with non-standard formats, this invention attempts to perform format conversion, such as parsing non-standard time strings and converting them to ISO 8601 format. For abnormal fields that cannot be repaired, this invention adds an error_flag field to the alarm data to record the abnormal details. After completion and repair, complete alarm data containing all fields is finally generated.

[0054] S34. Convert the complete alarm data into a unified JSON format and calculate the data fingerprint as a unique identifier to obtain standardized alarm data.

[0055] In step S34, the present invention receives the complete alarm data generated in step S33, and uses a JSON serialization tool to convert the data object into a JSON format string. During the conversion process, the present invention arranges the fields in a uniform order, uses UTF-8 encoding, and does not contain extra whitespace characters and newline characters.

[0056] After conversion, this invention calculates a hash value for the JSON string as a data fingerprint. It uses MD5 or SHA256 hash algorithms to process the byte sequence of the JSON string, generating a fixed-length hash digest. This hash digest serves as a unique identifier for the alarm data, used to quickly determine if data is duplicated and for data indexing. This invention encapsulates the JSON format string and the calculated data fingerprint together to form the final standardized alarm data. This data has a unified format, complete structure, and unique identifier.

[0057] S35. The standardized alarm data is written to the memory cache, distributed cache and persistent database through a multi-level caching architecture to achieve layered storage of data.

[0058] In step S35, the standardized alarm data generated in step S34 is sequentially written into a three-level cache architecture. First, the data is stored in a memory cache using a hash table structure with an LRU (Least Recently Used) eviction policy, storing the data fingerprint as the key and the standardized alarm data as the value. Then, the invention connects to the distributed cache service via a Redis client, uses the SET command to write identical key-value pairs into the Redis cache, and sets an expiration time (e.g., 1 hour). Finally, the invention establishes a connection to the MySQL database, constructs an INSERT SQL statement, and inserts the values ​​of each field of the standardized alarm data into the corresponding columns of the alerts table, using the data fingerprint as the primary key to ensure uniqueness.

[0059] In addition, the write operations of the three-level cache are executed asynchronously. The memory cache returns immediately after the write is completed, while the write operations of the distributed cache and the database are completed in a background thread, thus realizing a hierarchical data storage architecture.

[0060] Furthermore, the multi-level caching architecture set up in this invention includes: L1 cache: memory cache, response time <1ms; L2 cache: Redis cache, response time <5ms; L3 cache: database query cache, response time <50ms.

[0061] S4. Query historical alarm records related to the current alarm event from the database, construct multi-dimensional context information through time series correlation analysis and service dependency graph, and obtain context analysis results.

[0062] Step S4 further includes: S41, based on the alarm name and trigger time of the current alarm event, retrieving similar alarm records within a specified time window from the database to obtain a historical alarm dataset.

[0063] This invention reads the alarm name field and trigger time field of the current alarm event from the database stored in step S3. Then, using the trigger time of the current alarm event as a baseline, this invention calculates the starting time of the query by extrapolating backwards through a specified time window (e.g., 7 days, or 604,800 seconds). This invention constructs an SQL query statement with three filtering conditions in the WHERE clause: the alarm name field must exactly match the alarm name of the current alarm event; the trigger time field must be greater than or equal to the starting time; and the trigger time field must be less than the trigger time of the current alarm event. This invention executes the SQL query statement and retrieves all historical alarm records that meet the conditions from the alerts table. The query results returned by the database contain data on all alarm events with the same name as the current alarm within the past 7 days. Each record contains complete fields such as alarm name, trigger time, tag information, and severity level. This invention organizes these records into a list structure to form a historical alarm dataset.

[0064] S42. Calculate the similarity score between each record in the historical alarm dataset and the current alarm event, and obtain a subset of highly relevant historical alarms by filtering through the similarity threshold.

[0065] Furthermore, this invention iterates through each historical alarm record in the historical alarm dataset, comparing it one by one with the current alarm event to calculate similarity. Specifically, the similarity calculation is based on the degree of field matching across multiple dimensions. First, this invention compares the instance, service, and environment fields in the tag information, counting the number of identical fields. Then, it compares whether the severity level field is consistent and the lexical overlap of the alarm description text. Subsequently, this invention weights and sums the matching degrees of each dimension according to preset weights: instance field matching is assigned a weight of 0.4, service field matching a weight of 0.3, environment field matching a weight of 0.2, and other field matching a weight of 0.1, calculating a similarity score between 0 and 1. Finally, this invention reads a preset similarity threshold (e.g., 0.85) and filters out historical alarm records with similarity scores higher than this threshold, forming a highly relevant subset of historical alarms.

[0066] S43. The highly relevant historical alarm subset is weighted according to the chronological order to obtain a time-weighted alarm sequence.

[0067] In step S43, the present invention sorts the selected subset of highly relevant historical alarms in ascending order according to the trigger time field, forming an alarm sequence arranged in chronological order. Subsequently, the present invention uses an exponential decay function to calculate the time weight of each historical alarm record. Specifically, the present invention calculates the time difference (in seconds) between the trigger time of the current alarm event and the trigger time of each historical alarm record, and divides the time difference by the total length of the time window to obtain the normalized time distance. The present invention uses the natural constant e as the base and the negative time distance as the exponent to calculate the exponential decay weight value; the closer the historical alarm is to the current time, the closer its weight value is to 1, and the farther away the historical alarm is, the closer its weight value is to 0. Finally, the present invention binds the calculated weight values ​​with the corresponding historical alarm records, forming a binary structure containing alarm data and time weights. All binary pairs form a time-weighted alarm sequence in chronological order.

[0068] S44. Extract alarm frequency trends, periodic patterns, and anomaly scores from the time-weighted alarm sequence to obtain temporal context features.

[0069] In step S44, this invention extracts alarm frequency trend features from the time-weighted alarm sequence obtained in step S43, divides the time window into multiple time periods (e.g., 7 time periods per day), and counts the number of alarms in each time period to form an alarm frequency time series. Subsequently, this invention calculates the rate of change of the number of alarms in adjacent time periods to determine whether the alarm frequency is trending upwards, downwards, or stable. Next, this invention extracts periodic pattern features, performs a Fourier transform on the alarm frequency time series, identifies significant periodic components, and detects the existence of daily or weekly periodic alarm patterns. Then, this invention calculates anomaly scores by comparing the trigger frequency of the current alarm event with the historical average frequency, calculating the degree of deviation; the greater the deviation, the higher the anomaly score. Finally, this invention combines and encapsulates the three types of features—alarm frequency trend, periodic pattern, and anomaly score—to form a time-series context feature data structure.

[0070] S45. Query the service topology database to obtain the upstream and downstream dependencies of the service to which the current alarm event belongs, and obtain the service dependency context features.

[0071] In step S45, the present invention extracts the value of the service field from the tag information of the current alarm event as the target service identifier. After extraction, the present invention connects to the service topology relationship database, which stores the call dependency relationships between services in the microservice architecture.

[0072] Subsequently, this invention constructs a query statement, using the target service identifier as the query condition, to retrieve all upstream service records where the service is the callee, and simultaneously retrieve all downstream service records where the service is the caller. The query results returned by the database include a list of upstream service identifiers and a list of downstream service identifiers, with each service identifier associated with attribute information such as service name, call frequency, and dependency type.

[0073] This invention further queries the operational status data of upstream and downstream services, including indicators such as service health status, current load level, and number of recent alarms. Ultimately, this invention integrates and organizes the upstream and downstream dependencies of the target service and the operational status of dependent services to form a service dependency context feature data structure.

[0074] S46. The temporal context features and the service dependency context features are fused to obtain the context analysis results.

[0075] This invention receives the temporal context features generated in step S44 and the service dependency context features generated in step S45, and performs data fusion processing on the two types of features. Specifically, this invention creates a context analysis result object, which contains three main fields: alert_details, temporal_context, and service_context. Subsequently, this invention fills the alert_details field with the complete data of the current alarm event; fills the temporal_context field with subfields such as alarm frequency trend, periodic pattern, and anomaly score from the temporal context features, and also adds the summary information of highly relevant historical alarm subsets (including the number of historical alarms, the time of the most recent alarm, etc.) to this field; then, this invention fills the service_context field with subfields such as the upstream service list, downstream service list, and dependent service status from the service dependency context features. After this invention completes the field filling, the entire context analysis result object is serialized into JSON format data, which fully aggregates the multi-dimensional context information of the current alarm.

[0076] S5. Input the standardized alarm data and the context analysis results into the intelligent analysis model, and output the root cause localization results and processing suggestions.

[0077] Step S5 further includes: S51, extracting alarm details, tag information and indicator values ​​from the standardized alarm data into structured feature vectors.

[0078] This invention parses the alarm details from the standardized alarm data generated in step S3, extracting the `alert_name` and `description` field values ​​to form the alarm description text. Subsequently, it extracts the `instance`, `service`, and `environment` field values ​​from the tag information, and extracts quantitative indicators such as current CPU utilization, memory usage, and network traffic from the numerical metrics. This invention performs lexical encoding on the extracted text fields, using a pre-trained word vector model to convert each word into a fixed-dimensional vector representation, and averages and pools multiple word vectors for the same field to obtain the vector representation of that field. Next, this invention normalizes the extracted numerical fields, mapping them to a value range of 0 to 1. Finally, this invention concatenates the vector representations of all fields in a fixed order to form a high-dimensional structured feature vector, which fully encodes the feature information of the alarm data.

[0079] S52. Convert the context analysis results into a text description to obtain a text description.

[0080] This invention receives the context analysis results generated in step S46 and performs text conversion processing on the structured data therein. First, this invention processes the `temporal_context` field, reading alarm frequency trend data. If the trend value is positive, it generates the text "Alarm frequency is on the rise"; if the trend value is negative, it generates the text "Alarm frequency is on the fall". Next, this invention reads periodic pattern data. If periodicity is detected, it generates the text "Historical data shows a daily periodic alarm pattern"; if no periodicity is detected, it generates the text "Historical data does not show obvious periodicity". Simultaneously, this invention reads the anomaly score value and generates the text "Current alarm anomaly score is X points". Then, this invention processes the `service_context` field, reading the upstream service list and generating the text "Upstream dependent services include: Service A, Service B", and reading the downstream service list and generating the text "Downstream dependent services include: Service C, Service D". Finally, this invention connects the generated multiple text segments in logical order to form a complete text description.

[0081] S53. Construct analysis prompt words based on the structured feature vector and the text description. The analysis prompt words include basic alarm information, historical pattern features, and service dependency information.

[0082] In step S53, the present invention receives the structured feature vector obtained in step S51 and the text description obtained in step S52, and constructs analysis prompts for the intelligent analysis model. Specifically, the present invention first writes the guiding part of the prompts, including instructional text such as "Please analyze the following alarm events and locate the root cause". Then, the present invention adds a basic alarm information part, formatting the alarm name, trigger time, severity level, and alarm description from the standardized alarm data into the text format "Alarm Name: XXX, Trigger Time: XXX, Severity Level: XXX". Next, the present invention adds a historical pattern feature part, copying the content about alarm frequency trends and periodic patterns from the text description into the prompts. Then, the present invention adds a service dependency information part, copying the content about upstream and downstream dependent services from the text description into the prompts. Finally, the present invention adds output format requirements at the end of the prompts, specifying that the model needs to output fields such as root cause description, impact range, and confidence score. After organizing each part of the text according to paragraph format, a clearly structured analysis prompt text is finally formed.

[0083] S54. Input the analysis prompts into a pre-trained deep learning model, which then generates root cause localization results through contextual understanding and reasoning.

[0084] Furthermore, in step S54, the present invention uses the analysis prompt words constructed in step S53 as input text and calls the API interface of a pre-trained deep learning model. This deep learning model is based on the Transformer architecture and has been pre-trained on large-scale IT operation and maintenance text data. The present invention encodes the analysis prompt words into a token sequence and sends it to the model inference service via an HTTP request. After receiving the token sequence, the model performs contextual understanding through a multi-layer self-attention mechanism and a feedforward neural network, capturing the correlation between alarm information, historical patterns, and service dependencies. Subsequently, the decoder part of the model generates output text token by token, and the output content includes the analysis and reasoning process of the root cause of the fault and the final conclusion.

[0085] This invention receives response data returned by the model and parses the generated text content from the response. The text content is then subjected to structured parsing, extracting the text values ​​of the root cause description field, the scope of influence field, and the confidence score field, and organizing them into a root cause localization result data structure.

[0086] S55. Based on the root cause localization results and the corresponding confidence scores, generate hierarchical processing suggestions according to knowledge base matching.

[0087] Specifically, step S55 includes: generating automated script execution suggestions when the confidence score is greater than 0.9; generating manual decision-making suggestions when the confidence score is greater than or equal to 0.7 and less than or equal to 0.9; and generating detailed investigation guidance suggestions when the confidence score is less than 0.7.

[0088] In step S55, the present invention reads the confidence score value from the root cause localization result obtained in step S54 and compares this value with three preset thresholds. Specifically, when the confidence score is greater than 0.9, the present invention connects to the knowledge base database and matches the corresponding automated processing script record according to the content of the root cause description field. The knowledge base stores the mapping relationship between common fault scenarios and processing scripts. The present invention extracts information such as script path and script parameters from the matching record and generates automated script execution suggestions containing script execution commands. When the confidence score is greater than or equal to 0.7 and less than or equal to 0.9, the present invention retrieves the relevant fault handling decision tree from the knowledge base, extracts decision nodes and judgment conditions, and generates manual auxiliary decision suggestions containing multiple processing options and selection criteria. When the confidence score is less than 0.7, the present invention retrieves the fault troubleshooting checklist from the knowledge base, extracts the list of system components to be checked, log file paths, diagnostic commands, and other information, and generates detailed troubleshooting guidance suggestions containing detailed troubleshooting steps. Finally, the present invention merges the generated hierarchical processing suggestions with the root cause localization result to form a complete analysis output result.

[0089] As shown in Figure 2, the present invention also provides an adaptive intelligent alarm processing system, comprising: an acquisition module 100 for acquiring raw alarm data; a filtering module 200 for grouping and deduplicating the raw alarm data according to service identifier and severity level, and filtering to obtain alarm data to be processed based on preset routing rules; a preprocessing module 300 for preprocessing the alarm data to be processed to obtain standardized alarm data and storing it in a database; an analysis module 400 for querying historical alarm records related to the current alarm event from the database, constructing multi-dimensional context information through time series correlation analysis and service dependency graph, and obtaining context analysis results; and a location module 500, which is configured as an intelligent analysis model for analyzing the standardized alarm data and the context analysis results, and outputting root cause location results and processing suggestions.

[0090] In one specific embodiment, the system of the present invention consists of six core components, forming a layered and decoupled collaborative architecture, including: a data acquisition layer: Prometheus is responsible for collecting monitoring metrics and triggering alarm rules; an alarm processing layer: Alertmanager is responsible for alarm grouping, deduplication, and routing; a data standardization layer: alertsnitsh is responsible for cleaning, formatting, and storing alarm data; a data storage layer: MySQL is responsible for persistent storage of alarm data; an intelligent analysis layer: Deepseek is responsible for context-based alarm root cause analysis; and a workflow orchestration layer: Dify is responsible for workflow orchestration and result distribution.

[0091] This invention, relying on an innovative adaptive intelligent architecture and context-aware analysis mechanism, achieves full automation and intelligence in alarm processing. The adaptive intelligent architecture encompasses a collaborative design of multiple components, including a data acquisition layer and an alarm processing layer, and can automatically adjust processing strategies based on alarm characteristics and historical data. The context-aware analysis algorithm constructs a multi-dimensional analysis context through historical data association and pattern recognition, and improves the accuracy of root cause analysis by combining time series and service dependency analysis. Simultaneously, a strict data standardization and verification mechanism ensures data quality, and a high-performance concurrent processing mechanism enables real-time processing of large-scale alarms. Compared with existing technologies, this invention has significant advantages in terms of intelligence and adaptability.

[0092] With the help of the above-mentioned technological innovations, this invention achieves multiple core benefits: key indicators such as alarm processing response time, root cause analysis accuracy, and false alarm rate are significantly optimized; system availability is significantly improved and fault recovery efficiency is increased; manual intervention rate and operation and maintenance manpower costs are significantly reduced; at the same time, the system's intelligence, adaptability, and scalability are enhanced, providing an efficient and reliable solution for enterprise IT operation and maintenance.

[0093] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the embodiments of the present invention, and are not intended to limit them. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in the present invention should be included within the protection scope of the present invention.

Claims

1. An adaptive intelligent alarm processing method, characterized in that, include: S1. Obtain raw alarm data; S2. The original alarm data is grouped and deduplicated according to service identifier and severity level, and the alarm data to be processed is obtained by filtering based on preset routing rules; S3. The alarm data to be processed is preprocessed to obtain standardized alarm data and stored in the database; S4. Query historical alarm records related to the current alarm event from the database, and construct multi-dimensional context information through time series correlation analysis and service dependency graph to obtain context analysis results; S5. Input the standardized alarm data and the context analysis results into the intelligent analysis model, and output the root cause localization results and processing suggestions.

2. The adaptive intelligent alarm processing method according to claim 1, characterized in that, Step S1 further includes: S11, collecting operational metrics from multiple monitoring instances to obtain a time-series metric dataset; S12, segmenting the time-series metric dataset into time windows for statistical analysis, calculating the average and standard deviation within a specified period to obtain statistical feature parameters; S13, calculating an adaptive threshold based on the statistical feature parameters using a dynamic threshold algorithm; S14, comparing the real-time collected metric data with the adaptive threshold, and generating an alarm event when the metric data continuously exceeds the threshold for a preset duration to obtain the original alarm data.

3. The adaptive intelligent alarm processing method according to claim 2, characterized in that, The operational metrics in step S11 include: CPU utilization, memory usage, and network traffic data; the raw alarm data in step S14 includes: alarm name, trigger time, and tag information.

4. The adaptive intelligent alarm processing method according to claim 1, characterized in that, Step S2 further includes: S21, extracting the service identifier field and severity level field corresponding to the original alarm data, and constructing a service dependency graph; S22, identifying root cause candidate service nodes in the service dependency graph, and determining the set of downstream service nodes affected by the alarm through a graph traversal algorithm; S23, merging multiple alarm events from the same root cause candidate service node into an initial alarm set, and deduplicating duplicate alarms in the initial alarm set to obtain a simplified alarm set; S24, obtaining alarm data to be processed by filtering from the simplified alarm set according to the alarm severity level and target receiver configuration information through a routing distribution algorithm.

5. The adaptive intelligent alarm processing method according to claim 1, characterized in that, Step S3 further includes: S31, loading a predefined JSONSchema data structure template; S32, based on the JSONSchema data structure template, performing type matching and format verification on each of the multiple fields in the alarm data to be processed, and marking out abnormal fields that do not conform to the specifications; S33, performing exception handling and field completion on the abnormal fields to obtain complete alarm data; S34, converting the complete alarm data into a unified JSON format and calculating a data fingerprint as a unique identifier to obtain standardized alarm data; S35, writing the standardized alarm data into a memory cache, a distributed cache, and a persistent database through a multi-level caching architecture to achieve layered data storage.

6. The adaptive intelligent alarm processing method according to claim 5, characterized in that, The JSON Schema data structure template in step S31 includes: required fields, field types, and value ranges.

7. The adaptive intelligent alarm processing method according to claim 1, characterized in that, Step S4 further includes: S41. Based on the alarm name and trigger time of the current alarm event, retrieve similar alarm records within a specified time window in the database to obtain a historical alarm dataset; S42. Calculate the similarity score between each record in the historical alarm dataset and the current alarm event, and filter by a similarity threshold to obtain a subset of highly relevant historical alarms; S43. Perform weighted processing on the subset of highly relevant historical alarms according to chronological order to obtain a time-weighted alarm sequence; S44. Extract alarm frequency trends, periodic patterns, and anomaly scores from the time-weighted alarm sequence to obtain temporal context features; S45. Query the service topology relationship database to obtain the upstream and downstream dependencies of the service to which the current alarm event belongs, and obtain service dependency context features; S46. Fuse the temporal context features and the service dependency context features to obtain the context analysis result.

8. The adaptive intelligent alarm processing method according to claim 1, characterized in that, Step S5 further includes: S51, extracting alarm details, tag information, and indicator values ​​from the standardized alarm data into structured feature vectors; S52, converting the context analysis results into text descriptions to obtain text descriptions; S53, constructing analysis prompts based on the structured feature vectors and the text descriptions, wherein the analysis prompts contain basic alarm information, historical pattern features, and service dependency information; S54, inputting the analysis prompts into a pre-trained deep learning model, which generates root cause localization results through contextual understanding and reasoning; S55, generating tiered processing suggestions based on knowledge base matching using the root cause localization results and corresponding confidence scores.

9. The adaptive intelligent alarm processing method according to claim 8, characterized in that, Step S55 specifically includes: generating automated script execution suggestions when the confidence score is greater than 0.9; generating manual decision-making suggestions when the confidence score is greater than or equal to 0.7 and less than or equal to 0.9; and generating detailed investigation guidance suggestions when the confidence score is less than 0.

7.

10. An adaptive intelligent alarm processing system, characterized in that, Includes: Acquisition module: used to acquire raw alarm data; Filtering module: used to group and deduplicate the original alarm data according to service identifier and severity level, and filter to obtain alarm data to be processed based on preset routing rules; Preprocessing module: used to preprocess the alarm data to be processed, obtain standardized alarm data and store it in the database; Analysis module: used to query historical alarm records related to the current alarm event from the database, construct multi-dimensional context information through time series correlation analysis and service dependency graph, and obtain context analysis results; The positioning module is configured as an intelligent analysis model to analyze the standardized alarm data and the context analysis results, and output the root cause positioning results and processing suggestions.

Images