Method and system for judging alarm event

Abstract

The invention relates to an alarm event judgment method and system, and belongs to the technical field of data processing.The method comprises the steps that under the condition that an alarm event instruction is received, target equipment receiving an alarm event is determined, and reported data of the target equipment within preset time is obtained; constructing a time sequence data matrix based on the reported data, and inputting the time sequence data matrix into the trained twin neural network model to obtain a target feature vector; calculating a first Euclidean distance between the target feature vector and a real alarm library vector, and calculating a second Euclidean distance between the target feature vector and an error report alarm library vector; and determining a judgment result of the alarm event according to a comparison result of the first Euclidean distance and the second Euclidean distance with a target threshold value. The method improves the accuracy of the judgment result of the alarm event, does not need to depend on an additional sensor, and reduces the hardware cost.

Description

Technical Field

[0001] This invention belongs to the field of data processing technology, and in particular relates to a method and system for determining alarm events. Background Technology

[0002] In related technologies, with the rapid development of information technology, the scale and complexity of various networks and information systems continue to expand, making alarm management a crucial link in ensuring stable system operation. In actual operation and maintenance scenarios, a massive number of alarm events are constantly generated, including valid alarms that truly reflect system anomalies or faults, as well as a large number of false alarms triggered by environmental interference, configuration noise, and transient fluctuations. Traditional judgment methods based on fixed rules or thresholds often lack flexibility and are difficult to adapt to dynamically changing operating environments, resulting in a high false positive rate. This forces operation and maintenance personnel to invest a great deal of effort in alarm screening and verification, which is not only inefficient but may also lead to alarm fatigue and the overlooking of real threats. Therefore, how to better determine alarm events has become an urgent problem to be solved. Summary of the Invention

[0003] In view of the shortcomings of the prior art, the purpose of the invention is to provide a method and system for determining alarm events.

[0004] In a first aspect, the present invention provides a method for determining an alarm event, comprising: S1, upon receiving an alarm event instruction, determining the target device receiving the alarm event and acquiring the reported data of the target device within a preset time period; S2, constructing a time-series data matrix based on the reported data and inputting the time-series data matrix into a trained Siamese neural network model to obtain a target feature vector; S3, calculating a first Euclidean distance between the target feature vector and a real alarm database vector, and calculating a second Euclidean distance between the target feature vector and a false alarm database vector; S4, determining the judgment result of the alarm event based on the comparison results of the first Euclidean distance, the second Euclidean distance, and a target threshold.

[0005] Furthermore, the reported data of the target device every minute within the preset time period includes sine and cosine encodings of smoke concentration, ambient temperature, and time information; wherein, constructing a time-series data matrix based on the reported data includes: arranging the reported data at each time point in the preset time according to time order to obtain the time-series data matrix; wherein each time point corresponds to a row, and each column corresponds to a feature data.

[0006] Furthermore, the architecture of the Siamese neural network model includes an input layer, an LSTM layer, a fully connected layer, an L2 normalization layer, and an output layer. The Siamese neural network model is trained as follows: Training data is acquired, consisting of multiple historical alarm event data. Each historical alarm event data includes time-series data, metadata, and labels. The time-series data includes sine and cosine encodings of smoke concentration, ambient temperature, and time information. The metadata includes device ID and user ID. A feature vector is constructed for each historical alarm event data. Triples are constructed based on the training data. The feature vectors of the triples are input into the input layer of the Siamese neural network model in batches. The input layer of the Siamese neural network model inputs the feature vectors into the LSTM layer, allowing the LSTM layer to capture the temporal dependencies of the feature vectors and output a 64-dimensional context vector. This 64-dimensional context vector is then input into the fully connected layer, where the fully connected layer performs compression and nonlinear transformation on the 64-dimensional context vector to obtain a 32-dimensional low-dimensional vector. A low-dimensional vector is input to the L2 normalization layer to normalize the 32-dimensional low-dimensional vector. Based on the normalized vector, the feature vectors fA, fP, and fN of the triple are determined, and the feature vectors fA, fP, and fN of the triple are output by the output layer, where fA represents the feature vector of the reference sample, fP represents the feature vector of the positive sample, and fN represents the feature vector of the negative sample. The Euclidean distance Dap between the feature vector of the reference sample and the feature vector of the positive sample is calculated, as is the Euclidean distance Dan between the feature vector of the reference sample and the feature vector of the negative sample. The loss function L is calculated based on L = max(Euclidean distance Dap − Euclidean distance Dan + margin, 0), and the network parameters are adjusted by gradient descent to minimize the loss function L, where margin represents a preset positive hyperparameter. Training stops when the average of multiple loss functions is less than a preset threshold or the number of training iterations reaches a preset number. Simultaneously, a target model is selected based on the F1 score on the validation set, and the target model is used as the trained Siamese neural network model.

[0007] Further, constructing triples based on the training data includes: randomly selecting one historical alarm event data from multiple historical alarm event data as the reference sample; selecting one historical alarm event data of the same type as the reference sample from multiple historical alarm event data as the positive sample; selecting one historical alarm event data of a different type from the reference sample from multiple historical alarm event data as the negative sample; constructing the triples based on the reference sample, the positive sample, and the negative sample; and determining multiple triples based on multiple sample selections.

[0008] Further, the F1 score is calculated based on 2 * precision * recall / (precision + recall); where the precision is calculated based on TP / (TP + FP), where TP represents the number of true positives and FP represents the number of false positives; where the recall is calculated based on TP / (TP + FN), where FN represents the number of false negatives; where determining the number of true positives, the number of false positives, and the number of false negatives includes: incrementing the number of true positives by one if the Euclidean distance Dap is not greater than a distance threshold, otherwise incrementing the number of false positives by one; incrementing the number of false negatives by one if the Euclidean distance Dan is not greater than the distance threshold, otherwise incrementing the number of true negatives by one.

[0009] Further, calculating the first Euclidean distance between the target feature vector and the real alarm database vectors includes: calculating the Euclidean distance between the target feature vector and each vector in the real alarm database, obtaining multiple Euclidean distance calculation results, and taking the minimum value among the multiple Euclidean distance calculation results as the first Euclidean distance; wherein, calculating the second Euclidean distance between the target feature vector and the false alarm database vectors includes: calculating the Euclidean distance between the target feature vector and each vector in the false alarm database, obtaining multiple Euclidean distance calculation results, and taking the minimum value among the multiple Euclidean distance calculation results as the second Euclidean distance; wherein, based on ||AB|| 2 Calculate the Euclidean distance between the target feature vector and each vector in the real alarm database, or calculate the Euclidean distance between the target feature vector and each vector in the false alarm database, where A represents the target feature vector, B represents a vector in the real alarm database or a vector in the false alarm database, and n represents the dimension of the feature vector. This represents the i-th component of the target feature vector. This represents the i-th component of the real alarm database or the false alarm database.

[0010] Furthermore, the target threshold includes a first threshold and a second threshold. The determination of the judgment result of the alarm event based on the comparison result of the first Euclidean distance and the second Euclidean distance with the target threshold includes: determining the alarm event as a real alarm if the first Euclidean distance is not greater than the first threshold; and determining the alarm event as a false alarm if the first Euclidean distance is greater than the first threshold and the second Euclidean distance is less than the second threshold.

[0011] A second aspect of the present invention provides an alarm event determination system, comprising: a receiving module, configured to, upon receiving an alarm event instruction, determine the target device receiving the alarm event and acquire the reported data of the target device within a preset time period; an obtaining module, configured to construct a time-series data matrix based on the reported data and input the time-series data matrix into a trained Siamese neural network model to obtain a target feature vector; a calculation module, configured to calculate a first Euclidean distance between the target feature vector and a real alarm database vector, and calculate a second Euclidean distance between the target feature vector and a false alarm database vector; and a determining module, configured to determine the judgment result of the alarm event based on the comparison result of the first Euclidean distance and the second Euclidean distance with a target threshold.

[0012] A third aspect of the present invention provides an electronic device comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor to enable the at least one processor to perform the method described in any one aspect of the present invention.

[0013] A fourth aspect of the present invention provides a non-transitory computer-readable storage medium storing computer instructions, wherein the computer instructions are used to cause the computer to perform the method described in any one of the first aspects of the present invention.

[0014] The beneficial effects of this invention are as follows: The alarm event determination method and system of this invention, upon receiving an alarm event instruction, identifies the target device receiving the alarm event and acquires the reported data from the target device within a preset time period; constructs a time-series data matrix based on the reported data and inputs the time-series data matrix into a trained Siamese neural network model to obtain a target feature vector; calculates the first Euclidean distance between the target feature vector and the actual alarm database vector, and calculates the second Euclidean distance between the target feature vector and the false alarm database vector; and determines the alarm event determination result based on the comparison result of the first and second Euclidean distances with a target threshold. This method improves the accuracy of alarm event determination results and does not rely on additional sensors, thus reducing hardware costs. Attached Figure Description

[0015] The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. Throughout the drawings, the same reference numerals denote the same parts. It is obvious that the drawings described below are merely some embodiments of the present invention, and those skilled in the art can obtain other drawings based on these drawings.

[0016] Figure 1 This is a flowchart of a method for determining alarm events according to an embodiment of the present invention; Figure 2 This is a flowchart of a method for determining alarm events according to a specific embodiment of the present invention; Figure 3 This is a schematic diagram of an alarm event determination system according to an embodiment of the present invention; Figure 4 This is a structural block diagram of an electronic device according to an embodiment of the present invention. Detailed Implementation

[0017] To enable those skilled in the art to better understand the technical solutions in the embodiments of the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. It should be understood that these descriptions are merely exemplary and are not intended to limit the scope of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0018] Furthermore, descriptions of well-known structures and techniques are omitted in the following description to avoid unnecessarily obscuring the concepts disclosed in this invention.

[0019] In the description of this invention, it should be noted that, unless otherwise explicitly specified and limited, the terms "center," "upper," "lower," "left," "right," "vertical," "horizontal," "inner," and "outer," etc., indicating orientation or positional relationships based on the orientation or positional relationships shown in the accompanying drawings, are only for the convenience of describing the invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation, and therefore should not be construed as a limitation of the invention. Furthermore, the terms "first," "second," and "third" are used for descriptive purposes only and should not be construed as indicating or implying relative importance. The terms "installed," "connected," and "linked" should be interpreted broadly; for example, they can refer to a fixed connection, a detachable connection, or an integral connection; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; and they can refer to the internal communication of two components. Those skilled in the art can understand the specific meaning of the above terms in this invention based on the specific circumstances.

[0020] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numerals in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present invention. Rather, they are merely examples of methods and systems consistent with some aspects of the invention as detailed in the appended claims.

[0021] This invention proposes a method, system, and related equipment for determining alarm events. Specifically, the method, system, and related equipment for determining alarm events according to embodiments of this invention are described below with reference to the accompanying drawings.

[0022] Figure 1 This is a flowchart of an alarm event determination method according to an embodiment of the present invention. It should be noted that the alarm event determination method of this embodiment can be applied to the alarm event determination system of this embodiment. This alarm event determination system can be configured on an electronic device or in a server. This application does not limit the scope of the invention.

[0023] like Figure 1 As shown, the method for determining alarm events includes: S110: Upon receiving an alarm event command, determine the target device receiving the alarm event and obtain the data reported by the target device within a preset time.

[0024] In an embodiment of the present invention, when an alarm event is reported on the smoke detector, i.e., when an alarm event command is received, the reported data of the smoke detector within a preset time period can be obtained. For example, if the time when the alarm event command is received is determined to be 13:00, the reported data of the smoke detector in the 10 minutes before 13:00 can be obtained.

[0025] The data reported by the target device every minute within the preset time period includes sine and cosine encodings of smoke concentration, ambient temperature, and time information.

[0026] Taking 15:30 as an example, 15:30 is converted into the number of minutes elapsed since 0:00 (15 * 60 + 30 = 930 minutes). Then, this number of minutes is mapped to the range [0, 2π]. Since there are 24 hours in a day, which is 1440 minutes, the time in radians is calculated as: (number of minutes / 1440) * 2π. Then, the sine and cosine are calculated: sine code = sin(time in radians); cosine code = cos(time in radians).

[0027] S120: Construct a time-series data matrix based on the reported data, and input the time-series data matrix into the trained Siamese neural network model to obtain the target feature vector.

[0028] In an embodiment of the present invention, upon obtaining the reported data from the target device within a predetermined time period, a time-series data matrix can be constructed based on the reported data. Specifically, the reported data at each time point within the predetermined time period is arranged chronologically to obtain the time-series data matrix; each time point corresponds to a row, and each column corresponds to a feature data point. The time-series data matrix is ​​then input into a trained Siamese neural network model to obtain the target feature vector. Specific implementation details can be found in subsequent embodiments.

[0029] S130, calculate the first Euclidean distance between the target feature vector and the true alarm database vector, and calculate the second Euclidean distance between the target feature vector and the false alarm database vector.

[0030] In an embodiment of the present invention, when the target feature vector is obtained, the Euclidean distance between the target feature vector and each vector in the real alarm database is calculated to obtain multiple Euclidean distance calculation results, and the minimum value among the multiple Euclidean distance calculation results is taken as the first Euclidean distance; and the Euclidean distance between the target feature vector and each vector in the false alarm database is calculated to obtain multiple Euclidean distance calculation results, and the minimum value among the multiple Euclidean distance calculation results is taken as the second Euclidean distance.

[0031] S140, Based on the comparison results of the first Euclidean distance, the second Euclidean distance, and the target threshold, determine the judgment result of the alarm event.

[0032] In embodiments of the present invention, the target threshold includes a first threshold and a second threshold.

[0033] In an embodiment of the present invention, given a first Euclidean distance and a second Euclidean distance, the judgment result of the alarm event can be determined by comparing the first Euclidean distance with a first threshold and comparing the second Euclidean distance with a second threshold, based on the comparison result. Specific implementation details can be found in subsequent embodiments.

[0034] According to the alarm event determination method of the present invention, upon receiving an alarm event instruction, the method first identifies the target device receiving the alarm event and acquires the reported data of the target device within a preset time period; constructs a time-series data matrix based on the reported data and inputs the time-series data matrix into a trained Siamese neural network model to obtain a target feature vector; calculates a first Euclidean distance between the target feature vector and the actual alarm database vector, and calculates a second Euclidean distance between the target feature vector and the false alarm database vector; and determines the alarm event determination result based on the comparison result of the first and second Euclidean distances with a target threshold. This method improves the accuracy of alarm event determination and does not rely on additional sensors, thus reducing hardware costs.

[0035] To enable those skilled in the art to more readily understand the present invention, Figure 2 This is a method for determining alarm events according to a specific embodiment of the present invention, such as... Figure 2 As shown, the method for determining this alarm event includes: S210: Upon receiving an alarm event command, determine the target device receiving the alarm event and obtain the data reported by the target device within a preset time.

[0036] In embodiments of the present invention, step S210 can be implemented with reference to the implementation of step S110 described above. Further details will not be provided here.

[0037] S220, constructs a time-series data matrix based on the reported data.

[0038] In an embodiment of the present invention, when the reported data of the target device within a preset time period is obtained, the reported data of each time point within the preset time period is arranged in chronological order to obtain a time-series data matrix; wherein each time point corresponds to a row and each column corresponds to a feature data.

[0039] For example, at a certain point in time, the smoke detector reports the following data: smoke concentration = 30%, temperature = 25℃, time = 15:30. The sine code for the time information is -0.795, and the cosine code for the time information is -0.606. Therefore, this row of data would be: [30, 25, -0.795, -0.606]. This process is repeated for each time point within the last 10 minutes, resulting in 10 rows, forming a 10x4 matrix. This is the time-series data matrix.

[0040] S230, Obtain the trained Siamese neural network model.

[0041] In embodiments of the present invention, the architecture of the Siamese neural network model includes an input layer, an LSTM layer, a fully connected layer, an L2 normalized layer, and an output layer.

[0042] The Siamese neural network model is trained in the following way: Acquire training data, which consists of multiple historical alarm event datasets. Each historical alarm event dataset includes time-series data, metadata, and labels. The time-series data includes sine and cosine codes for smoke concentration, ambient temperature, and time information. The metadata includes device ID and user ID. Construct feature vectors for each historical alarm event dataset. Construct triples based on the training data. Input the feature vectors of the triples into the input layer of a Siamese neural network model in batches. The input layer of the Siamese neural network model inputs the feature vectors into an LSTM layer, allowing the LSTM layer to capture the temporal dependencies of the feature vectors and output a 64-dimensional context vector. This 64-dimensional context vector is then input into a fully connected layer, where it undergoes compression and nonlinear transformation to obtain a 32-dimensional low-dimensional vector. This 32-dimensional low-dimensional vector is then input into an L2 normalization layer, where it is normalized to a length of [length missing]. 1. Based on the normalized vectors, determine the feature vectors fA, fP, and fN of the triples, and output the feature vectors fA, fP, and fN of the triples based on the output layer, where fA represents the feature vector of the reference sample, fP represents the feature vector of the positive sample, and fN represents the feature vector of the negative sample; calculate the Euclidean distance Dap between the feature vectors of the reference sample and the feature vectors of the positive sample; calculate the Euclidean distance Dan between the feature vectors of the reference sample and the feature vectors of the negative sample; calculate the loss function L based on L = max(Euclidean distance Dap − Euclidean distance Dan + margin, 0), and adjust the network parameters using gradient descent to minimize the loss function L, where margin represents a preset positive hyperparameter; stop training when the average of multiple loss functions is less than a preset threshold or the number of training iterations reaches a preset number, and simultaneously select the target model based on the F1 score on the validation set, and use the target model as the trained Siamese neural network model.

[0043] Specifically, a historical alarm event is randomly selected from multiple historical alarm event data as a reference sample; a historical alarm event of the same type as the reference sample is selected from multiple historical alarm event data as a positive sample; a historical alarm event of a different type than the reference sample is selected from multiple historical alarm event data as a negative sample; triples are constructed based on the reference sample, positive sample, and negative sample; and multiple triples are determined based on multiple sample selections.

[0044] In other words, the three samples in the triplet (reference sample A, positive sample P, negative sample N) are input into the Siamese neural network model. After passing through the network, each sample yields a fixed-dimensional feature vector, fA, fP, and fN. The Euclidean distance Dap between fA and fP, and the Euclidean distance Dan between fA and fN are calculated. To minimize the distance between samples of the same class and maximize the distance between samples of different classes, the loss function L is calculated as L = max(Euclidean distance Dap − Euclidean distance Dan + margin, 0). During training, the network parameters are adjusted using gradient descent to minimize the loss function L. This involves decreasing the Euclidean distance Dap and increasing the Euclidean distance Dan until the Euclidean distance Dan is at least greater than the margin of the Euclidean distance Dap.

[0045] During training, one batch of triples is processed at a time. Assuming a batch has three triples, the loss for the entire batch is the average loss of each triple. Training stops when the overall batch loss is less than a preset threshold. In other words, training stops when the average of multiple loss functions is less than a preset threshold.

[0046] In an embodiment of the present invention, the F1 score is calculated based on 2 * precision * recall / (precision + recall).

[0047] The accuracy is calculated based on TP / (TP+FP), where TP represents the number of true positives and FP represents the number of false positives.

[0048] The recall rate is calculated based on TP / (TP+FN), where FN represents the number of false negatives. Specifically, if the Euclidean distance *Dap* is not greater than a distance threshold, the count of true positives is incremented by one; otherwise, the count of false positives is incremented by one. Similarly, if the Euclidean distance *Dan* is not greater than a distance threshold, the count of false negatives is incremented by one; otherwise, the count of true negatives is incremented by one. This allows us to determine the total number of true positives, false positives, and false negatives.

[0049] In embodiments of the present invention, the usability of a Siamese neural network model can be evaluated based on accuracy, precision, recall, and F1 score. If usable, the model is saved and applied to Internet of Things applications.

[0050] The accuracy can be calculated based on (TP+TN) / (TP+TN+FP+FN). TN represents true negatives.

[0051] S240: Input the time series data matrix into the trained Siamese neural network model to obtain the target feature vector.

[0052] In an embodiment of the present invention, a time-series data matrix is ​​input into a trained Siamese neural network model. The input layer of the trained Siamese neural network model receives the time-series data matrix and inputs it into an LSTM layer so that the LSTM layer outputs a 64-dimensional context vector. The 64-dimensional context vector is then input into a fully connected layer so that the fully connected layer compresses and performs nonlinear transformation on the 64-dimensional context vector to obtain a 32-dimensional low-dimensional vector. The 32-dimensional low-dimensional vector is then input into an L2 normalization layer so that the L2 normalization layer normalizes the 32-dimensional low-dimensional vector. The normalized vector is then used as the target feature vector.

[0053] S250, calculate the first Euclidean distance between the target feature vector and the true alarm database vector, and calculate the second Euclidean distance between the target feature vector and the false alarm database vector.

[0054] In an embodiment of the present invention, when the target feature vector is obtained, the Euclidean distance between the target feature vector and each vector in the real alarm database is calculated to obtain multiple Euclidean distance calculation results, and the minimum value among the multiple Euclidean distance calculation results is taken as the first Euclidean distance; and the Euclidean distance between the target feature vector and each vector in the false alarm database is calculated to obtain multiple Euclidean distance calculation results, and the minimum value among the multiple Euclidean distance calculation results is taken as the second Euclidean distance.

[0055] Among them, based on ||AB|| 2 Calculate the Euclidean distance between the target feature vector and each vector in the real alarm database, or calculate the Euclidean distance between the target feature vector and each vector in the false alarm database, where A represents the target feature vector, B represents the vector in the real alarm database or the vector in the false alarm database, and n represents the dimension of the feature vector. This represents the i-th component of the target feature vector. This represents the i-th component of the real alarm database or the false alarm database.

[0056] S260, Based on the comparison results of the first Euclidean distance, the second Euclidean distance, and the target threshold, determine the judgment result of the alarm event.

[0057] In embodiments of the present invention, the target threshold includes a first threshold and a second threshold.

[0058] In an embodiment of the present invention, if a first Euclidean distance and a second Euclidean distance are obtained, and the first Euclidean distance is not greater than a first threshold, the alarm event is determined to be a real alarm; if the first Euclidean distance is greater than the first threshold and the second Euclidean distance is less than the second threshold, the alarm event is determined to be a false alarm.

[0059] In an embodiment of the present invention, if the alarm event is determined to be a genuine alarm, an emergency procedure is initiated.

[0060] In an embodiment of the present invention, if the alarm event is determined to be a false alarm, the alarm event is automatically ignored, and the false alarm event is recorded for subsequent model optimization.

[0061] In an embodiment of the present invention, if the first Euclidean distance is not greater than the first threshold, and the first Euclidean distance is greater than the first threshold and the second Euclidean distance is less than the second threshold, the alarm event is determined to be pending confirmation, that is, pushed to the manual processing interface, and the operation and maintenance personnel make a final judgment based on the on-site situation.

[0062] The alarm event determination method according to embodiments of the present invention extracts deep features from time-series data through a Siamese neural network, which can effectively distinguish between real alarms and false alarms, reduce misjudgments caused by environmental interference and other factors, and improve the reliability of the alarm system. Utilizing an LSTM layer to process reported data, it can effectively learn the changing patterns of parameters such as smoke concentration and temperature over time, and combined with periodic encoding (sine / cosine) of time information, it more accurately reflects the behavioral characteristics of different time periods. Training with a triplet loss function enables the model to narrow the feature distance between similar alarm events and widen the feature distance between different types of events. This forms a discriminative feature space, and the model is further optimized by continuously collecting false alarm event data. During the inference phase, the model only needs to calculate the minimum Euclidean distance between the target feature vector and two alarm databases (real alarm database and false alarm database), and make a classification decision quickly by combining the preset threshold, which is conducive to real-time or near-real-time processing of alarm events. Based on the comparison results of the first Euclidean distance and the second Euclidean distance, it can automatically distinguish into three categories: "real alarm", "false alarm" and "pending confirmation", realizing alarm triage: real alarms trigger emergency procedures, false alarms are automatically ignored, and uncertain events are transferred to manual processing, improving operation and maintenance efficiency.

[0063] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods according to the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, or network device, etc.) to execute the methods of the various embodiments of this application.

[0064] According to one aspect of the present invention, a system for determining alarm events is also proposed. Figure 3 This is a schematic diagram of an alarm event determination system according to an embodiment of the present invention; as shown Figure 3 As shown, it includes: The receiving module 310 is used to determine the target device receiving the alarm event and obtain the reported data of the target device within a preset time when it receives an alarm event instruction. The module 320 is used to construct a time-series data matrix based on the reported data, and input the time-series data matrix into the trained Siamese neural network model to obtain the target feature vector; The calculation module 330 is used to calculate the first Euclidean distance between the target feature vector and the real alarm database vector, and to calculate the second Euclidean distance between the target feature vector and the false alarm database vector. The determination module 340 is used to determine the judgment result of the alarm event based on the comparison result of the first Euclidean distance and the second Euclidean distance with the target threshold.

[0065] According to an embodiment of the alarm event determination system of the present invention, upon receiving an alarm event instruction, the system determines the target device receiving the alarm event and acquires the reported data of the target device within a preset time period; constructs a time-series data matrix based on the reported data, and inputs the time-series data matrix into a trained Siamese neural network model to obtain a target feature vector; calculates a first Euclidean distance between the target feature vector and the real alarm database vector, and calculates a second Euclidean distance between the target feature vector and the false alarm database vector; and determines the judgment result of the alarm event based on the comparison result of the first and second Euclidean distances with a target threshold. This improves the accuracy of the alarm event judgment result and eliminates the need for additional sensors, thus reducing hardware costs.

[0066] Optionally, the reported data of the target device every minute within the preset time period includes sine and cosine encodings of smoke concentration, ambient temperature, and time information; wherein, the obtaining module 320 is specifically used to arrange the reported data of each time point in the preset time according to the time order to obtain the time-series data matrix; wherein, each time point corresponds to a row, and each column corresponds to a feature data.

[0067] Optionally, the architecture of the Siamese neural network model includes an input layer, an LSTM layer, a fully connected layer, an L2 normalization layer, and an output layer. The Siamese neural network model is trained as follows: Training data is acquired, consisting of multiple historical alarm event data. Each historical alarm event data includes time-series data, metadata, and labels. The time-series data includes sine and cosine encodings of smoke concentration, ambient temperature, and time information. The metadata includes device ID and user ID. A feature vector is constructed for each historical alarm event data. Triples are constructed based on the training data. The feature vectors of the triples are input into the input layer of the Siamese neural network model in batches. The input layer of the Siamese neural network model inputs the feature vectors into the LSTM layer, allowing the LSTM layer to capture the temporal dependencies of the feature vectors and output a 64-dimensional context vector. This 64-dimensional context vector is then input into the fully connected layer, where the fully connected layer performs compression and nonlinear transformation on the 64-dimensional context vector to obtain a 32-dimensional low-dimensional vector. A low-dimensional vector is input to the L2 normalization layer to normalize the 32-dimensional low-dimensional vector. Based on the normalized vector, the feature vectors fA, fP, and fN of the triple are determined, and the feature vectors fA, fP, and fN of the triple are output by the output layer, where fA represents the feature vector of the reference sample, fP represents the feature vector of the positive sample, and fN represents the feature vector of the negative sample. The Euclidean distance Dap between the feature vector of the reference sample and the feature vector of the positive sample is calculated, as is the Euclidean distance Dan between the feature vector of the reference sample and the feature vector of the negative sample. The loss function L is calculated based on L = max(Euclidean distance Dap − Euclidean distance Dan + margin, 0), and the network parameters are adjusted by gradient descent to minimize the loss function L, where margin represents a preset positive hyperparameter. Training stops when the average of multiple loss functions is less than a preset threshold or the number of training iterations reaches a preset number. Simultaneously, a target model is selected based on the F1 score on the validation set, and the target model is used as the trained Siamese neural network model.

[0068] Optionally, constructing triples based on the training data includes: randomly selecting one historical alarm event data from multiple historical alarm event data as the reference sample; selecting one historical alarm event data of the same type as the reference sample from multiple historical alarm event data as the positive sample; selecting one historical alarm event data of a different type from the reference sample from multiple historical alarm event data as the negative sample; constructing the triples based on the reference sample, the positive sample, and the negative sample; and determining multiple triples based on multiple sample selections.

[0069] Optionally, the F1 score is calculated based on 2 * precision * recall / (precision + recall); wherein the precision is calculated based on TP / (TP + FP), where TP represents the number of true positives and FP represents the number of false positives; wherein the recall is calculated based on TP / (TP + FN), where FN represents the number of false negatives; wherein determining the number of true positives, the number of false positives, and the number of false negatives includes: incrementing the number of true positives by one if the Euclidean distance Dap is not greater than a distance threshold, otherwise incrementing the number of false positives by one; incrementing the number of false negatives by one if the Euclidean distance Dan is not greater than the distance threshold, otherwise incrementing the number of true negatives by one.

[0070] Optionally, the calculation module 330 is specifically used to calculate the Euclidean distance between the target feature vector and each vector in the real alarm database, obtaining multiple Euclidean distance calculation results, and taking the minimum value among the multiple Euclidean distance calculation results as the first Euclidean distance; calculate the Euclidean distance between the target feature vector and each vector in the false alarm database, obtaining multiple Euclidean distance calculation results, and taking the minimum value among the multiple Euclidean distance calculation results as the second Euclidean distance; wherein, based on ||AB|| 2 Calculate the Euclidean distance between the target feature vector and each vector in the real alarm database, or calculate the Euclidean distance between the target feature vector and each vector in the false alarm database, where A represents the target feature vector, B represents a vector in the real alarm database or a vector in the false alarm database, and n represents the dimension of the feature vector. This represents the i-th component of the target feature vector. This represents the i-th component of the real alarm database or the false alarm database.

[0071] Optionally, the target threshold includes a first threshold and a second threshold. Specifically, the determining module 340 is used to determine that the alarm event is a real alarm when the first Euclidean distance is not greater than the first threshold; and to determine that the alarm event is a false alarm when the first Euclidean distance is greater than the first threshold and the second Euclidean distance is less than the second threshold.

[0072] According to one aspect of the present invention, an electronic device is provided.

[0073] Figure 4 This is a schematic diagram of the structure of an electronic device according to an embodiment of the present invention. Figure 4 As shown, an electronic device may include one or more ( Figure 4 Only one is shown in the image. A processor 102 (which may include, but is not limited to, a microprocessor unit (MPU) or a programmable logic device (PLD)) and a memory 104 for storing data are also shown. In one exemplary embodiment, the electronic device may further include a transmission device 106 for communication functions and an input / output device 108. Those skilled in the art will understand that... Figure 4 The structure shown is for illustrative purposes only and does not limit the structure of the terminal device described above. For example, the terminal device may also include components that are more... Figure 4 The more or fewer components shown, or having the same Figure 4 Equivalent functions or ratios shown Figure 4 The functions shown have more different configurations.

[0074] The memory 104 can be used to store computer programs, such as application software programs and modules, like the computer program corresponding to the alarm event determination method in this embodiment of the invention. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, thereby implementing the above-described method. The memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to terminal devices via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0075] The transmission device 106 is used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by the communication provider of the switching device. In one example, the transmission device 106 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission device 106 may be a Radio Frequency (RF) module used for wireless communication with the Internet.

[0076] This invention proposes a non-transitory computer-readable storage medium storing computer instructions, which are used to cause the computer to execute a method for determining alarm events.

[0077] The applicant of this invention has provided a detailed description of the embodiments of the invention in conjunction with the accompanying drawings. However, those skilled in the art should understand that the above embodiments are merely preferred embodiments of the invention. The detailed description is only intended to help readers better understand the spirit of the invention and is not intended to limit the scope of protection of the invention. On the contrary, any improvements or modifications made based on the inventive spirit of the invention should fall within the scope of protection of the invention.

[0078] Furthermore, the functional units in the various embodiments of the present invention can be integrated into a processing module, or each unit can exist physically separately, or two or more units can be integrated into a module. The integrated module can be implemented in hardware or as a software functional module. If the integrated module is implemented as a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium.

[0079] The storage medium mentioned above can be a read-only memory, a disk, or an optical disk, etc. Although embodiments of the present invention have been shown and described above, it is to be understood that the above embodiments are exemplary and should not be construed as limiting the present invention. Those skilled in the art can make changes, modifications, substitutions, and variations to the above embodiments within the scope of the present invention.

[0080] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the embodiments of the present invention, and are not intended to limit them. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in the present invention should be included within the protection scope of the present invention.

Claims

1. A method for determining alarm events, characterized in that, include: S1, upon receiving an alarm event instruction, determine the target device receiving the alarm event and obtain the data reported by the target device within a preset time period; S2, construct a time-series data matrix based on the reported data, and input the time-series data matrix into the trained Siamese neural network model to obtain the target feature vector; S3, calculate the first Euclidean distance between the target feature vector and the real alarm database vector, and calculate the second Euclidean distance between the target feature vector and the false alarm database vector; S4. Based on the comparison results of the first Euclidean distance and the second Euclidean distance with the target threshold, determine the judgment result of the alarm event.

2. The method for determining alarm events according to claim 1, characterized in that, The data reported by the target device every minute within the preset time period includes sine and cosine encodings of smoke concentration, ambient temperature, and time information. The construction of a time-series data matrix based on the reported data includes: The reported data at each time point in the preset time are arranged in chronological order to obtain the time-series data matrix; wherein each time point corresponds to a row and each column corresponds to a feature data.

3. The method for determining alarm events according to claim 1, characterized in that, The architecture of the Siamese neural network model includes an input layer, an LSTM layer, a fully connected layer, an L2 normalized layer, and an output layer. The Siamese neural network model is trained in the following manner: Acquire training data, which consists of multiple historical alarm event data. Each historical alarm event data includes time series data, metadata, and tags. The time series data includes sine and cosine encodings of smoke concentration, ambient temperature, and time information. The metadata includes device ID and user ID. Construct a feature vector for each of the historical alarm event data; Construct triples based on the training data; The feature vectors of the triples are input into the input layer of the Siamese neural network model in batches. The input layer of the Siamese neural network model inputs the feature vectors into the LSTM layer so that the LSTM layer captures the temporal dependencies of the feature vectors and outputs a 64-dimensional context vector. The 64-dimensional context vector is then input into the fully connected layer so that the fully connected layer compresses and performs nonlinear transformation on the 64-dimensional context vector to obtain a 32-dimensional low-dimensional vector. The 32-dimensional low-dimensional vector is then input into the L2 normalization layer so that the L2 normalization layer normalizes the 32-dimensional low-dimensional vector. Based on the normalized vector, the feature vectors fA, fP, and fN of the triples are determined, and the feature vectors fA, fP, and fN of the triples are output based on the output layer, where fA represents the feature vector of the reference sample, fP represents the feature vector of the positive sample, and fN represents the feature vector of the negative sample. Calculate the Euclidean distance Dap between the feature vector of the reference sample and the feature vector of the positive sample; and calculate the Euclidean distance Dan between the feature vector of the reference sample and the feature vector of the negative sample. The loss function L is calculated based on L = max(Euclidean distance Dap − Euclidean distance Dan + margin, 0), and the network parameters are adjusted by gradient descent to minimize the loss function L. Here, margin represents a preset positive hyperparameter. When the average of multiple loss functions is less than a preset threshold or the number of training iterations reaches a preset number, training is stopped. At the same time, a target model is selected based on the F1 score on the validation set, and the target model is used as the trained Siamese neural network model.

4. The method for determining alarm events according to claim 3, characterized in that, Constructing triples based on the training data includes: Randomly select one of the historical alarm event data from the multiple historical alarm event data as the reference sample; Select one historical alarm event data point from the multiple historical alarm event data points that is of the same type as the reference sample, and use it as the positive sample; Select one historical alarm event data point from the multiple historical alarm event data points that is of a different type from the reference sample, and use it as the negative sample; The triplet is constructed based on the reference sample, the positive sample, and the negative sample, and multiple triplets are determined based on multiple sample selections.

5. The method for determining alarm events according to claim 3, characterized in that, The F1 score is calculated based on 2 * precision * recall / (precision + recall). The precision rate is calculated based on TP / (TP+FP), where TP represents the number of true positives and FP represents the number of false positives. The recall rate is calculated based on TP / (TP+FN), where FN represents the number of false negatives. Determining the number of true positives, the number of false positives, and the number of false negatives includes: If the Euclidean distance Dap is not greater than the distance threshold, the number of true positives is incremented by one; otherwise, the number of false positives is incremented by one. If the Euclidean distance Dan is not greater than the distance threshold, the number of false negatives is incremented by one; otherwise, the number of true negatives is incremented by one.

6. The method for determining alarm events according to claim 1, characterized in that, Calculating the first Euclidean distance between the target feature vector and the real alarm database vector includes: Calculate the Euclidean distance between the target feature vector and each vector in the real alarm database to obtain multiple Euclidean distance calculation results, and take the minimum value among the multiple Euclidean distance calculation results as the first Euclidean distance; The calculation of the second Euclidean distance between the target feature vector and the false alarm database vector includes: Calculate the Euclidean distance between the target feature vector and each vector in the false alarm database to obtain multiple Euclidean distance calculation results, and take the minimum value among the multiple Euclidean distance calculation results as the second Euclidean distance; Among them, based on ||AB|| 2 Calculate the Euclidean distance between the target feature vector and each vector in the real alarm database, or calculate the Euclidean distance between the target feature vector and each vector in the false alarm database, where A represents the target feature vector, B represents a vector in the real alarm database or a vector in the false alarm database, and n represents the dimension of the feature vector. This represents the i-th component of the target feature vector. This represents the i-th component of the real alarm database or the false alarm database.

7. The method for determining alarm events according to claim 1, characterized in that, The target threshold includes a first threshold and a second threshold, wherein the judgment result of the alarm event is determined based on the comparison result of the first Euclidean distance and the second Euclidean distance with the target threshold, including: If the first Euclidean distance is not greater than the first threshold, the alarm event is determined to be a real alarm. If the first Euclidean distance is greater than the first threshold and the second Euclidean distance is less than the second threshold, the alarm event is determined to be a false alarm.

8. A system for determining alarm events, characterized in that, include: The receiving module is used to determine the target device receiving the alarm event when an alarm event instruction is received, and to obtain the data reported by the target device within a preset time. The module is used to construct a time-series data matrix based on the reported data, and input the time-series data matrix into the trained Siamese neural network model to obtain the target feature vector; The calculation module is used to calculate the first Euclidean distance between the target feature vector and the real alarm database vector, and to calculate the second Euclidean distance between the target feature vector and the false alarm database vector; The determination module is used to determine the judgment result of the alarm event based on the comparison result of the first Euclidean distance and the second Euclidean distance with the target threshold.

9. An electronic device, characterized in that, include: At least one processor; as well as A memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor to enable the at least one processor to perform the method of any one of claims 1 to 7.

10. A non-transitory computer-readable storage medium storing computer instructions, characterized in that, The computer instructions are used to cause the computer to perform the method according to any one of claims 1 to 7.

Images