Derivative alarm generation method and device and storage medium

Abstract

The invention discloses a derivative alarm generation method, the method is applied to derivative alarm generation equipment, and the method comprises the following steps: obtaining a first fusion feature vector from an alarm information fusion pool; the alarm information fusion pool is used for storing a fusion feature vector obtained based on original data sent by the alarm equipment; obtaining first original data corresponding to the first fusion feature vector; performing feature processing on the first fusion feature vector by adopting the first original data through a first large model to obtain one or more feature vectors to be analyzed; performing rule generation processing on the one or more to-be-analyzed feature vectors by adopting a second large model to obtain m first alarm rules; the m first alarm rules are used for realizing alarm processing at the alarm equipment. The invention further discloses derivative alarm generation equipment and a storage medium.

Description

Technical Field

[0001] This application relates to the field of cloud computing technology, and in particular to a derivative alarm generation method, device and storage medium. Background Technology

[0002] Recently, with the continuous development of large-scale models, alarm systems have begun to automate alarm processing through machine learning algorithms and large-scale models, hoping to expand existing alarms with the help of algorithms. However, even after using large-scale models, manual addition of new alarms and repair of existing alarms are still required. Furthermore, if the generated new invalid alarms cannot be converged, it will increase maintenance costs. Therefore, how to use large-scale models to generate effective alarms, achieve automatic maintenance while converging redundant alarms, reduce labor costs, and use the least amount of large-scale model call costs has become an important problem facing major cloud service providers. Summary of the Invention

[0003] To address the aforementioned technical issues, this application aims to provide a method, device, and storage medium for generating derivative alarms. This solves the current problem of not being able to generate effective alarms using large models for automatic maintenance. It enables the generation of effective alarms using large models and performs automatic maintenance on the generated alarms, achieving effective convergence of redundant alarms and reducing the maintenance cost of large models.

[0004] The technical solution of this application is implemented as follows: This application provides a method for generating derivative alarms, the method being applied to a derivative alarm generation device, the method comprising: Obtain a first fusion feature vector from the alarm information fusion pool; wherein the alarm information fusion pool is used to store fusion feature vectors obtained based on the original data sent by the alarm device, and the original data includes at least the following data parameters: alarm data parameters related to the service, attribute information parameters of the alarm device corresponding to the generation of the alarm data, and access call information parameters of the service corresponding to the generation of the alarm data; Obtain the first original data corresponding to the first fused feature vector; The first model uses the first original data to perform feature processing on the first fused feature vector to obtain one or more feature vectors to be analyzed. The second major model is used to generate rules for the one or more feature vectors to be analyzed, resulting in m first alarm rules; wherein the m first alarm rules are used to implement alarm processing at the alarm device, and m is an integer greater than or equal to 1.

[0005] Optionally, the second major model is used to perform rule generation processing on the one or more feature vectors to be analyzed, resulting in m first alarm rules, including: The second major model is used to perform rule generation processing on the one or more feature vectors to be analyzed, resulting in n second alarm rules; Determine the confidence level of each second alarm rule; Based on each confidence level, m first alarm rules are obtained from the n second alarm rules; where n is an integer greater than or equal to m.

[0006] Optionally, determining the confidence level of each of the second alarm rules includes: Determine the rule generation probability for each of the second alarm rules; Calculate the alarm accuracy rate of each second alarm rule belonging to the same type of alarm rule; Calculate the first product of the first coefficient and the generation probability of each of the aforementioned rules; Calculate the second product of the second coefficient and the accuracy of each alarm; wherein the second coefficient is the difference between 1 and the first coefficient; The sum of the first product and the second product of each second alarm rule is calculated to obtain the corresponding confidence level.

[0007] Optionally, the step of selecting the m first alarm rules from the n first alarm rules based on each confidence level includes: The confidence threshold corresponding to the first fused feature vector is determined using the first large model; From the n second alarm rules, select alarm rules with a confidence level greater than or equal to the confidence threshold to obtain p third alarm rules; where p is an integer greater than or equal to m and less than or equal to n; From the p third alarm rules, select the m alarm rules with the highest confidence to obtain the m first alarm rules.

[0008] Optionally, after using the second largest model to perform rule generation processing on the one or more feature vectors to be analyzed to obtain m first alarm rules, the method further includes: Based on the m first alarm rules and the first original data, the second major model is adjusted to obtain the updated second major model.

[0009] Optionally, before obtaining the first fused feature vector from the alarm information fusion pool, the method further includes: If the second raw data sent by the alarm device is received, a second fusion feature vector is generated based on the second raw data; The second fused feature vector is stored in the alarm information fusion pool.

[0010] Optionally, if the second raw data sent by the alarm device is received, generating a second fusion feature vector based on the second raw data includes: If the second raw data sent by the alarm device is received, the second raw data is preprocessed to obtain the data to be fused; Determine the current weight coefficient of each data parameter in the second original data within the current period; Based on the current weight coefficient of each data parameter, the data to be fused is subjected to weighted fusion processing to obtain the second fused feature vector.

[0011] Optionally, determining the current weight coefficient of each data parameter in the original data includes: Determine the historical weighting coefficient of each data parameter in the previous period adjacent to the current period; Determine the historical alarm accuracy for each of the data parameters; Calculate the third product of the accuracy coefficient and the historical alarm accuracy of each data parameter; The current weight coefficient of each data parameter is obtained by calculating the sum of the historical weight coefficient and the corresponding third product.

[0012] This application provides a derivative alarm generation device, the device comprising at least: a communication interface, a memory, a processor, and a communication bus; wherein: The memory is used to store executable information; The communication bus is used to realize the communication connection between the communication interface, the processor and the memory; The processor is configured to execute the derived alarm generation program stored in the memory, and implement the steps in the derived alarm generation method as described in any of the preceding claims.

[0013] This application provides a storage medium storing a derived alarm generation program, which, when executed, implements the steps of the derived alarm generation method as described in any of the preceding claims.

[0014] This application provides a method, device, and storage medium for generating derived alarms. The derived alarm generation device obtains a first fused feature vector from an alarm information fusion pool, then obtains the corresponding first raw data. A first large model is used to process the first fused feature vector using the first raw data, resulting in one or more feature vectors to be analyzed. A second large model is then used to generate rules from these feature vectors, resulting in m first alarm rules. In this way, by processing the first fused feature vector in the alarm information fusion pool using the first large model to obtain one or more feature vectors to be analyzed, and then using the second large model to generate rules from these feature vectors, m first alarm rules that can be used for alarm generation are obtained. This enables the generation of new alarms based on existing alarms, solving the current problem of not being able to automatically maintain alarms by generating effective alarms using a large model. It achieves the generation of effective alarms using a large model and automatic maintenance of the generated alarms, effectively converging redundant alarms and reducing the maintenance cost of the large model. Attached Figure Description

[0015] Figure 1 A flowchart illustrating a derived alarm generation method provided in an embodiment of this application; Figure 2 A schematic diagram illustrating the implementation process of an application embodiment of the derived alarm generation method provided in this application; Figure 3 A schematic diagram illustrating the implementation process of generating alarm rules provided in an embodiment of this application; Figure 4 A schematic diagram of a derived alarm generation device provided in an embodiment of this application; Figure 5 This is a schematic diagram of a derived alarm generation device provided in an embodiment of this application. Detailed Implementation

[0016] The technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings.

[0017] The embodiments of this application provide a method for generating derivative alarms, referring to... Figure 1 As shown, the method is applied to a derived alarm generation device, and the method includes the following steps: Step 101: Obtain the first fusion feature vector from the alarm information fusion pool.

[0018] The alarm information fusion pool is used to store the fusion feature vector obtained from the original data sent by the alarm device. The original data includes at least the following data parameters: alarm data parameters related to the service, attribute information parameters of the alarm device corresponding to the alarm data generation, and access call information parameters of the service corresponding to the alarm data generation.

[0019] In this application embodiment, the derived alarm generation device can be at least a device used to collect and analyze alarm information of business devices for different services. For example, it can be a server device, a computer device, or a cloud device. The specific device can be determined by the actual application scenario and is not specifically limited here.

[0020] Alarm devices are devices that generate alarms when performing business operations. They can be terminal devices with applications installed to implement business operations, such as smartphones, smart cars, and other smart devices, or virtual devices that need to be monitored and processed, such as cloud servers. The specific device can be determined by the actual application scenario, and no specific limitation is made here.

[0021] The alarm information fusion pool can be generated by the derived alarm generation device. In some application scenarios, the alarm information fusion pool can also be provided by other devices to the derived alarm generation device, depending on the actual application scenario. The alarm information fusion pool includes fusion feature vectors generated based on alarm-related information sent by different alarm devices. The alarm-related information sent by the alarm devices can also be called raw data. The raw data includes at least the specific data corresponding to the following parameters: alarm data parameters related to the business, used to represent the specific alarm data when alarming for the business; device attribute information of the alarm device corresponding to the alarm data generation, such as the resource usage and network status parameters of the alarm device; access call information parameters, which can be some call access data, access nodes, or even access devices of the business when implementing the business. After receiving the alarm-related information sent by the alarm devices, the derived alarm generation device performs information fusion processing on the alarm-related information to obtain the fusion feature vector corresponding to the alarm, and stores the fusion feature vector in the alarm information fusion pool so that new alarm rules can be generated based on the alarm information fusion pool to implement alarms.

[0022] Step 102: Obtain the first original data corresponding to the first fused feature vector.

[0023] In this embodiment, after determining the first fused feature vector, the derived alarm device also obtains the first original data corresponding to the first fused feature vector. The first original data may be stored in a database accessible to the derived alarm generation device. The database may be stored in the local storage unit of the derived alarm generation device, or it may be stored in a third-party storage unit accessible to the derived alarm generation device, such as a cloud storage device. The specific storage method can be determined by the actual application scenario, and no specific limitation is made here.

[0024] Step 103: Using the first original data, the first fused feature vector is processed by the first large model to obtain one or more feature vectors to be analyzed.

[0025] In this embodiment, the first large model can be a pre-trained large artificial intelligence model, without specific limitations. The first large model is invoked, and based on the corresponding template, the first fused feature vector is processed using the first original data. For example, some or all data features are obtained from the first original data and supplemented or replaced in the first fused feature vector, thereby obtaining one or more feature vectors to be analyzed. In some application scenarios, the feature vectors to be analyzed can also be obtained by deleting some data features from the first fused feature vector; the specific method depends on the actual application scenario and is not specifically limited here.

[0026] Step 104: Use the second large model to generate rules for one or more feature vectors to be analyzed, and obtain m first alarm rules.

[0027] Among them, m first alarm rules are used to implement alarm processing at the alarm device, where m is an integer greater than or equal to 1.

[0028] In this embodiment, the second major model can be the same artificial intelligence model as the first major model, or it can be a different artificial intelligence model, depending on the actual application scenario. No specific limitation is made here. After determining one or more feature vectors to be analyzed, the second major model is used to generate rules based on these feature vectors, resulting in m first alarm rules. These m first alarm rules can be sent to all devices managed by the derived alarm generation device, so that when a device detects that a business operation meets one of the first alarm rules, it can implement the corresponding alarm processing.

[0029] In this way, by using a large model to generate different fusion feature vectors based on alarm information through the derivation alarm generation device, different alarm rules are generated using the large model based on the different fusion feature vectors generated, thus achieving effective alarm derivation.

[0030] Based on the foregoing embodiments, in other embodiments of this application, step 104 uses a second large model to perform rule generation processing on one or more feature vectors to be analyzed to obtain m first alarm rules, which can be achieved through the following steps: The second major model is used to generate rules for one or more feature vectors to be analyzed, resulting in n second alarm rules. Determine the confidence level of each second alarm rule; Based on each confidence level, m first alarm rules are selected from n second alarm rules; where n is an integer greater than or equal to m.

[0031] In this embodiment, one method for the derived alarm generation device to determine m first alarm rules is as follows: A second large model is used to perform rule generation processing on one or more feature vectors to be analyzed, resulting in n second alarm rules. Then, m rules are selected from the n second alarm rules to obtain m first alarm rules. These m first alarm rules use the first original data as a reference, ensuring high reliability. When the alarm corresponding to the first original data is an accurate alarm, the alarm implementation accuracy of these m first alarm rules is also high. Another method for selecting m first alarm rules from the n second alarm rules is as follows: After calculating the confidence level of each second alarm rule, m first alarm rules are selected from the n second alarm rules based on the confidence level of the second alarm rules.

[0032] Thus, the m first alarm rules are not randomly selected, but are selected based on the degree of execution, which has a certain degree of reliability and can guarantee the convergence of alarm rules.

[0033] Based on the foregoing embodiments, in other embodiments of this application, the step of determining the confidence level of each second alarm rule can be achieved through the following steps: Determine the rule generation probability for each second alarm rule; Calculate the alarm accuracy rate of each second alarm rule belonging to the same type of alarm rule; Calculate the first product of the first coefficient and the generation probability of each rule; Calculate the second product of the second coefficient and the accuracy of each alarm; where the second coefficient is the difference between 1 and the first coefficient; Calculate the sum of the first and second products of each second alarm rule to obtain the corresponding confidence level.

[0034] In this embodiment, the rule generation probability of the second alarm rule can be provided by the second largest model when generating the second alarm rule. The alarm accuracy of the same type of alarm rule to which each second alarm rule belongs can be determined by the derived alarm generation device after determining each same type of alarm rule described by the second alarm rule and querying the alarm results corresponding to that same type of alarm rule. The first coefficient can be an empirical coefficient obtained from a large number of experiments, and can be adaptively adjusted according to the application scenario in some practical application scenarios. The confidence level of the second alarm rule. The following formula can be used to calculate it: In the formula, As the first coefficient, This refers to the alarm accuracy rate of the same type of alarm rules to which the second alarm rule belongs. The probability of generating the rule for the second alarm rule. This is the second coefficient.

[0035] In this way, the generated alarm rules are quantitatively analyzed in the above manner, so that the alarm rules can be quickly filtered in the future, thus improving the filtering efficiency.

[0036] Based on the foregoing embodiments, in other embodiments of this application, the step of selecting m first alarm rules from n first alarm rules based on each confidence level can be achieved through the following steps: The confidence threshold corresponding to the first fusion feature vector is determined using the first major model; From the n second alarm rules, select alarm rules with a confidence level greater than or equal to the confidence threshold to obtain p third alarm rules; where p is an integer greater than or equal to m and less than or equal to n; From p third alarm rules, select the m alarm rules with the highest confidence to obtain m first alarm rules.

[0037] In this embodiment, the confidence threshold corresponding to the first fusion adjustment vector can be the learning rate determined for the first fusion feature vector in the first large model. In this way, the confidence threshold will be dynamically changed according to the actual application scenario with each learning, ensuring that the confidence threshold fits the actual application scenario, making the judgment and analysis process more accurate and personalized.

[0038] To ensure the reliability of the rules, firstly, when filtering the n second alarm rules, alarm rules with a confidence level greater than or equal to the confidence threshold are selected to obtain p third alarm rules. Then, the p third alarm rules are further processed to select the top m alarm rules with the highest confidence level to obtain m first alarm rules.

[0039] Based on the foregoing embodiments, in other embodiments of this application, after the step of using a second large model to perform rule generation processing on one or more feature vectors to be analyzed to obtain m first alarm rules, the derived alarm generation device is further used to perform the following steps: Based on the m first alarm rules and the first original data, the second major model is adjusted to obtain the updated second major model.

[0040] In this embodiment of the application, after the derived alarm generation device determines m first alarm rules, it performs model fine-tuning on the second major model based on the determined m first alarm rules and the first original data, so that the alarm rules generated by the second major model converge, thus ensuring the accuracy of the generated alarm rules.

[0041] In some application scenarios, the actor-critic algorithm can be used to perform reinforcement learning on the m first alarm rules and the first original data, and then adjust the second model to obtain the updated second model.

[0042] In this way, the second model is fine-tuned to ensure the accuracy of the generated alarm rules.

[0043] Based on the foregoing embodiments, in other embodiments of this application, before the derived alarm generation device performs the step of obtaining the first fused feature vector from the alarm information fusion pool, it is further configured to perform the following steps: If the second raw data sent by the alarm device is received, a second fusion feature vector is generated based on the second raw data; Store the second fused feature vector in the alarm information fusion pool.

[0044] In this embodiment, a method for obtaining a fusion feature vector in an alarm information fusion pool is provided. Specifically, when the alarm device that generated the alarm sends second raw data, the derived alarm generation device performs data fusion processing based on the received second raw data to generate a second fusion feature vector, and stores the second fusion feature vector in the alarm information fusion pool. It should be noted that the device only sends its alarm-related raw data to the derived alarm generation device when it generates an alarm.

[0045] It should be further noted that whether the derived alarm generation device generates m new first alarm rules is unrelated to whether it receives the second raw data sent by the alarm device. That is, the derived alarm generation device can execute steps 101-104 regardless of whether it receives the second raw data sent by the alarm device. For example, it can be executed according to a certain time period, or it can occur when other events are triggered. The specifics can be determined by the actual application scenario, and no specific limitations are made here.

[0046] Based on the foregoing embodiments, in other embodiments of this application, if the second raw data sent by the alarm device is received, the step of generating a second fused feature vector based on the second raw data can be implemented through the following steps: If the second raw data sent by the alarm device is received, the second raw data is preprocessed to obtain the data to be fused; Determine the current weight coefficient of each data parameter in the second original data within the current period; Based on the current weight coefficient of each data parameter, the data to be fused is subjected to weighted fusion processing to obtain the second fused feature vector.

[0047] In this embodiment, after receiving the second raw data sent by the alarm device, the second raw data is preprocessed. For example, the alarm data in the second raw data can be categorized using a Natural Language Processing (NLP) model. Then, the identified categories are merged if they are the same. Missing device attribute information in the second raw data is supplemented, for example, by interpolation. Duplicate content, such as duplicate call relationships, in the access call information of the second raw data is deleted. This yields the data to be fused, which includes the aforementioned multiple data parameters. Then, the current weight coefficient of each data parameter in the second raw data is determined within the current period of receiving the second raw data. Then, each data parameter in the data to be fused is weighted with its corresponding current weight coefficient and then fused. For example, data concatenation can be performed to obtain the second fused feature vector. In this way, by weighting each data parameter in the data to be fused with its corresponding current weight coefficient, the focus of analysis for each data parameter when analyzing the fused feature vector data is realized. That is, the current weight coefficient can determine the degree of influence of each data parameter on the generation of alarm rules.

[0048] It should be noted that the current weight coefficient of each data parameter in the second original data will change with time and application scenarios.

[0049] Based on the foregoing embodiments, in other embodiments of this application, the step of determining the current weight coefficient of each data parameter in the original data can be achieved through the following steps: Determine the historical weighting coefficients of each data parameter in the previous period adjacent to the current period; Determine the historical alarm accuracy for each data parameter; Calculate the third product of the accuracy coefficient and the historical alarm accuracy for each data parameter; Calculate the sum of the historical weight coefficient of each data parameter and the corresponding third product to obtain the current weight coefficient of each data parameter.

[0050] In this embodiment, the historical weight coefficient of each data parameter in the previous period adjacent to the current period can be determined by determining the current weight coefficient. The historical alarm accuracy of each data parameter can be obtained by statistical analysis based on historical data. The accuracy coefficient is determined by the prediction accuracy of the second largest model. Thus, under the premise of the historical weight coefficient of each data parameter, the current weight coefficient of each data parameter is obtained by adjusting the third product of the accuracy coefficient and the historical alarm accuracy of each data parameter.

[0051] Based on the foregoing embodiments, this application provides a system flowchart for automatically generating alarms, referring to... Figure 2 As shown, taking the alarm device as an example of a cloud platform, the derivative alarm generation device is used to implement at least the following steps: Step a11: Preprocess the received raw data related to the cloud platform.

[0052] The raw data includes at least: alarm data, monitoring data, and topology data. Alarm data can include currently generated alarm information, the corresponding alarm rules, and historical alarm and handling data. Monitoring data corresponds to the aforementioned attribute information parameters, including hardware and software information of the cloud host, such as the cloud host's Central Processing Unit (CPU) utilization, memory usage, and network bandwidth. Topology data corresponds to the aforementioned access and call information, specifically information related to business call relationships and device access management, such as Configuration Management Database (CMDB) topology information, microservice call chains, and hardware device connection relationships.

[0053] Correspondingly, when preprocessing alarm data, an NLP model can be used. The alarm data is input as parameters into the NLP model, which then segments the alarm data according to granularity, predicts the segmented data, and outputs the corresponding entity labels. The prediction process of the NLP model can be described as follows: ,in, For the i-th keyword in the segmented alarm data, These are the hidden layer vectors of an NLP model. Here, m represents the NER classification weight matrix, where m is the label category. The entity labels output from alarm keywords in the alarm data are merged according to type. For example, if the entity label is "Insufficient system disk space for device a" and the system disk space for device b is insufficient, they can be merged into a triple (Insufficient disk space, / dev / sdb1, 98%). "Insufficient disk space" indicates the alarm information, / dev / sdb1 indicates the target of the alarm, and 98% indicates the disk utilization rate.

[0054] When preprocessing monitoring data, for example, if monitoring data at time t is missing, linear interpolation can be used, i.e., by using the formula... Missing values ​​are filled in using the padding method, where x t-1 For the monitoring data at time t-1, x t+1 This refers to the monitoring data at time t+1. Other methods can also be used to achieve this; this is just one example.

[0055] When preprocessing topology data, duplicate nodes can be removed, call relationships can be established based on the call chain, and call time, delay, and status can be recorded to explore the call relationships between calls.

[0056] Step a12: Perform data fusion on the preprocessed initial data using a data fusion method, and place the fused feature vector into the fusion pool.

[0057] Among them, the fusion pool corresponds to the aforementioned alarm information fusion pool.

[0058] When performing data fusion, the following methods can be used: Just now, the alarm data was preprocessed. and the processed monitoring data Topology data Perform cross-modal concatenation to obtain the fused feature vector. Among them, the pre-processed alarm data and the processed monitoring data Topology data When performing cross-modal concatenation, weighting can be applied to different data, and the corresponding weighting coefficients can be determined using the following formula: 'i' corresponds to alarm data, monitoring data, and topology data, respectively. This is the accuracy coefficient. Let i be the historical alarm accuracy corresponding to the data. In this way, the initial data is fused to ensure efficient alarm generation and alarm convergence in the future.

[0059] When aligning and enhancing the features of alarm data, monitoring data, and topology data, it is necessary to ensure that the feature vectors are aligned in time and space, that is, the timestamps of the three data parts are aligned, preferably at the same time or close to the same time. For example, if the determination is a behavioral process, the time error can be set within 1 second; if the determination is a behavioral result, the time error can be set to less than 0.01 seconds. It should be noted that the time error can be corrected based on the results of subsequent derived alarms; no specific limitation is made here.

[0060] Step a13: Generate new alarm rules based on the fusion feature vector in the fusion pool.

[0061] The implementation process of step a13 can be referred to Figure 3 The flowchart shown is used to implement this, and the specific implementation steps include the following: Step b11: Obtain the fusion feature vector from the fusion pool, and obtain the association information of the fusion feature vector from the original data corresponding to the fusion feature vector.

[0062] For example, the fused feature vector V1={machine a, CPU utilization rate 90%, memory overflow}, the corresponding associated information can be: {memory utilization rate 56%}, {boot failure}, {system disk core count 4}.

[0063] Step b12: Using the Transformer model, generate dynamic alarm thresholds based on historical time-series data.

[0064] Among them, the Transformer model can correspond to the first major model mentioned above, and the dynamic alarm threshold can correspond to the confidence threshold mentioned above.

[0065] Step b13: Using the Transformer model, the fused feature vector is modified with correlation information to generate different modified feature vectors.

[0066] Step b14: Use an NLP model to identify different error types in the corrected feature vector, map them to the alarm rule base, and generate new alarm rules.

[0067] For example, the newly generated alarm rule could be: Alarm rule 1: If CPU usage > 90% and memory usage > 55%, the machine is considered to be in an abnormal state and overloaded. Alarm rule 2: If CPU usage > 90% and memory overflow occurs, the machine operation is considered to have failed.

[0068] Step b15: Filter the newly generated alarm rules according to the confidence level to obtain the final new alarm rules.

[0069] One possible calculation formula is: The confidence level of each new alarm rule is calculated and then compared with the dynamic alarm threshold. Alarm rules with a confidence level greater than the dynamic alarm threshold are selected from the new alarm rules. Furthermore, the Top-k method is used to select the m alarm rules with the highest confidence levels from the selected alarm rules to obtain the final alarm rules.

[0070] In some application scenarios of this application, after obtaining the final new alarm rules, the alarms are handled according to the actual alarm situation; the reward value is calculated based on the handling situation, and the rules are updated and fed back based on the reward value of this round, and the learning results are updated to the alarm rule base.

[0071] The reward mechanism in reinforcement learning, which calculates rewards based on processing performance, allows for the specification of new alert directions for the NLP model. This enables fine-tuning of the model's generation, gradual convergence, and improved accuracy in generating alerts. Specifically, the Actor-critic algorithm can be applied. The definitions of the reinforcement learning environment, state, behavior, and reward function are as follows: Environment: Alarm data fusion pool, current alarm rules, historical alarm data.

[0072] Actions: Increase or decrease the threshold in the alarm rule, and add or replace the error log in the alarm rule.

[0073] Reward function: ,in, This refers to the number of valid alarms for the alarm rules during this adjustment process. This is a false alarm. The number of rule information entries included in the alarm. The correlation coefficient, Negative value , It is a positive value. The more valid alarms there are, the more positive rewards will be obtained, the more false alarms there will be, and the more rules an alarm contains, the more penalties will be imposed. The final training result of the alarms is concise and effective.

[0074] To maximize the expected reward, the adjustable parameters of the NLP model can be updated using the PPO algorithm, along with temporal differencing to update the value function in each round. Specifically, in each round, the reinforcement learning agent iteratively updates the confidence formula and log information, combining the alarm processing results of each round to calculate the reward value, making alarm generation more directional. The update formula for the alarm generation rate can be written as: ,in The learning rate is an empirical value, such as 0.05. This is the base reward value for a valid alarm. If both the cumulative reward and the valid alarm rate for an alarm rule exceed the given threshold, the rule is considered to be retained. If, after a certain number of consecutive rounds, such as 5 rounds, the reward value for an alarm is less than the elimination threshold, and the valid alarm rate is also less than the elimination threshold, the alarm rule is deleted.

[0075] In some application scenarios, embodiments of this application also provide a closed-loop mechanism of automated handling, effect verification, and feedback learning to achieve intelligent alarm processing and continuous model optimization. Combining the inference capabilities of large models with reinforcement learning ensures improved system adaptability in dynamic cloud environments. The specific process can be as follows: Step 1: When an alarm is triggered, the large model inputs existing handling strategies and dynamically selects a strategy to handle the alarm based on the severity of the alarm and historical success rate. If it is a new alarm and there is no corresponding handling strategy, the large model will generate a corresponding executable script based on the alarm content.

[0076] Step 2: After the process is completed, observe whether the alarms have been restored, including whether the observed indicators have returned to normal and whether the logs show the same or related errors.

[0077] Step 3: Alarms that still fluctuate after automatic handling are automatically marked and pushed to maintenance personnel for manual verification. The personnel then determine whether the current handling is reasonable and complete.

[0078] This means manual intervention. If the alarm is resolved, the maintenance personnel confirm / reject the processing result. If the alarm is still not resolved after automated processing, manual intervention is required to repair the alarm and record the repair process. All processing steps will be used as one of the inputs for the next step.

[0079] Step 3: Many high-risk and unmanageable scenarios are handled manually.

[0080] Step 4: Record the handling process for each alarm, including automated handling processes and manual verification processes.

[0081] This record can be fed back to the handling strategy library and the fusion pool.

[0082] During the implementation process, for the fusion feature vectors in the fusion pool, a dependency relationship can be established through a large model, the alarm rule base can be reversed, and it can be determined whether the alarm rules correspond to the actual events, thus converging redundant alarms.

[0083] One possible process for implementing automated alarm handling is as follows: obtain a pre-built script library, analyze existing scripts, deduce the actual alarm handling method, and automate the alarm handling.

[0084] The derived alarm generation method provided in this application embodiment obtains a first fused feature vector from the alarm information fusion pool through a derived alarm generation device, then obtains the first original data corresponding to the first fused feature vector. A first large model is used to perform feature processing on the first fused feature vector using the first original data to obtain one or more feature vectors to be analyzed. A second large model is then used to perform rule generation processing on the one or more feature vectors to be analyzed, resulting in m first alarm rules. In this way, after performing feature processing on the first fused feature vector in the alarm information fusion pool using the first large model to obtain one or more feature vectors to be analyzed, and then using the second large model to perform rule generation processing on the one or more feature vectors to be analyzed, m first alarm rules that can be used for alarm generation are obtained. This achieves the generation of new alarms based on existing alarms, solving the current problem of not being able to automatically maintain alarms by generating effective alarms using a large model. It realizes the generation of effective alarms using a large model and the automatic maintenance of the generated alarms, achieving effective convergence of redundant alarms and reducing the maintenance cost of the large model.

[0085] Based on the foregoing embodiments, embodiments of this application provide a derivative alarm generation apparatus, which can be applied to... Figure 1 In the corresponding embodiment, the derived alarm generation method is provided with reference to... Figure 4 As shown, the derived alarm generation device is applied to the derived alarm generation equipment. The derived alarm generation device 2 may include: an acquisition unit 21, a first processing unit 22, and a second processing unit 23; wherein: The acquisition unit 21 is used to acquire a first fusion feature vector from the alarm information fusion pool; wherein, the alarm information fusion pool is used to store the fusion feature vector obtained based on the original data sent by the alarm device, and the original data includes at least the following data parameters: alarm data parameters related to the service, attribute information parameters of the alarm device corresponding to the generation of alarm data, and access call information parameters of the service corresponding to the generation of alarm data; Acquisition unit 21 is used to acquire the first original data corresponding to the first fused feature vector; The first processing unit 22 is used to perform feature processing on the first fused feature vector using the first original data through the first large model to obtain one or more feature vectors to be analyzed. The second processing unit 23 is used to perform rule generation processing on one or more feature vectors to be analyzed using the second large model to obtain m first alarm rules; wherein, the m first alarm rules are used to implement alarm processing at the alarm device, and m is an integer greater than or equal to 1.

[0086] In other embodiments of this application, the second processing unit is specifically used to implement the following steps: The second major model is used to generate rules for one or more feature vectors to be analyzed, resulting in n second alarm rules. Determine the confidence level of each second alarm rule; Based on each confidence level, m first alarm rules are selected from n second alarm rules; where n is an integer greater than or equal to m.

[0087] In other embodiments of this application, when the second processing unit performs the step of determining the confidence level of each second alarm rule, it can be achieved through the following steps: Determine the rule generation probability for each second alarm rule; Calculate the alarm accuracy rate of each second alarm rule belonging to the same type of alarm rule; Calculate the first product of the first coefficient and the generation probability of each rule; Calculate the second product of the second coefficient and the accuracy of each alarm; where the second coefficient is the difference between 1 and the first coefficient; Calculate the sum of the first and second products of each second alarm rule to obtain the corresponding confidence level.

[0088] In other embodiments of this application, when the second processing unit performs the step of filtering m first alarm rules from n first alarm rules based on each confidence level, it can be achieved through the following steps: The confidence threshold corresponding to the first fusion feature vector is determined using the first major model; From the n second alarm rules, select alarm rules with a confidence level greater than or equal to the confidence threshold to obtain p third alarm rules; where p is an integer greater than or equal to m and less than or equal to n; From p third alarm rules, select the m alarm rules with the highest confidence to obtain m first alarm rules.

[0089] In other embodiments of this application, after the second processing unit, the derived alarm generation device further includes: an adjustment unit; wherein: The adjustment unit is used to adjust the second major model based on m first alarm rules and first original data to obtain the updated second major model.

[0090] In other embodiments of this application, before the acquisition unit performs the step of acquiring the first fused feature vector from the alarm information fusion pool, the derived alarm generation device further includes: a generation unit and a storage unit; wherein: The generation unit is used to generate a second fusion feature vector based on the second raw data sent by the alarm device if it receives the second raw data. The storage unit is used to store the second fused feature vector into the alarm information fusion pool.

[0091] In other embodiments of this application, the generation unit is specifically used to implement the following steps: If the second raw data sent by the alarm device is received, the second raw data is preprocessed to obtain the data to be fused; Determine the current weight coefficient of each data parameter in the second original data within the current period; Based on the current weight coefficient of each data parameter, the data to be fused is subjected to weighted fusion processing to obtain the second fused feature vector.

[0092] In other embodiments of this application, when the generation unit performs the step of determining the current weight coefficient of each data parameter in the original data, it can be achieved through the following steps: Determine the historical weighting coefficients of each data parameter in the previous period adjacent to the current period; Determine the historical alarm accuracy for each data parameter; Calculate the third product of the accuracy coefficient and the historical alarm accuracy for each data parameter; Calculate the sum of the historical weight coefficient of each data parameter and the corresponding third product to obtain the current weight coefficient of each data parameter.

[0093] It should be noted that the process of information interaction between units and modules in this embodiment can be referred to the description in other embodiments, and will not be repeated here.

[0094] The derived alarm generation device provided in this application obtains a first fused feature vector from the alarm information fusion pool through a derived alarm generation device, then obtains the first original data corresponding to the first fused feature vector. A first large model is used to perform feature processing on the first fused feature vector using the first original data to obtain one or more feature vectors to be analyzed. A second large model is then used to perform rule generation processing on the one or more feature vectors to be analyzed, resulting in m first alarm rules. In this way, after performing feature processing on the first fused feature vector in the alarm information fusion pool using the first large model to obtain one or more feature vectors to be analyzed, and then using the second large model to perform rule generation processing on the one or more feature vectors to be analyzed, m first alarm rules that can be used for alarm generation are obtained. This realizes the generation of new alarms based on existing alarms, solving the current problem of not being able to automatically maintain alarms by generating effective alarms using a large model. It achieves the generation of effective alarms using a large model and automatic maintenance of the generated alarms, realizing effective convergence of redundant alarms and reducing the maintenance cost of the large model.

[0095] Based on the foregoing embodiments, embodiments of this application provide a derived alarm generation device, which can be applied to... Figure 1 In the corresponding embodiment, the derived alarm generation method is provided with reference to... Figure 5 As shown, the derived alarm generation device 3 may include: a communication interface 31, a memory 32, a processor 33, and a communication bus 34; wherein: Memory 32 is used to store executable information; The communication bus 34 is used to realize the communication connection between the communication interface 31, the processor 33 and the memory 32; Processor 33 is used to execute the derived alarm generation program stored in memory, to achieve, for example... Figure 1 The steps in the derived alarm generation method provided in the corresponding embodiments.

[0096] Based on the foregoing embodiments, embodiments of this application provide a computer-readable storage medium, simply referred to as a storage medium, which stores one or more programs that can be executed by one or more processors to implement the reference. Figure 1 The implementation process of the derived alarm generation method provided in the corresponding embodiment will not be described in detail here.

[0097] Based on the foregoing embodiments, this application also provides a computer program product, including a computer program that can be executed by the processor of a derived alarm generation device to complete any of the foregoing method steps.

[0098] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of hardware embodiments, software embodiments, or embodiments combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage and optical storage) containing computer-usable program code.

[0099] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0100] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0101] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0102] The above description is merely a preferred embodiment of this application and is not intended to limit the scope of protection of this application.

Claims

1. A method for generating derivative alarms, characterized in that, The method is applied to a derived alarm generation device, and the method includes: Obtain a first fusion feature vector from the alarm information fusion pool; wherein the alarm information fusion pool is used to store fusion feature vectors obtained based on the original data sent by the alarm device, and the original data includes at least the following data parameters: alarm data parameters related to the service, attribute information parameters of the alarm device corresponding to the generation of the alarm data, and access call information parameters of the service corresponding to the generation of the alarm data; Obtain the first original data corresponding to the first fused feature vector; The first model uses the first original data to perform feature processing on the first fused feature vector to obtain one or more feature vectors to be analyzed. The second major model is used to generate rules for the one or more feature vectors to be analyzed, resulting in m first alarm rules; wherein the m first alarm rules are used to implement alarm processing at the alarm device, and m is an integer greater than or equal to 1.

2. The method according to claim 1, characterized in that, The second major model is used to generate rules for the one or more feature vectors to be analyzed, resulting in m first alarm rules, including: The second major model is used to perform rule generation processing on the one or more feature vectors to be analyzed, resulting in n second alarm rules; Determine the confidence level of each second alarm rule; Based on each confidence level, m first alarm rules are obtained from the n second alarm rules; where n is an integer greater than or equal to m.

3. The method according to claim 2, characterized in that, Determining the confidence level of each second alarm rule includes: Determine the rule generation probability for each of the second alarm rules; Calculate the alarm accuracy rate of each second alarm rule belonging to the same type of alarm rule; Calculate the first product of the first coefficient and the generation probability of each of the aforementioned rules; Calculate the second product of the second coefficient and the accuracy of each alarm; wherein the second coefficient is the difference between 1 and the first coefficient; The sum of the first product and the second product of each second alarm rule is calculated to obtain the corresponding confidence level.

4. The method according to claim 2 or 3, characterized in that, The step of selecting m first alarm rules from the n first alarm rules based on each confidence level includes: The confidence threshold corresponding to the first fused feature vector is determined using the first large model; From the n second alarm rules, select alarm rules with a confidence level greater than or equal to the confidence threshold to obtain p third alarm rules; where p is an integer greater than or equal to m and less than or equal to n; From the p third alarm rules, select the m alarm rules with the highest confidence to obtain the m first alarm rules.

5. The method according to claim 1, characterized in that, After generating m first alarm rules by using the second largest model to process the one or more feature vectors to be analyzed, the method further includes: Based on the m first alarm rules and the first original data, the second major model is adjusted to obtain the updated second major model.

6. The method according to claim 1, characterized in that, Before obtaining the first fused feature vector from the alarm information fusion pool, the method further includes: If the second raw data sent by the alarm device is received, a second fusion feature vector is generated based on the second raw data; The second fused feature vector is stored in the alarm information fusion pool.

7. The method according to claim 6, characterized in that, If the second raw data sent by the alarm device is received, a second fusion feature vector is generated based on the second raw data, including: If the second raw data sent by the alarm device is received, the second raw data is preprocessed to obtain the data to be fused; Determine the current weight coefficient of each data parameter in the second original data within the current period; Based on the current weight coefficient of each data parameter, the data to be fused is subjected to weighted fusion processing to obtain the second fused feature vector.

8. The method according to claim 7, characterized in that, Determining the current weight coefficient of each data parameter in the original data includes: Determine the historical weighting coefficient of each data parameter in the previous period adjacent to the current period; Determine the historical alarm accuracy for each of the data parameters; Calculate the third product of the accuracy coefficient and the historical alarm accuracy of each data parameter; The current weight coefficient of each data parameter is obtained by calculating the sum of the historical weight coefficient and the corresponding third product.

9. A derivative alarm generation device, characterized in that, The device includes at least: a communication interface, a memory, a processor, and a communication bus; wherein: The memory is used to store executable information; The communication bus is used to realize the communication connection between the communication interface, the processor and the memory; The processor is configured to execute the derived alarm generation program stored in the memory, and implement the steps in the derived alarm generation method as described in any one of claims 1 to 8.

10. A storage medium, characterized in that, The storage medium stores a derivative alarm generation program, which, when executed, implements the steps of the derivative alarm generation method as described in any one of claims 1 to 8.

Images