Alarm event processing method, apparatus and device

Abstract

The alarm event processing method, apparatus, and equipment provided in this application include: acquiring monitoring index data of the network of work orders to be processed; acquiring a trained time series prediction model and a sliding window of the network of work orders to be processed; performing prediction processing based on the trained time series prediction model and monitoring index data to determine the corresponding dynamic threshold range; detecting and aggregating alarm events based on the dynamic threshold range and the sliding window to obtain a preliminary alarm set; dynamically adjusting the time length of the sliding window based on the real-time alarm density of the preliminary alarm set; identifying the main cause alarm and downstream redundant alarms based on a pre-constructed network topology diagram; and suppressing downstream redundant alarms, thereby improving the operation and maintenance processing efficiency of alarm events.

Description

Technical Field

[0001] This application relates to the field of network operation and maintenance, and in particular to an alarm event handling method, apparatus and equipment. Background Technology

[0002] In carrier network operations and maintenance, a "work order storm" (a sudden influx of work orders within a short period) is a critical issue affecting network service quality and operational efficiency. Work orders typically involve network operation and maintenance scenarios such as base station failures, transmission interruptions, and core network anomalies, including base station outages, core network node crashes, or a surge in cloud resource pool load. When a sudden network failure occurs, such as a cluster outage of base stations in a certain area or an anomaly in a core network node, the monitoring system generates a large number of alarm events, creating a work order storm. Therefore, a method for handling alarm events is urgently needed.

[0003] In existing technologies, the static threshold method is mainly used to manually set a fixed alarm threshold, use a fixed sliding window to count the number of alarms within a fixed time window, apply a simple clustering algorithm (K-means) to merge duplicate work orders, and call up backup resources according to preset rules through resource scheduling strategies.

[0004] However, existing technologies suffer from low efficiency in handling alarm events due to factors such as rigid threshold settings in static threshold methods, lack of dynamic adjustment intelligence in fixed sliding windows, insufficient redundancy alarm suppression capabilities in simple clustering algorithms, and delayed response of resource scheduling strategies. Summary of the Invention

[0005] The alarm event handling method, apparatus, and equipment provided in this application are intended to solve the technical problem of low efficiency in the operation and maintenance handling of alarm events in the prior art.

[0006] Firstly, this application provides an alarm event handling method, including:

[0007] Obtain monitoring metrics data for the network of work orders to be processed, including equipment operating parameters and alarm events;

[0008] Obtain the sliding window of the trained time series prediction model and the work order network to be processed. The trained time series prediction model is obtained by training through monitoring indicator data samples and corresponding dynamic threshold range labels. The initial time length of the sliding window is determined based on preset rules or parameters in the cold start phase.

[0009] Predictive processing is performed based on the trained time series prediction model and monitoring indicator data to determine the corresponding dynamic threshold range;

[0010] Alarm events are detected and aggregated based on dynamic threshold ranges and sliding windows to obtain a preliminary alarm set.

[0011] The time length of the sliding window is dynamically adjusted based on the real-time alarm density of the initial alarm set; the adjusted sliding window is used for the detection and aggregation of subsequent alarm events.

[0012] Based on the pre-built network topology diagram, identify the main cause alarm and downstream redundant alarms;

[0013] Suppress downstream redundant alarms.

[0014] In one possible implementation, before obtaining the sliding window of the trained time series prediction model and the network of work orders to be processed, the method further includes:

[0015] Determine if historical work order network historical monitoring data exists;

[0016] If it does not exist, the preset time length is set as the initial time length of the sliding window, and the trained meta-learning model is obtained, wherein the meta-learning model is trained through multiple different types of monitoring indicator data;

[0017] Based on the monitoring indicator data, the corresponding type features are determined, and the type features are input into the meta-learning model for training to obtain the corresponding model initialization parameters;

[0018] Based on the model initialization parameters and the preset initial dynamic threshold range, a time series prediction model is constructed and initialized to obtain a trained time series prediction model.

[0019] If it exists, then based on historical monitoring data, a transfer learning method is used to construct an initial time series prediction model;

[0020] The monitoring indicator data and the preset initial dynamic threshold range are input into the initial time series prediction model for training, so as to obtain a trained time series prediction model.

[0021] Based on the trained time series prediction model and the preset initial dynamic threshold range, the dynamic threshold range for the cold start phase is determined.

[0022] Obtain the alarm frequency during the cold start phase, and initialize the sliding window based on the alarm frequency to obtain the parameters for the cold start phase.

[0023] Determine the initial time length of the sliding window based on the parameters of the cold start phase.

[0024] In one possible implementation, prediction processing is performed based on a trained time series prediction model and monitoring indicator data to determine the corresponding dynamic threshold range, including:

[0025] Based on the time series forecasting model, trend analysis is performed on the monitoring indicator data to obtain the predicted mean and predicted standard deviation of the monitoring indicator data.

[0026] The dynamic threshold range is determined based on the predicted mean and the predicted standard deviation. The dynamic threshold range includes an upper threshold and a lower threshold. The upper threshold is the sum of the predicted mean and twice the predicted standard deviation. The lower threshold is the difference between the predicted mean and twice the predicted standard deviation.

[0027] In one possible implementation, the time length of the sliding window is dynamically adjusted based on the real-time alarm density of the initial alarm set, including:

[0028] Timestamps are extracted from alarm events in the initial alarm set to determine the number of alarm events per unit time, so as to obtain the real-time alarm density.

[0029] Collect historical alarm event data within a historical time period and extract the timestamp information from the historical alarm event data;

[0030] The timestamp information is clustered to obtain multiple different alarm density intervals;

[0031] The sliding window duration and real-time alarm density are input into the trained reinforcement learning model to obtain the mapping relationship between the alarm density range and the sliding window duration.

[0032] Match the real-time alarm density with the alarm density range to determine the corresponding target range;

[0033] The time length of the sliding window is dynamically adjusted based on the mapping relationship and the target interval.

[0034] In one possible implementation, before identifying the primary cause alarm and downstream redundancy alarm based on a pre-built network topology graph, the method further includes:

[0035] Collect node information, node connection relationship information, and device hierarchy relationship information in the network. The node information includes the identification information of core network nodes, cloud resource pool nodes, and terminal device nodes.

[0036] Node information is used as graph nodes, node connection information is used as graph edges, and device hierarchy information is used as graph edge weights to construct graph structure data.

[0037] The graph structure data is input into the graph neural network for training to obtain the network topology graph; the network topology graph is used to characterize the strength of node associations.

[0038] In one possible implementation, alarm events are detected and aggregated based on a dynamic threshold range and a sliding window to obtain a preliminary alarm set, including:

[0039] Receive new alarm events and extract the generation timestamp and metric value of the new alarm events;

[0040] Determine if the indicator value exceeds the dynamic threshold range; if it does, mark the new alarm event as a candidate alarm event.

[0041] Determine whether the generated timestamp falls within the preset time range of the sliding window;

[0042] If so, the candidate alarm events will be aggregated in the sliding window;

[0043] If not, the candidate alarm event is stored in the alarm event of the pre-built buffer queue, and the corresponding storage time is recorded; the buffer queue is used to cache alarm events that are not covered by the sliding window.

[0044] According to the preset inspection cycle, iterate through the alarm events in the buffer queue and calculate the time difference between the storage time of the alarm event in each buffer queue and the current time.

[0045] If the time difference is not greater than the preset delay tolerance time, the alarm event corresponding to the time difference will be stored in the next sliding window for aggregation.

[0046] After aggregation is complete, candidate alarm events within the sliding window are integrated to obtain a preliminary alarm set.

[0047] In one possible implementation, after suppressing downstream redundant alarms, the method further includes:

[0048] Obtain the pre-built work order state machine, which is used to manage the lifecycle of alarm work orders. The work order status includes active status, pending confirmation status, and resolved status. Alarm work orders are those that only retain the main cause alarm.

[0049] When the number of associated alarms of the fault node corresponding to the main cause alarm in the sliding window reaches the preset aggregation threshold, the alarm work order is triggered to change from the pending confirmation state to the active state.

[0050] The system collects the operating parameters of the faulty node through a preset health check interface to verify the fault recovery status.

[0051] If the operating parameters meet the preset normal range and there are no new related alarm events within the preset observation period, the alarm work order will be changed from active to resolved. If the operating parameters do not meet the preset normal range, the active state will be maintained and an intervention notification will be triggered.

[0052] Record the transition time of each status of the alarm work order and the associated alarm information of the related alarm events to form a work order lifecycle file.

[0053] In one possible implementation, after the work order lifecycle file is created, the following is also included:

[0054] Obtain a pre-built AI decision tree and a pre-built rule engine, wherein the AI ​​decision tree is used to output repair action suggestions for the main cause of the fault, and the rule engine is used to store preset automated repair execution rules;

[0055] Based on the type and level of the primary cause alarm, the AI ​​decision tree is invoked to output corresponding repair action suggestions, and combined with the execution rules of the rule engine, automated repair instructions are generated;

[0056] Execute automated repair commands and collect the operating parameters of the faulty nodes in real time through a preset health check interface to verify the repair effect;

[0057] If the operating parameters do not reach the preset normal range, the status of the alarm work order will be updated from resolved or pending confirmation to active, and the corresponding intervention notification will be triggered.

[0058] Extract monitoring data and fault information corresponding to alarm work orders that failed to be repaired, in order to adjust the parameters of the time series prediction model and the artificial intelligence decision tree.

[0059] In one possible implementation, the alarm event handling method further includes:

[0060] Obtain preset alarm aggregation dimensions, including network area, device type, and fault level;

[0061] Alarm events are dimensionally labeled and divided into multiple different alarm groups based on the alarm aggregation dimension;

[0062] For each alarm group, determine the corresponding dynamic threshold range, sliding window parameters, and initial alarm set;

[0063] Based on the dynamic threshold range, the parameters of the sliding window, and the initial alarm set, establish the correlation between each alarm group;

[0064] Based on the association relationship, alarm events in different groups caused by the same main cause are associated with the same work order;

[0065] Update the work order association data in the work order state machine based on the associated work order.

[0066] Secondly, this application provides an alarm event handling device, comprising:

[0067] The first acquisition module is used to acquire monitoring indicator data of the network of work orders to be processed, including equipment operating parameters and alarm events.

[0068] The second acquisition module is used to acquire the sliding window of the trained time series prediction model and the work order network to be processed. The trained time series prediction model is obtained by training through monitoring indicator data samples and corresponding dynamic threshold range labels. The initial time length of the sliding window is determined based on preset rules or parameters in the cold start phase.

[0069] The first processing module is used to perform prediction processing based on the trained time series prediction model and monitoring indicator data to determine the corresponding dynamic threshold range.

[0070] The second processing module is used to detect and aggregate alarm events based on the dynamic threshold range and sliding window to obtain a preliminary alarm set.

[0071] The adjustment module is used to dynamically adjust the time length of the sliding window based on the real-time alarm density of the initial alarm set; the adjusted sliding window is used for subsequent alarm event detection and aggregation processing.

[0072] The identification module is used to identify the main cause alarm and downstream redundancy alarm based on the pre-built network topology diagram;

[0073] The suppression module is used to suppress downstream redundant alarms.

[0074] Thirdly, this application provides an alarm event processing device, including: a memory and a processor;

[0075] The memory stores the instructions that the computer executes;

[0076] The processor executes computer execution instructions stored in memory, causing the processor to perform the first aspect and / or various possible implementations of the first aspect as described above.

[0077] Fourthly, this application provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the first aspect and / or various possible embodiments of the first aspect.

[0078] Fifthly, this application provides a computer program product, including a computer program that, when executed by a processor, implements the first aspect and / or various possible implementations of the first aspect.

[0079] This application provides an alarm event processing method, apparatus, and device. By acquiring network monitoring index data of work orders to be processed, it provides foundational data for subsequent processing. A trained time-series prediction model and sliding window are acquired, enabling accurate determination of dynamic threshold ranges based on samples and labels. Predictive processing based on the model and data yields the dynamic threshold range, allowing for more precise alarm event detection. Alarm events are aggregated based on the dynamic threshold range and sliding window to obtain a preliminary alarm set. The sliding window is dynamically adjusted according to real-time alarm density, making the detection aggregation more realistic. The main causes and downstream redundant alarms are identified based on the network topology diagram, suppressing downstream redundant alarms and reducing invalid alarms, thereby achieving the overall technical effect of improving the efficiency of alarm event operation and maintenance processing. Attached Figure Description

[0080] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0081] Figure 1 This application provides a schematic diagram of an application data processing system architecture.

[0082] Figure 2 A flowchart illustrating the alarm event handling method provided in the embodiments of this application. Figure 1 ;

[0083] Figure 3 A flowchart illustrating the alarm event handling method provided in the embodiments of this application. Figure 2 ;

[0084] Figure 4 A flowchart illustrating the alarm event handling method provided in the embodiments of this application. Figure 3 ;

[0085] Figure 4 A flowchart illustrating the alarm event handling method provided in the embodiments of this application. Figure 5 ;

[0086] Figure 5 A flowchart illustrating the alarm event handling method provided in the embodiments of this application. Figure 6 ;

[0087] Figure 6 A flowchart illustrating the alarm event handling method provided in the embodiments of this application. Figure 7 ;

[0088] Figure 7 A flowchart illustrating the alarm event handling method provided in the embodiments of this application. Figure 8 ;

[0089] Figure 8This is a schematic diagram of the structure of the alarm event processing device provided in the embodiments of this application;

[0090] Figure 9 This is a schematic diagram of the structure of the alarm event processing device provided in the embodiments of this application.

[0091] The accompanying drawings illustrate specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concept of this application to those skilled in the art through reference to particular embodiments. Detailed Implementation

[0092] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0093] Due to factors such as the rigid threshold setting of static threshold method, the lack of dynamic adjustment intelligence of fixed sliding window, the insufficient ability of simple clustering algorithm to suppress redundant alarms, and the lag in response of resource scheduling strategy, the existing technology has the technical problem of low efficiency in operation and maintenance of alarm events.

[0094] To address the aforementioned issues, this application provides an alarm event processing method, apparatus, and device. By acquiring network monitoring index data of work orders to be processed, it provides foundational data for subsequent processing. A trained time-series prediction model and sliding window are acquired, enabling accurate determination of dynamic threshold ranges based on samples and labels. Predictive processing based on the model and data yields the dynamic threshold range, allowing for more precise alarm event detection. Alarm events are aggregated based on the dynamic threshold range and sliding window to obtain a preliminary alarm set. The sliding window is dynamically adjusted according to real-time alarm density, making the detection aggregation more realistic. The root cause and downstream redundant alarms are identified based on the network topology diagram, suppressing downstream redundant alarms and reducing invalid alarms, thereby achieving the overall technical effect of improving the efficiency of alarm event operation and maintenance processing.

[0095] The technical solution of this application and how the technical solution of this application solves the above-mentioned technical problems are described in detail below with specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of this application will now be described with reference to the accompanying drawings.

[0096] Figure 9This is a schematic diagram of an application data processing system architecture provided in an embodiment of this application. The application data processing system is a computer device. Figure 1 As shown, the above architecture includes at least one of a data acquisition device 101, a processing device 102, and a display device 103.

[0097] It is understood that the structures illustrated in the embodiments of this application do not constitute a specific limitation on the architecture of the application data processing system. In other feasible embodiments of this application, the above architecture may include more or fewer components than illustrated, or combine some components, or split some components, or arrange different components, which can be determined according to the actual application scenario and is not limited here. Figure 1 The components shown can be implemented in hardware, software, or a combination of both.

[0098] In the specific implementation process, the data acquisition device 101 may include an input / output interface or a communication interface, and the data acquisition device 101 can be connected to the processing device through the input / output interface or the communication interface.

[0099] The processing device 102 can first acquire network monitoring index data of the work orders to be processed, as well as a trained time series prediction model and an initial sliding window. Then, it uses the model and data to make predictions to determine the dynamic threshold range, and uses this and the sliding window to detect and aggregate alarms to obtain a preliminary set. Then, it dynamically adjusts the window according to the real-time alarm density, and finally uses the network topology diagram to identify and suppress downstream redundant alarms.

[0100] The display device 103 can also be a touch screen or the screen of a terminal device, used to receive user commands while displaying the above-mentioned content, so as to realize interaction with the user.

[0101] It should be understood that the aforementioned processing device can be implemented by a processor reading instructions from memory and executing those instructions, or it can be implemented by a chip circuit.

[0102] Furthermore, the network architecture and business scenarios described in the embodiments of this application are for the purpose of more clearly illustrating the technical solutions of the embodiments of this application, and do not constitute a limitation on the technical solutions provided in the embodiments of this application. As those skilled in the art will know, with the evolution of network architecture and the emergence of new business scenarios, the technical solutions provided in the embodiments of this application are also applicable to similar technical problems.

[0103] Figure 1 A flowchart illustrating the alarm event handling method provided in the embodiments of this application. Figure 2 ,like Figure 1 As shown, the alarm event handling method provided in this embodiment includes:

[0104] S201. Obtain monitoring indicator data of the network of work orders to be processed.

[0105] In this embodiment, the monitoring indicator data includes equipment operating parameters and alarm events.

[0106] Acquire monitoring metrics data of the network for pending work orders. This data covers equipment operating parameters and alarm events, providing basic information for subsequent processing and comprehensively reflecting the current operating status of the network.

[0107] S202. Obtain the sliding window of the trained time series prediction model and the work order network to be processed.

[0108] In this embodiment, the trained time series prediction model is obtained by monitoring indicator data samples and corresponding dynamic threshold range labels; the initial time length of the sliding window is determined based on preset rules or parameters of the cold start phase.

[0109] Obtain the trained time series prediction model, which is trained by monitoring indicator data samples and corresponding dynamic threshold range labels; at the same time, obtain the sliding window of the work order network to be processed, whose initial time length is determined according to preset rules or cold start phase parameters.

[0110] S203. Perform prediction processing based on the trained time series prediction model and monitoring indicator data to determine the corresponding dynamic threshold range.

[0111] In one possible implementation, prediction processing is performed based on a trained time series prediction model and monitoring indicator data to determine the corresponding dynamic threshold range, including: performing trend analysis processing on the monitoring indicator data according to the time series prediction model to obtain the predicted mean and predicted standard deviation of the monitoring indicator data; and determining the dynamic threshold range based on the predicted mean and predicted standard deviation.

[0112] In this embodiment, the dynamic threshold range includes an upper threshold and a lower threshold; the upper threshold is the sum of the predicted mean and twice the predicted standard deviation; the lower threshold is the difference between the predicted mean and twice the predicted standard deviation.

[0113] Based on the trained time series prediction model and monitoring indicator data, the monitoring indicator data is first analyzed for trend to obtain the predicted mean and predicted standard deviation. Then, the dynamic threshold range is determined based on this, including the upper threshold (the sum of the predicted mean and twice the predicted standard deviation) and the lower threshold (the difference between the predicted mean and twice the predicted standard deviation).

[0114] S204. Based on the dynamic threshold range and sliding window, the alarm events are detected and aggregated to obtain a preliminary alarm set.

[0115] Based on the dynamic threshold range and sliding window, alarm events are detected and aggregated. Alarm events that are outside the dynamic threshold range but within the sliding window are grouped together to obtain a preliminary alarm set.

[0116] S205. Based on the real-time alarm density of the preliminary alarm set, dynamically adjust the time length of the sliding window.

[0117] In this embodiment, the adjusted sliding window is used for the detection and aggregation of subsequent alarm events.

[0118] Based on the real-time alarm density of the initial alarm set, the sliding window time length is dynamically adjusted. The adjusted sliding window is used for the detection and aggregation of subsequent alarm events to better adapt to the actual alarm situation.

[0119] S206. Identify the primary cause alarm and downstream redundancy alarm based on the pre-built network topology diagram.

[0120] Based on the pre-built network topology diagram, the connection relationships between various parts of the network can be clearly seen, thereby identifying the main cause alarm and downstream redundancy alarm.

[0121] In one possible implementation, before identifying the primary cause alarm and downstream redundancy alarm based on a pre-built network topology graph, the method further includes:

[0122] Collect node information, node connection information, and device hierarchy information in the network; use the node information as graph nodes, the node connection information as graph edges, and the device hierarchy information as graph edge weights to construct graph structure data; input the graph structure data into a graph neural network for training to obtain the network topology graph.

[0123] In this embodiment, the node information includes the identification information of core network nodes, cloud resource pool nodes, and terminal device nodes; the network topology diagram is used to characterize the node association strength.

[0124] For example, firstly, various key information from the network is collected. Node information includes the identification information of core network nodes, cloud resource pool nodes, and terminal device nodes, which accurately distinguish different nodes. Node connection information reflects how nodes are connected. Device hierarchy information reflects the positional relationship of devices in the hierarchical structure. Next, a graph structure is constructed, using node information as graph nodes to provide basic entities for subsequent analysis; node connection information as graph edges to clarify the connection paths between nodes; and device hierarchy information as graph edge weights, the magnitude of which reflects the tightness of device hierarchy associations. Then, the constructed graph structure data is input into a graph neural network for training. The graph neural network learns the information of nodes, edges, and weights in the graph structure to uncover complex relationships and potential patterns between nodes, ultimately obtaining a network topology graph. This graph clearly represents the strength of node associations, providing strong support for accurately identifying primary alarms and downstream redundant alarms, ensuring the accuracy and effectiveness of alarm analysis.

[0125] S207, Suppress downstream redundant alarms.

[0126] Suppressing downstream redundant alarms involves processing identified downstream redundant alarms to prevent them from interfering with operations and maintenance, reducing invalid alarms, and improving operations and maintenance efficiency.

[0127] This application provides an alarm event handling method that acquires network monitoring index data of work orders to be processed, providing foundational data for subsequent processing. A trained time-series prediction model and sliding window are obtained, enabling accurate determination of dynamic threshold ranges based on samples and labels. Predictive processing based on the model and data yields the dynamic threshold range, allowing for more precise alarm event detection. Alarm events are aggregated based on the dynamic threshold range and sliding window to obtain a preliminary alarm set. The sliding window is dynamically adjusted according to real-time alarm density, making the detection aggregation more realistic. The method identifies the root cause and downstream redundant alarms based on the network topology diagram, suppressing downstream redundant alarms and reducing invalid alarms, thereby achieving the overall technical effect of improving the efficiency of alarm event operation and maintenance processing.

[0128] Figure 2 A flowchart illustrating the alarm event handling method provided in the embodiments of this application. Figure 3 ,like Figure 2 As shown, this embodiment, based on the above embodiment, provides supplementary explanations regarding the preparation process before obtaining the sliding window of the trained time series prediction model and the work order network, including:

[0129] S301. Determine if there is historical monitoring data for the historical work order network.

[0130] First, determine whether there is historical monitoring data from the historical work order network. This determination is the watershed for different subsequent processing procedures, and determines which method to use to prepare the time series prediction model and sliding window related parameters.

[0131] S302. If it does not exist, the preset time length is set as the initial time length of the sliding window, and the trained meta-learning model is obtained.

[0132] In this embodiment, the meta-learning model is trained using multiple different types of monitoring indicator data.

[0133] If no historical monitoring data exists, the preset time length is set as the initial time length of the sliding window. At the same time, a trained meta-learning model is obtained. This model is trained from multiple different types of monitoring indicator data and can provide basic support for subsequent operations.

[0134] S303. Based on the monitoring indicator data, determine the corresponding type features, input the type features into the meta-learning model for training, and obtain the corresponding model initialization parameters.

[0135] Based on the monitoring indicator data, the corresponding type features are determined, and these features are input into the meta-learning model for training, thereby obtaining the corresponding model initialization parameters, which prepares for building a time series prediction model.

[0136] S304. Based on the model initialization parameters and the preset initial dynamic threshold range, construct and initialize the time series prediction model to obtain the trained time series prediction model.

[0137] Based on the obtained model initialization parameters and preset initial dynamic threshold range, a time series prediction model is constructed and initialized, and finally a trained time series prediction model is obtained, which can then be used to predict the dynamic threshold range.

[0138] S305. If it exists, then based on historical monitoring data, use transfer learning to construct an initial time series prediction model.

[0139] If historical monitoring data exists, an initial time series prediction model can be built using transfer learning. Transfer learning can leverage historical monitoring data to quickly build a model framework suitable for the current monitoring scenario, avoiding starting from scratch and improving model building efficiency.

[0140] S306. Input the monitoring indicator data and the preset initial dynamic threshold range into the initial time series prediction model for training to obtain a trained time series prediction model; and determine the dynamic threshold range for the cold start stage based on the trained time series prediction model and the preset initial dynamic threshold range.

[0141] The monitoring indicator data and the preset initial dynamic threshold range are input into the initial time series prediction model for training, resulting in a trained model. Then, the preset range is used to determine the dynamic threshold range for the cold start phase, providing an accurate standard for alarm detection and enabling the model to better adapt to the cold start phase.

[0142] S307. Obtain the alarm occurrence frequency during the cold start phase, and initialize the sliding window according to the alarm occurrence frequency to obtain the parameters for the cold start phase.

[0143] The alarm frequency during the cold start phase is obtained, and the sliding window is initialized accordingly to obtain the cold start phase parameters. The alarm frequency reflects the alarm situation during this phase, and by setting the parameters accordingly, the sliding window can better adapt to the alarm detection requirements during the cold start phase.

[0144] S308. Determine the initial time length of the sliding window based on the parameters of the cold start phase.

[0145] Based on the parameters obtained after initialization during the cold start phase, the initial duration of the sliding window is determined. This duration is set based on parameters such as the actual alarm frequency to ensure that the sliding window can reasonably cover alarm events during the cold start phase and accurately perform detection and aggregation processing.

[0146] The alarm event handling method provided in this application provides guidance for subsequent processing by determining whether historical monitoring data exists. When no historical monitoring data is available, a sliding window length is preset, and a meta-learning model is obtained. After training, initial parameters are obtained to construct the model, ensuring its reasonable construction and accurate determination of dynamic thresholds. When historical monitoring data is available, transfer learning is used to construct an initial model. After training, the cold-start dynamic threshold range is determined, enabling rapid construction of an adapted model. The cold-start alarm frequency is obtained, and the sliding window is initialized with a reasonable initial time length, allowing the sliding window to better detect aggregated alarms during the cold-start phase, thus improving overall alarm processing efficiency and accuracy.

[0147] Figure 3 A flowchart illustrating the alarm event handling method provided in the embodiments of this application. Figure 4 ,like Figure 3 As shown, this embodiment, based on the above embodiment, elaborates on the dynamic adjustment process of the sliding window's time length, including:

[0148] S401. Extract timestamps from alarm events in the preliminary alarm set to determine the number of alarm events per unit time, so as to obtain the real-time alarm density.

[0149] The timestamp of each alarm event is extracted from the initial alarm set. The real-time alarm density is calculated by counting the number of alarm events per unit of time (e.g., per minute, per hour). This provides a clear picture of the current alarm concentration, offering real-time data for subsequent dynamic adjustments to the sliding window, allowing adjustments to better reflect the actual alarm situation. For example, counting alarms every minute yields the real-time alarm density for that minute.

[0150] S402. Collect historical alarm event data within a historical time period and extract the timestamp information from the historical alarm event data.

[0151] Collect historical alarm event data over a period of time (such as one day or one week) and extract timestamp information from this data. Historical alarm event data can reflect the distribution pattern of alarms in different time periods, providing a comprehensive reference for determining reasonable alarm density intervals and avoiding inaccurate interval divisions due to relying solely on current data.

[0152] S403. Cluster the timestamp information to obtain multiple different alarm density intervals.

[0153] Clustering algorithms (such as K-Means) are used to process the extracted timestamp information. Based on the distribution of timestamps, the data is divided into multiple different groups, each corresponding to an alarm density interval. This allows for the classification of alarms with different densities, facilitating subsequent matching with real-time alarm density.

[0154] S404. Input the sliding window duration and real-time alarm density into the trained reinforcement learning model to obtain the mapping relationship between the alarm density interval and the sliding window duration.

[0155] The current time length of the sliding window and the calculated real-time alarm density are input into the trained reinforcement learning model. By learning from a large amount of data, the reinforcement learning model can output the mapping relationship between the alarm density range and the sliding window time length, providing an intelligent decision-making basis for dynamic adjustment.

[0156] S405. Match the real-time alarm density with the alarm density range to determine the corresponding target range.

[0157] The calculated real-time alarm density is compared and matched with the previously obtained multiple alarm density intervals to determine the target interval to which the real-time alarm density belongs. This clarifies the current alarm density range, providing direction for subsequent adjustments to the sliding window length.

[0158] S406. Adjust the time length of the sliding window dynamically according to the mapping relationship and the target interval.

[0159] Based on the mapping relationship output by the reinforcement learning model and the determined target interval, the duration of the sliding window is dynamically adjusted according to preset rules. For example, if the target interval corresponds to a longer window length, the duration of the sliding window is lengthened to better adapt to the current alarm situation and improve the alarm handling effect.

[0160] The alarm event processing method provided in this application calculates the real-time alarm density by extracting the timestamps of the initial alarm set, enabling timely understanding of the current alarm concentration level. Historical alarm data is collected, timestamps are extracted, and clustering is performed to obtain multiple alarm density intervals, providing a comprehensive reference for matching. The sliding window length and real-time alarm density are input into a reinforcement learning model to obtain a mapping relationship, achieving intelligent decision-making. Matching the real-time alarm density with the intervals determines the target interval, clarifying the adjustment direction. Finally, the sliding window length is dynamically adjusted based on the mapping and the target interval, allowing the window to better adapt to different alarm situations, improving the accuracy and efficiency of alarm processing.

[0161] Figure 4 A flowchart illustrating the alarm event handling method provided in the embodiments of this application. Figure 5 ,like Figure 4 As shown, this embodiment, based on the above embodiments, provides a detailed explanation of the specific process for identifying a preliminary alarm set, including:

[0162] S501. Receive new alarm events and extract the generation timestamp and indicator value of the new alarm events.

[0163] The system continuously receives newly generated alarm events and accurately extracts the generation timestamp from each new alarm event, which can clearly identify the specific time when the alarm occurred. At the same time, it extracts the indicator values, which reflect the status of alarm-related indicators and provide a data basis for subsequent judgment on whether the alarm is abnormal.

[0164] S502. Determine whether the indicator value exceeds the dynamic threshold range; if it does, mark the new alarm event as a candidate alarm event.

[0165] The extracted indicator values ​​are compared with preset dynamic threshold ranges. If an indicator value exceeds this range, it indicates that the indicator is in an abnormal state. This new alarm event is marked as a candidate alarm event for further analysis and processing, avoiding the omission of potentially important alarms.

[0166] S503. Determine whether the generated timestamp falls within the preset time range of the sliding window.

[0167] Check whether the generation timestamps of candidate alarm events fall within the time range preset by the sliding window. The sliding window is used to aggregate and analyze alarm events over a certain time span; this step determines whether candidate alarm events are within the current analysis time interval.

[0168] S504. If so, the candidate alarm events will be aggregated in the sliding window.

[0169] If the generated timestamp falls within the preset time range of the sliding window, the candidate alarm event is included in the sliding window. Within the sliding window, multiple related alarm events can be comprehensively analyzed to uncover their correlations, providing a basis for accurately determining the alarm status.

[0170] S505. If not, store the candidate alarm event in the alarm event of the pre-built buffer queue and record the corresponding storage time.

[0171] In this embodiment, the buffer queue is used to cache alarm events that are not covered by the sliding window.

[0172] If the generated timestamp is outside the preset time range of the sliding window, the candidate alarm event is stored in a pre-built buffer queue, and the storage time is recorded. The buffer queue can temporarily store alarm events that are not covered by the current sliding window to prevent them from being lost.

[0173] S506. According to the preset inspection cycle, traverse the alarm events in the buffer queue and calculate the time difference between the storage time of the alarm event in each buffer queue and the current time.

[0174] According to the preset check cycle, each alarm event in the buffer queue is traversed sequentially, and the difference between the entry time of each alarm event and the current time is calculated. The check cycle can be set according to actual needs to ensure timely processing of alarms in the buffer queue.

[0175] S507. If the time difference is not greater than the preset delay tolerance time, the alarm event corresponding to the time difference is stored in the next sliding window for aggregation.

[0176] If the calculated time difference is not greater than the preset delay tolerance time, it means that although the alarm event is not covered by the current sliding window, it is within the acceptable delay range. It is then stored in the next sliding window for aggregation analysis to ensure the integrity of alarm processing.

[0177] S508. After aggregation is completed, integrate the candidate alarm events in the sliding window to obtain a preliminary alarm set.

[0178] After completing the above aggregation operations, all candidate alarm events within the sliding window are integrated to form a preliminary alarm set. This set contains relevant alarm events under certain time and logical relationships, providing basic data for subsequent further analysis and processing.

[0179] The alarm event processing method provided in this application receives new alarm events and extracts key information, providing a basis for judging alarm anomalies. Candidate alarms are marked by comparing them with dynamic thresholds to avoid missing important alarms. Timestamps are used to determine whether to include alarms in a sliding window, enabling aggregated analysis of related alarms. An overwritten alarm queue is used to temporarily store alarms that have not been covered, preventing loss. Time differences are calculated by iterating through the check cycle, and alarms with tolerable delays are stored in the next window to ensure processing completeness. Finally, candidate alarms within the sliding window are integrated to form a preliminary set, providing strong data support for subsequent accurate alarm analysis and processing.

[0180] Figure 5 A flowchart illustrating the alarm event handling method provided in the embodiments of this application. Figure 6 ,like Figure 5 As shown, this embodiment, based on the above embodiment, provides supplementary explanations of the subsequent process after the downstream redundant alarm is suppressed, including:

[0181] S601. Obtain the pre-built work order state machine.

[0182] In this embodiment, the work order state machine is used to manage the lifecycle of alarm work orders. The work order status includes active status, pending confirmation status, and resolved status. Alarm work orders are those that retain only the main cause alarm.

[0183] Obtain a pre-built work order state machine, which acts as a rule framework to manage the lifecycle of alarm work orders that retain only the primary cause alarm. The work order status includes three types: active, pending confirmation, and resolved. Different statuses correspond to different stages of alarm handling, clearly defining the characteristics and operational requirements of the work order at each stage.

[0184] S602. When the number of associated alarms of the fault node corresponding to the main cause alarm in the sliding window reaches the preset aggregation threshold, the alarm work order is triggered to change from the pending confirmation state to the active state.

[0185] Within the sliding window, when the number of alarms associated with the fault node corresponding to the primary cause alarm reaches the preset aggregation threshold, it means that the fault may be more serious and the scope of impact is expanding. At this time, the alarm work order is triggered to change from the pending confirmation state to the active state so that more resources can be invested in processing in a timely manner.

[0186] S603. Collect the operating parameters of the faulty node through the preset health check interface to verify the fault recovery status.

[0187] The system uses a pre-defined health check interface to examine faulty nodes and collect their operational parameters. These parameters reflect the current operational status of the faulty node, providing crucial data for determining whether the fault has been resolved.

[0188] S604. If the operating parameters meet the preset normal range and there are no new related alarm events within the preset observation period, the alarm work order will be changed from the active state to the resolved state. If the operating parameters do not meet the preset normal range, the active state will be maintained and an intervention notification will be triggered.

[0189] If the collected operating parameters meet the preset normal range and there are no new related alarm events within the preset observation period, it indicates that the fault has been recovered, and the alarm work order is triggered to change from the active state to the resolved state; if the operating parameters do not meet the normal range, the active state is maintained and an intervention notification is triggered to remind relevant personnel to handle the situation in a timely manner.

[0190] S605. Record the transition time of each status of the alarm work order and the associated alarm information of the associated alarm events to form a work order lifecycle file.

[0191] Record the status transition times of each alarm work order and the associated alarm information of related alarm events to form a work order lifecycle file. This provides detailed information for subsequent analysis of the alarm handling process and summarizing lessons learned, which helps to optimize the alarm handling process.

[0192] The alarm event handling method provided in this application embodiment clarifies the alarm work order lifecycle management rules through a pre-built work order state machine, providing a framework for subsequent processing. Reaching an aggregation threshold triggers a state transition, enabling timely response to severe faults. Collecting operational parameters verifies fault recovery, ensuring accurate judgment. Changing the work order state or triggering intervention based on parameters and observation period ensures timely and effective fault handling. Recording state transitions and associated information forms an archive, providing a basis for optimizing the alarm handling process and improving overall alarm handling efficiency and quality.

[0193] Figure 6 A flowchart illustrating the alarm event handling method provided in the embodiments of this application. Figure 7 ,like Figure 6 As shown, this embodiment, based on the above embodiment, provides supplementary explanations of the process after the formation of the work order lifecycle file, including:

[0194] S701, Obtain pre-built AI decision trees and pre-built rule engines.

[0195] In this embodiment, the artificial intelligence decision tree is used to output repair action suggestions for the main cause of the fault, and the rule engine is used to store preset automated repair execution rules.

[0196] An AI decision tree is pre-built, trained on a large amount of historical fault data, and can output targeted repair action suggestions based on the main fault characteristics of the input. At the same time, a rule engine is built to store preset automated repair execution rules. These rules clarify the specific requirements and processes of repair instructions under different conditions, providing a basis for automated repair.

[0197] S702. Based on the type and level of the primary cause alarm, call the artificial intelligence decision tree to output corresponding repair action suggestions, and combine them with the execution rules of the rule engine to generate whether the automated repair instruction exceeds the dynamic threshold range; if it does, mark the new alarm event as a candidate alarm event.

[0198] Based on the type and level of the primary cause alarm, corresponding repair action suggestions are obtained from the AI ​​decision tree. These suggestions are then combined with execution rules from the rule engine to determine whether automated repair instructions can be generated. This step ensures that the repair instructions not only conform to the actual fault situation but also follow preset rules, guaranteeing the rationality and effectiveness of the repair.

[0199] S703 executes automated repair commands, collects the operating parameters of the faulty node in real time through the preset health check interface, and verifies the repair effect.

[0200] After executing the generated automated repair instructions, the system collects the operating parameters of the faulty node in real time through a preset health check interface. These parameters directly reflect the repair effect, and by comparing the parameters with the preset normal range, it can accurately determine whether the fault has been resolved.

[0201] S704. If the operating parameters do not reach the preset normal range, the status of the alarm work order will be updated from resolved or pending confirmation to active, and the corresponding intervention notification will be triggered.

[0202] If the collected operating parameters do not reach the preset normal range, it means that the repair was unsuccessful. The alarm work order status will be updated from resolved or pending confirmation to active status, and an intervention notification will be triggered to remind relevant personnel to intervene in a timely manner to avoid the fault from continuing to affect the system operation.

[0203] S705. Extract the monitoring data and fault information corresponding to the alarm work orders that failed to be repaired, so as to adjust the parameters of the time series prediction model and the artificial intelligence decision tree.

[0204] Extract monitoring data and fault information corresponding to alarms that were not successfully repaired. Use this data to adjust and optimize the parameters of the time series prediction model and the artificial intelligence decision tree to improve the accuracy of the model and decision tree in predicting and repairing faults.

[0205] The alarm event handling method provided in this application provides intelligent suggestions and rule support for automated repair by acquiring an artificial intelligence decision tree and rule engine. It combines the root cause alarm with the decision tree and rules to generate repair instructions, ensuring reasonable and effective repairs. After executing the instructions, parameters are collected to verify the repair effect and accurately determine the repair status. If the repair fails, the work order status is updated and intervention is triggered to handle the fault promptly. Data from unsuccessfully repaired work orders is extracted to adjust model parameters, improving the accuracy of subsequent fault prediction and repair suggestions, and enhancing the system's fault handling capabilities.

[0206] Figure 7 A flowchart illustrating the alarm event handling method provided in the embodiments of this application. Figure 8 ,like Figure 7 As shown, this embodiment supplements the alarm event handling method based on the above embodiments, including:

[0207] S801, Obtain the preset alarm aggregation dimensions.

[0208] In this embodiment, the aggregation dimensions include network region, device type, and fault level.

[0209] Pre-defined alarm aggregation dimensions, such as network area, clearly define the network scope where the fault occurs; device type, distinguishing alarms generated by different devices; and fault level, reflecting the severity of the fault. These dimensions provide a basis for subsequent alarm event classification, facilitating alarm analysis and processing from different perspectives. For example, the device type dimension allows for quick location of alarms related to specific devices.

[0210] S802. Mark the alarm events by dimension and divide the alarm events into multiple different alarm groups according to the alarm aggregation dimension.

[0211] Each alarm event is dimensionally labeled, and alarm events with the same dimensional characteristics are grouped into the same alarm group based on preset aggregation dimensions such as network area, device type, and fault level. For example, alarms from the same type of device within the same network area and with the same fault level are grouped together, making alarm classification clearer and more orderly.

[0212] S803. Based on each alarm group, determine the corresponding dynamic threshold range, sliding window parameters, and preliminary alarm set.

[0213] For each alarm group, a suitable dynamic threshold range is determined by combining historical data and actual business conditions to determine whether the alarm is abnormal; sliding window parameters, such as window size and sliding step, are set to collect alarms within a certain period of time; at the same time, a preliminary alarm set is determined to prepare for subsequent correlation analysis.

[0214] S804. Based on the dynamic threshold range, the parameters of the sliding window, and the preliminary alarm set, establish the correlation between each alarm group.

[0215] Based on the dynamic threshold range, sliding window parameters, and preliminary alarm set, the temporal and spatial relationships between alarm events in different alarm groups are analyzed to establish their correlations. For example, if two alarm groups are found to be closely linked in time, a causal relationship may exist.

[0216] S805. Based on the association relationship, alarm events in different groups caused by the same main cause are associated with the same work order.

[0217] Based on the established relationships, alarm events in different groups caused by the same primary cause are associated with the same work order, enabling centralized processing of related alarms, facilitating a comprehensive understanding of the fault situation, and improving fault handling efficiency.

[0218] S806. Update the work order association data in the work order state machine based on the associated work order.

[0219] The associated work order information is updated in the work order association data in the work order state machine to ensure that the work order state machine can accurately reflect the association status of the work orders, providing an accurate basis for subsequent work order status transitions and management.

[0220] The alarm event handling method provided in this application provides clear standards for alarm classification by pre-setting alarm aggregation dimensions, facilitating subsequent processing. Alarm events are labeled with dimensions and grouped, making alarm management more organized. Determining the parameters and preliminary sets of each group lays the foundation for correlation analysis. Establishing correlations between groups enables the discovery of potential fault connections. Related alarms are grouped into the same work order for centralized fault handling. Updating the work order state machine correlation data ensures accurate work order state management and improves overall alarm handling efficiency and quality.

[0221] Figure 8 This is a schematic diagram of the alarm event handling device provided in an embodiment of this application. The device in this embodiment can be in the form of software and / or hardware. Figure 9 As shown in the embodiment of this application, the alarm event processing device 900 includes: a first acquisition module 901, a second acquisition module 902, a first processing module 903, a second processing module 904, an adjustment module 905, an identification module 906, and a suppression module 907.

[0222] The first acquisition module 901 is used to acquire monitoring indicator data of the network of work orders to be processed, wherein the monitoring indicator data includes equipment operating parameters and alarm events.

[0223] The second acquisition module 902 is used to acquire the sliding window of the trained time series prediction model and the work order network to be processed. The trained time series prediction model is obtained by training through monitoring indicator data samples and corresponding dynamic threshold range labels. The initial time length of the sliding window is determined based on preset rules or parameters in the cold start phase.

[0224] The first processing module 903 is used to perform prediction processing based on the trained time series prediction model and monitoring indicator data to determine the corresponding dynamic threshold range.

[0225] The second processing module 904 is used to detect and aggregate alarm events according to the dynamic threshold range and sliding window to obtain a preliminary alarm set.

[0226] The adjustment module 905 is used to dynamically adjust the time length of the sliding window based on the real-time alarm density of the initial alarm set; the adjusted sliding window is used for subsequent detection and aggregation processing of alarm events.

[0227] The identification module 906 is used to identify the main cause alarm and downstream redundancy alarm based on the pre-built network topology diagram;

[0228] Suppression module 907 is used to suppress downstream redundant alarms.

[0229] In one possible implementation, the second acquisition module 902 is further configured to:

[0230] Determine if historical work order network historical monitoring data exists;

[0231] If it does not exist, the preset time length is set as the initial time length of the sliding window, and the trained meta-learning model is obtained, wherein the meta-learning model is trained through multiple different types of monitoring indicator data;

[0232] Based on the monitoring indicator data, the corresponding type features are determined, and the type features are input into the meta-learning model for training to obtain the corresponding model initialization parameters;

[0233] Based on the model initialization parameters and the preset initial dynamic threshold range, a time series prediction model is constructed and initialized to obtain a trained time series prediction model.

[0234] If it exists, then based on historical monitoring data, a transfer learning method is used to construct an initial time series prediction model;

[0235] The monitoring indicator data and the preset initial dynamic threshold range are input into the initial time series prediction model for training, so as to obtain a trained time series prediction model.

[0236] Based on the trained time series prediction model and the preset initial dynamic threshold range, the dynamic threshold range for the cold start phase is determined.

[0237] Obtain the alarm frequency during the cold start phase, and initialize the sliding window based on the alarm frequency to obtain the parameters for the cold start phase.

[0238] Determine the initial time length of the sliding window based on the parameters of the cold start phase.

[0239] In one possible implementation, the first processing module 903 is further configured to:

[0240] Based on the time series forecasting model, trend analysis is performed on the monitoring indicator data to obtain the predicted mean and predicted standard deviation of the monitoring indicator data.

[0241] The dynamic threshold range is determined based on the predicted mean and the predicted standard deviation. The dynamic threshold range includes an upper threshold and a lower threshold. The upper threshold is the sum of the predicted mean and twice the predicted standard deviation. The lower threshold is the difference between the predicted mean and twice the predicted standard deviation.

[0242] In one possible implementation, the adjustment module 905 is further configured to:

[0243] Timestamps are extracted from alarm events in the initial alarm set to determine the number of alarm events per unit time, so as to obtain the real-time alarm density.

[0244] Collect historical alarm event data within a historical time period and extract the timestamp information from the historical alarm event data;

[0245] The timestamp information is clustered to obtain multiple different alarm density intervals;

[0246] The sliding window duration and real-time alarm density are input into the trained reinforcement learning model to obtain the mapping relationship between the alarm density range and the sliding window duration.

[0247] Match the real-time alarm density with the alarm density range to determine the corresponding target range;

[0248] The time length of the sliding window is dynamically adjusted based on the mapping relationship and the target interval.

[0249] In one possible implementation, the identification module 906 is further configured to:

[0250] Collect node information, node connection relationship information, and device hierarchy relationship information in the network. The node information includes the identification information of core network nodes, cloud resource pool nodes, and terminal device nodes.

[0251] Node information is used as graph nodes, node connection information is used as graph edges, and device hierarchy information is used as graph edge weights to construct graph structure data.

[0252] The graph structure data is input into the graph neural network for training to obtain the network topology graph; the network topology graph is used to characterize the strength of node associations.

[0253] In one possible implementation, the second processing module 904 is further configured to:

[0254] Receive new alarm events and extract the generation timestamp and metric value of the new alarm events;

[0255] Determine if the indicator value exceeds the dynamic threshold range; if it does, mark the new alarm event as a candidate alarm event.

[0256] Determine whether the generated timestamp falls within the preset time range of the sliding window;

[0257] If so, the candidate alarm events will be aggregated in the sliding window;

[0258] If not, the candidate alarm event is stored in the alarm event of the pre-built buffer queue, and the corresponding storage time is recorded; the buffer queue is used to cache alarm events that are not covered by the sliding window.

[0259] According to the preset inspection cycle, iterate through the alarm events in the buffer queue and calculate the time difference between the storage time of the alarm event in each buffer queue and the current time.

[0260] If the time difference is not greater than the preset delay tolerance time, the alarm event corresponding to the time difference will be stored in the next sliding window for aggregation.

[0261] After aggregation is complete, candidate alarm events within the sliding window are integrated to obtain a preliminary alarm set.

[0262] In one possible implementation, the suppression module 907 is further configured to:

[0263] Obtain the pre-built work order state machine, which is used to manage the lifecycle of alarm work orders. The work order status includes active status, pending confirmation status, and resolved status. Alarm work orders are those that only retain the main cause alarm.

[0264] When the number of associated alarms of the fault node corresponding to the main cause alarm in the sliding window reaches the preset aggregation threshold, the alarm work order is triggered to change from the pending confirmation state to the active state.

[0265] The system collects the operating parameters of the faulty node through a preset health check interface to verify the fault recovery status.

[0266] If the operating parameters meet the preset normal range and there are no new related alarm events within the preset observation period, the alarm work order will be changed from active to resolved. If the operating parameters do not meet the preset normal range, the active state will be maintained and an intervention notification will be triggered.

[0267] Record the transition time of each status of the alarm work order and the associated alarm information of the related alarm events to form a work order lifecycle file.

[0268] In one possible implementation, the suppression module 907 is further configured to:

[0269] Obtain a pre-built AI decision tree and a pre-built rule engine, wherein the AI ​​decision tree is used to output repair action suggestions for the main cause of the fault, and the rule engine is used to store preset automated repair execution rules;

[0270] Based on the type and level of the primary cause alarm, the AI ​​decision tree is invoked to output corresponding repair action suggestions, and combined with the execution rules of the rule engine, automated repair instructions are generated;

[0271] Execute automated repair commands and collect the operating parameters of the faulty nodes in real time through a preset health check interface to verify the repair effect;

[0272] If the operating parameters do not reach the preset normal range, the status of the alarm work order will be updated from resolved or pending confirmation to active, and the corresponding intervention notification will be triggered.

[0273] Extract monitoring data and fault information corresponding to alarm work orders that failed to be repaired, in order to adjust the parameters of the time series prediction model and the artificial intelligence decision tree.

[0274] In one possible implementation, the alarm event handling device 900 is further configured to:

[0275] Obtain preset alarm aggregation dimensions, including network area, device type, and fault level;

[0276] Alarm events are dimensionally labeled and divided into multiple different alarm groups based on the alarm aggregation dimension;

[0277] For each alarm group, determine the corresponding dynamic threshold range, sliding window parameters, and initial alarm set;

[0278] Based on the dynamic threshold range, the parameters of the sliding window, and the initial alarm set, establish the correlation between each alarm group;

[0279] Based on the association relationship, alarm events in different groups caused by the same main cause are associated with the same work order;

[0280] Update the work order association data in the work order state machine based on the associated work order.

[0281] The alarm event processing device provided in this embodiment can execute the method provided in the above method embodiment. Its implementation principle and technical effect are similar, and will not be described in detail here.

[0282] Figure 9 This is a schematic diagram of the structure of the alarm event processing device provided in an embodiment of this application. Figure 10 Figure 10 As shown, the alarm event processing device 1000 provided in this embodiment includes at least one processor 1001 and a memory 1002. Optionally, the device 1000 further includes a communication component 1003. The processor 1001, memory 1002, and communication component 1003 are connected via a bus.

[0283] In a specific implementation, at least one processor 1001 executes computer execution instructions stored in memory 1002, causing at least one processor 1001 to perform the above-described method.

[0284] The specific implementation process of processor 1001 can be found in the above method embodiments, and its implementation principle and technical effect are similar. It will not be repeated here.

[0285] In the above embodiments, it should be understood that the processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), etc. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in this invention can be directly implemented by a hardware processor, or implemented by a combination of hardware and software modules within the processor.

[0286] The memory may include random access memory (RAM) and may also include non-volatile memory (NVM), such as at least one disk storage device.

[0287] The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of illustration, the buses shown in the accompanying drawings are not limited to a single bus or a single type of bus.

[0288] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the above-described method.

[0289] This application also provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the above-described method.

[0290] The aforementioned readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. The readable storage medium can be any available medium accessible to a general-purpose or special-purpose computer.

[0291] An exemplary readable storage medium is coupled to a processor, enabling the processor to read information from and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can reside in an Application Specific Integrated Circuit (ASIC). Alternatively, the processor and the readable storage medium can exist as discrete components in the device.

[0292] The division of units is merely a logical functional division; in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be indirect coupling or communication connection through some interfaces, devices, or units, and may be electrical, mechanical, or other forms.

[0293] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0294] In addition, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0295] If a function is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0296] Those skilled in the art will understand that all or part of the steps of the above-described method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When executed, the program performs the steps of the above-described method embodiments; and the aforementioned storage medium includes various media capable of storing program code, such as ROM, RAM, magnetic disks, or optical disks.

[0297] Finally, it should be noted that other embodiments of the invention will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This invention is intended to cover any variations, uses, or adaptations of the invention that follow the general principles of the invention and include common knowledge or customary techniques in the art not disclosed herein, and is not limited to the precise structures described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of the invention is limited only by the appended claims.

Claims

1. A method for handling alarm events, characterized in that, include: Obtain monitoring index data of the network of work orders to be processed, wherein the monitoring index data includes equipment operating parameters and alarm events; Obtain the trained time series prediction model and the sliding window of the work order network to be processed, wherein the trained time series prediction model is trained through the monitoring index data and the corresponding dynamic threshold range; the initial time length of the sliding window is determined based on preset rules or parameters of the cold start phase. Based on the trained time series prediction model and the monitoring indicator data, prediction processing is performed to determine the corresponding dynamic threshold range; The alarm events are detected and aggregated based on the dynamic threshold range and the sliding window to obtain a preliminary alarm set. The time length of the sliding window is dynamically adjusted based on the real-time alarm density of the initial alarm set; wherein the adjusted sliding window is used for subsequent alarm event detection and aggregation processing. Based on the pre-built network topology diagram, identify the main cause alarm and downstream redundant alarms; Suppress the downstream redundant alarms.

2. The method according to claim 1, characterized in that, Before obtaining the sliding window of the trained time series prediction model and the network of work orders to be processed, the method further includes: Determine if historical work order network historical monitoring data exists; If it does not exist, the preset time length is determined as the initial time length of the sliding window, and the trained meta-learning model is obtained, wherein the meta-learning model is trained through multiple different types of monitoring indicator data; Based on the monitoring index data, the corresponding type features are determined, and the type features are input into the meta-learning model for training to obtain the corresponding model initialization parameters; Based on the model initialization parameters and the preset initial dynamic threshold range, the time series prediction model is constructed and initialized to obtain the trained time series prediction model; If such a model exists, an initial time series prediction model is constructed using transfer learning based on the historical monitoring data. The monitoring indicator data and the preset initial dynamic threshold range are input into the initial time series prediction model for training, so as to obtain the trained time series prediction model. Based on the trained time series prediction model and the preset initial dynamic threshold range, the dynamic threshold range of the cold start phase is determined. The alarm occurrence frequency during the cold start phase is obtained, and the sliding window is initialized based on the alarm occurrence frequency to obtain the parameters of the cold start phase. The initial time length of the sliding window is determined based on the parameters of the cold start phase.

3. The method according to claim 2, characterized in that, The step of performing prediction processing based on the trained time series prediction model and the monitoring indicator data to determine the corresponding dynamic threshold range includes: Based on the time series prediction model, trend analysis is performed on the monitoring indicator data to obtain the predicted mean and predicted standard deviation of the monitoring indicator data. The dynamic threshold range is determined based on the predicted mean and the predicted standard deviation; wherein the dynamic threshold range includes an upper threshold and a lower threshold; the upper threshold is the sum of the predicted mean and twice the predicted standard deviation; and the lower threshold is the difference between the predicted mean and twice the predicted standard deviation.

4. The method according to claim 3, characterized in that, The step of dynamically adjusting the time length of the sliding window based on the real-time alarm density of the preliminary alarm set includes: The timestamps of the alarm events in the preliminary alarm set are extracted to determine the number of alarm events per unit time, so as to obtain the real-time alarm density; Collect historical alarm event data within a historical time period and extract the timestamp information from the historical alarm event data; The timestamp information is clustered to obtain multiple different alarm density intervals; The time length of the sliding window and the real-time alarm density are input into the trained reinforcement learning model to obtain the mapping relationship between the alarm density interval and the time length of the sliding window; The real-time alarm density is matched with the alarm density range to determine the corresponding target range; The time length of the sliding window is dynamically adjusted based on the mapping relationship and the target interval.

5. The method according to claim 4, characterized in that, Before identifying the primary cause alarm and downstream redundancy alarm based on the pre-built network topology diagram, the method further includes: Collect node information, node connection relationship information, and device hierarchy relationship information in the network, wherein the node information includes the identification information of core network nodes, cloud resource pool nodes, and terminal device nodes; The node information is used as graph nodes, the node connection relationship information is used as graph edges, and the device hierarchy relationship information is used as graph edge weights to construct graph structure data; The graph structure data is input into a graph neural network for training to obtain the network topology graph; wherein, the network topology graph is used to characterize the node association strength.

6. The method according to any one of claims 1 to 5, characterized in that, The alarm events are detected and aggregated based on the dynamic threshold range and the sliding window to obtain a preliminary alarm set, including: Receive new alarm events and extract the generation timestamp and indicator value of the new alarm events; Determine whether the value of the indicator exceeds the dynamic threshold range; if it does, mark the new alarm event as a candidate alarm event. Determine whether the generated timestamp falls within the preset time range of the sliding window; If so, the candidate alarm events are aggregated in the sliding window; If not, the candidate alarm event is stored in the alarm event of the pre-built buffer queue, and the corresponding storage time is recorded; wherein, the buffer queue is used to cache alarm events that are not covered by the sliding window; According to the preset inspection cycle, the alarm events in the buffer queue are traversed, and the time difference between the storage time of each alarm event in the buffer queue and the current time is calculated. If the time difference is not greater than the preset delay tolerance time, the alarm event corresponding to the time difference is stored in the next sliding window for aggregation. After aggregation is completed, the candidate alarm events within the sliding window are integrated to obtain the preliminary alarm set.

7. The method according to any one of claims 1 to 5, characterized in that, After suppressing the downstream redundant alarms, the following is also included: Obtain a pre-built work order state machine, wherein the work order state machine is used to manage the lifecycle of alarm work orders, and the work order state includes an active state, a pending confirmation state, and a resolved state; the alarm work order is the work order that only retains the main cause alarm. When the number of associated alarms of the fault node corresponding to the main cause alarm in the sliding window reaches a preset aggregation threshold, the alarm work order is triggered to change from the pending confirmation state to the active state. The system collects the operating parameters of the faulty node through a preset health check interface to verify the fault recovery status. If the operating parameters meet the preset normal range and there are no new related alarm events within the preset observation period, the alarm work order is triggered to change from an active state to a resolved state; if the operating parameters do not meet the preset normal range, the active state is maintained and an intervention notification is triggered. Record the transition time of each state of the alarm work order and the associated alarm information of the associated alarm events to form a work order lifecycle file.

8. The method according to claim 7, characterized in that, After the creation of the work order lifecycle file, the following is also included: Obtain a pre-built AI decision tree and a pre-built rule engine, wherein the AI ​​decision tree is used to output repair action suggestions for the main cause of the fault, and the rule engine is used to store preset automated repair execution rules; Based on the type and level of the primary cause alarm, the AI ​​decision tree is invoked to output corresponding repair action suggestions, and combined with the execution rules of the rule engine, an automated repair instruction is generated; The automated repair command is executed, and the operating parameters of the faulty node are collected in real time through a preset health check interface to verify the repair effect; If the operating parameters do not reach the preset normal range, the status of the alarm work order will be updated from the resolved or pending confirmation status to the active status, and the corresponding intervention notification will be triggered. Extract monitoring data and fault information corresponding to alarm work orders that failed to be repaired, so as to adjust the parameters of the time series prediction model and the artificial intelligence decision tree.

9. The method according to claim 7, characterized in that, Also includes: Obtain preset alarm aggregation dimensions, wherein the aggregation dimensions include network area, device type, and fault level; The alarm events are dimensionally labeled, and the alarm events are divided into multiple different alarm groups according to the alarm aggregation dimension; Based on each alarm group, determine the corresponding dynamic threshold range, the parameters of the sliding window, and the preliminary alarm set; Based on the dynamic threshold range, the parameters of the sliding window, and the preliminary alarm set, establish the association between each alarm group; Based on the aforementioned association, alarm events in different groups triggered by the same primary cause alarm are associated with the same work order; Update the work order association data in the work order state machine based on the associated work order.

10. An alarm storm suppression device based on dynamic thresholds and sliding windows, characterized in that, include: The first acquisition module is used to acquire monitoring indicator data of the network of work orders to be processed, wherein the monitoring indicator data includes equipment operating parameters and alarm events; The second acquisition module is used to acquire the trained time series prediction model and the sliding window of the work order network to be processed. The trained time series prediction model is obtained by training through monitoring indicator data samples and corresponding dynamic threshold range labels. The initial time length of the sliding window is determined based on preset rules or parameters of the cold start phase. The first processing module is used to perform prediction processing based on the trained time series prediction model and the monitoring indicator data to determine the corresponding dynamic threshold range. The second processing module is used to detect and aggregate the alarm events according to the dynamic threshold range and the sliding window to obtain a preliminary alarm set. An adjustment module is used to dynamically adjust the time length of the sliding window based on the real-time alarm density of the initial alarm set; wherein the adjusted sliding window is used for subsequent alarm event detection and aggregation processing. The identification module is used to identify the main cause alarm and downstream redundancy alarm based on the pre-built network topology diagram; The suppression module is used to suppress the downstream redundant alarms.

11. An alarm storm suppression device based on dynamic thresholds and sliding windows, characterized in that, include: Memory, processor; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory, causing the processor to perform the method as described in any one of claims 1-9.

12. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the method as described in any one of claims 1-9.

13. A computer program product, characterized in that, Includes a computer program that, when executed by a processor, implements the method described in any one of claims 1-9.

Images