Alarm event noise reduction processing method, electronic device, and program product

Abstract

The present disclosure provides a noise reduction processing method of an alarm event, an electronic device and a program product. The noise reduction processing method of the alarm event of the present disclosure comprises: in response to the event information of the received alarm event, acquiring system running index data associated with the alarm event; respectively performing semantic feature extraction and normalization processing on the event information of the alarm event and the system running index data to obtain an event feature vector corresponding to the alarm event; performing clustering analysis on the event feature vectors of the alarm events triggered in the first time range and dividing alarm clusters; identifying a main alarm event representing the root cause of the fault from the multiple alarm events in the alarm cluster according to the event information of each alarm event in the alarm cluster; and outputting the main alarm event in the alarm cluster, and when the main alarm event is output, the event information of the other alarm events in the alarm cluster except the main alarm event is compressed and displayed.

Description

Technical Field

[0001] This disclosure relates to a noise reduction processing method, electronic device, and program product for alarm events. Background Technology

[0002] In modern large-scale information technology systems, especially complex business systems employing microservices, distributed architectures, and cloud-native technologies, system stability and reliability are paramount. To monitor system health in real time, a granular monitoring system covering basic components, business metrics, and business log alerts is typically employed. However, based on this granular monitoring system, a single underlying root cause failure (such as a database performance bottleneck) can simultaneously trigger a chain reaction of alerts such as "timeouts" and "error rate spikes" across multiple upstream related microservices. Identifying the root cause from a massive volume of alerts is not only inefficient but also prone to alert fatigue, leading to delayed handling of truly high-risk faults and causing significant business losses. Summary of the Invention

[0003] This disclosure provides a noise reduction processing method, electronic device, and program product for alarm events.

[0004] According to one aspect of this disclosure, a noise reduction processing method for alarm events is provided, comprising: In response to the received alarm event information, obtain system operation indicator data associated with the alarm event; Semantic features are extracted from the event information of the alarm event to generate a text semantic vector. The system operation index data is normalized to generate a standardized numerical vector. The text semantic vector and the standardized numerical vector are concatenated to obtain the event feature vector corresponding to the alarm event. Cluster analysis is performed on the event feature vectors of alarm events triggered within the first time range to determine the correlation strength between alarm events. The alarm events are then divided into alarm clusters based on the correlation strength. Alarm events within the same alarm cluster are identified as chain alarm events caused by the same fault cause, and the correlation strength between alarm events within the alarm cluster and at least some alarm events within the same alarm cluster is greater than or equal to the strength threshold. Based on the event information of each alarm event in the alarm cluster, the trigger time or trigger node of each alarm event in the alarm cluster is determined, and the main alarm event is identified from multiple alarm events in the alarm cluster based on the trigger time or trigger node. The main alarm event is used to characterize the root cause of the fault. The main alarm event in the alarm cluster is output, and when the main alarm event is output, the event information of other alarm events in the alarm cluster other than the main alarm event is compressed and displayed. The compressed display includes folded display or aggregated statistics display.

[0005] According to one technical solution, by responding to the event information of the received alarm event, the system operation index data associated with the alarm event is obtained, and the event information and system operation index data of the alarm event are transformed to obtain the event feature vector corresponding to the alarm event. This realizes the deep fusion of multimodal data and thus constructs a feature representation that can comprehensively and accurately characterize the essence of the alarm event.

[0006] Next, by clustering the event feature vectors of alarm events triggered within the first time frame, cascading alarm events caused by the same fault are grouped into the same alarm cluster. This effectively identifies and aggregates the massive amount of redundant alarms generated by the propagation of a single fault along the system node call chain. Then, the primary alarm event representing the root cause of the fault (i.e., the root cause alarm) is identified and output from the alarm cluster, and other alarm events in the alarm cluster, excluding the primary alarm event, are compressed and displayed. This allows maintenance personnel to directly focus on the root cause alarm, reducing alarm noise, alleviating alarm fatigue, and improving the efficiency of fault diagnosis and location.

[0007] According to at least one embodiment of the noise reduction processing method for alarm events of this disclosure, cluster analysis is performed on the event feature vectors of alarm events triggered within a first time range to determine the correlation strength between alarm events, including: The triggering time and triggering node of any two alarm events are determined from the event feature vectors of any two alarm events triggered within the first time range; Based on the time difference between the trigger times of any two alarm events, the time proximity between the two event feature vectors is determined, and the time proximity is negatively correlated with the time difference. Based on the path length of the shortest topological path in the system node call dependency relationship of the triggering nodes of any two alarm events, the topological correlation between the two event feature vectors is determined, and the topological correlation is negatively correlated with the path length of the shortest topological path. The time proximity and the topological correlation are weighted and summed, and the weighted sum is used as the correlation strength between any two alarm events.

[0008] According to the technical solution of this embodiment, the implicit coupling relationship between alarm events is accurately quantified by multi-dimensional fusion calculation of time proximity and topological correlation, avoiding the defects of false clustering and missed clustering caused by relying solely on fixed time window sliding or simple keyword matching.

[0009] According to at least one embodiment of the noise reduction method for alarm events of this disclosure, before performing cluster analysis on the event feature vectors of alarm events triggered within a first time range, the noise reduction method for alarm events further includes: The similarity between the event feature vector of the newly triggered alarm event and the event feature vector of each alarm event triggered within the second time range is calculated to determine the similarity between the two event feature vectors. If the similarity is greater than or equal to the similarity threshold, the newly triggered alarm event is identified as a duplicate alarm and suppressed.

[0010] According to the technical solution of this embodiment, by comparing the similarity of event feature vectors, the operation and maintenance monitoring system can accurately identify duplicate alarm events, overcome the defect of being insensitive to differences in alarm text descriptions or fluctuations in indicators, and significantly improve the accuracy of duplicate alarm identification.

[0011] According to at least one embodiment of the noise reduction method for alarm events of this disclosure, before performing cluster analysis on the event feature vectors of alarm events triggered within a first time range, the noise reduction method for alarm events further includes: The event type of the newly triggered alarm event is determined by identifying the event feature vector of the newly triggered alarm event, and the event type includes fault alarm or non-fault alarm. When the event type is a non-fault alarm, the newly triggered alarm event is suppressed.

[0012] According to the technical solution of this embodiment, by identifying the event type of alarm events, non-fault alarms caused by normal system fluctuations can be accurately identified and suppressed, reducing alarm noise. Furthermore, the suppressed non-fault alarms do not participate in subsequent cluster analysis processing, saving computing resources and improving the effectiveness of cluster analysis results.

[0013] According to at least one embodiment of the noise reduction processing method for alarm events disclosed herein, suppressing alarm events includes ignoring the alarm events or reducing the output frequency of the alarm events, and the event feature vector of the alarm events does not participate in cluster analysis processing.

[0014] According to the technical solution of this embodiment, alarm noise is reduced, and the suppressed non-fault alarms do not participate in the subsequent cluster analysis process, which saves computing resources and improves the effectiveness of cluster analysis results.

[0015] According to at least one embodiment of the noise reduction processing method for alarm events of this disclosure, in response to received event information of an alarm event, system operation index data associated with the alarm event is obtained, including: In response to the event information of the received alarm event, determine the fluctuation range of the system operation index data within the third time range; The system operation index data that determines the fluctuation range is greater than or equal to the fluctuation threshold is associated with the alarm event and acquired accordingly.

[0016] According to the technical solution of this embodiment, compared with the collection of system operation index data in all dimensions, the system operation index data related to alarm events can be filtered out by fluctuation range, which can greatly reduce the collection of irrelevant index data and avoid the interference of noise dimension.

[0017] A noise reduction processing method for alarm events according to at least one embodiment of the present disclosure identifies the main alarm event from multiple alarm events in the alarm cluster based on the trigger time or trigger node, including: The alarm event with the earliest trigger time in the alarm cluster is determined as the main alarm event; Alternatively, determine the position of the triggering node of each alarm event in the alarm cluster in the system node call dependency relationship, and determine the alarm event triggered by the triggering node at the lowest position in the system node call dependency relationship as the main alarm event.

[0018] According to the technical solution of this embodiment, the validity of the main alarm event identification result can be guaranteed.

[0019] According to at least one embodiment of the noise reduction processing method for alarm events disclosed herein, the event information and event feature vector of the alarm event are persistently stored in a vector database.

[0020] According to the technical solution of this embodiment, it is convenient to filter and obtain information related to alarm events within different time ranges, thereby improving data processing efficiency.

[0021] According to another aspect of this disclosure, an operation and maintenance monitoring system is provided, comprising: The data acquisition module is used to obtain system operation indicator data associated with the alarm event in response to the event information of the received alarm event; The preprocessing module is used to extract semantic features from the event information of the alarm event, generate a text semantic vector, normalize the system operation index data, generate a standardized numerical vector, and concatenate the text semantic vector and the standardized numerical vector to obtain the event feature vector corresponding to the alarm event. The noise reduction processing module is used to perform cluster analysis on the event feature vectors of alarm events triggered within a first time range, determine the correlation strength between alarm events, and divide the alarm events into alarm clusters based on the correlation strength. Alarm events within the same alarm cluster are identified as chain alarm events caused by the same fault cause, and the correlation strength between alarm events within the alarm cluster and at least some alarm events within the same alarm cluster is greater than or equal to a strength threshold. Based on the event information of each alarm event in the alarm cluster, the module determines the trigger time or trigger node of each alarm event in the alarm cluster, and identifies the main alarm event from multiple alarm events in the alarm cluster based on the trigger time or trigger node. The main alarm event is used to characterize the root cause of the fault. The module outputs the main alarm event in the alarm cluster, and when outputting the main alarm event, compresses and displays the event information of other alarm events in the alarm cluster besides the main alarm event. The compressed display includes folded display or aggregated statistical display.

[0022] According to another aspect of this disclosure, an electronic device is provided, comprising: a memory storing execution instructions; and a processor executing the execution instructions stored in the memory, causing the processor to perform a noise reduction processing method for alarm events according to any embodiment of this disclosure.

[0023] According to another aspect of this disclosure, a readable storage medium is provided, wherein execution instructions are stored therein, and when executed by a processor, the execution instructions are used to implement a noise reduction processing method for alarm events according to any embodiment of this disclosure.

[0024] According to another aspect of this disclosure, a computer program product is provided, including a computer program that, when executed by a processor, implements a noise reduction processing method for alarm events according to any embodiment of this disclosure. Attached Figure Description

[0025] The accompanying drawings illustrate exemplary embodiments of the present disclosure and, together with the description thereof, serve to explain the principles of the present disclosure. These drawings are included to provide a further understanding of the present disclosure and are incorporated in and constitute a part of this specification.

[0026] Figure 1 This is a schematic diagram illustrating an application scenario of a noise reduction processing method for alarm events according to one embodiment of the present disclosure.

[0027] Figure 2 This is a flowchart illustrating a noise reduction processing method for alarm events according to one embodiment of the present disclosure.

[0028] Figure 3This is a flowchart illustrating the process of determining the correlation strength in a noise reduction processing method for alarm events according to one embodiment of the present disclosure.

[0029] Figure 4 This is a flowchart illustrating the process of repeat alarm identification in a noise reduction processing method for alarm events according to one embodiment of the present disclosure.

[0030] Figure 5 This is a flowchart illustrating the non-fault alarm identification process in an alarm event noise reduction processing method according to one embodiment of the present disclosure.

[0031] Figure 6 This is a flowchart illustrating step S210 of an alarm event noise reduction processing method according to an embodiment of the present disclosure.

[0032] Figure 7 This is a schematic structural block diagram of an operation and maintenance monitoring system according to one embodiment of the present disclosure.

[0033] Figure 8 This is a schematic structural block diagram of an electronic device according to one embodiment of the present disclosure. Detailed Implementation

[0034] The present disclosure will now be described in further detail with reference to the accompanying drawings and examples. It should be understood that the specific examples described herein are for illustrative purposes only and are not intended to limit the scope of the disclosure. Furthermore, it should be noted that, for ease of description, only the parts relevant to the present disclosure are shown in the accompanying drawings.

[0035] It should be noted that, where there is no conflict, the embodiments and features described in this disclosure can be combined with each other. The technical solutions of this disclosure will now be described in detail with reference to the accompanying drawings and embodiments.

[0036] Existing technologies struggle to quickly identify cascading redundant alarms among a massive number of alarms, resulting in low fault location efficiency and a tendency to cause alarm fatigue.

[0037] To this end, the present disclosure proposes the following technical solution. In this technical solution, in response to the event information of the received alarm event, system operation index data associated with the alarm event is obtained. Semantic feature extraction and normalization processing are performed on the event information of the alarm event and the system operation index data respectively. The obtained text semantic vector and standardized numerical vector are concatenated to obtain the event feature vector corresponding to the alarm event, thereby realizing the deep fusion of multimodal data and constructing a feature representation that can comprehensively and accurately characterize the essence of the alarm event.

[0038] Next, by clustering the event feature vectors of alarm events triggered within the first time frame, cascading alarm events caused by the same fault are grouped into the same alarm cluster. This effectively identifies and aggregates the massive amount of redundant alarms generated by the propagation of a single fault along the system node call chain. Then, the primary alarm event representing the root cause of the fault (i.e., the root cause alarm) is identified and output from the alarm cluster, and other alarm events in the alarm cluster, excluding the primary alarm event, are compressed and displayed. This allows maintenance personnel to directly focus on the root cause alarm, reducing alarm noise, alleviating alarm fatigue, and improving the efficiency of fault diagnosis and location.

[0039] Figure 1 This is a schematic diagram illustrating an application scenario of a noise reduction processing method for alarm events according to one embodiment of this disclosure. For example... Figure 1 As shown, this application scenario includes terminal device 101, network 102, and server 103.

[0040] For example, an operation and maintenance monitoring system is deployed on server 103, which communicates with various monitoring subsystems (such as log alarm system, basic component monitoring system, business indicator monitoring system, etc.). The operation and maintenance monitoring system can collect the original event information of alarm events generated by each monitoring subsystem and the system operation indicator data associated with the alarm event in real time, thereby executing the noise reduction processing method for alarm events provided in this disclosure.

[0041] Terminal device 101 includes one or more electronic devices such as smartphones, tablets, laptops, and desktop computers. The terminal device 101 has a front-end interface program deployed on it, used to display event information of alarm events to maintenance personnel and receive their interactive operations (such as viewing event information and handling alarm events).

[0042] Figure 2 This is a flowchart illustrating a noise reduction method for alarm events according to one embodiment of the present disclosure. This noise reduction method for alarm events can be applied to the operation and maintenance monitoring system described above.

[0043] like Figure 2 As shown, the noise reduction processing method for this alarm event preferably includes steps S210 to S250.

[0044] In step S210, in response to the event information of the received alarm event, system operation index data associated with the alarm event is obtained.

[0045] Alarm events are alarm records that are triggered based on preset rules or thresholds and characterize abnormal states of the business system. Preferably, the event information of an alarm event includes one or more of the following: alarm identifier, alarm type, alarm time, alarm description text, and trigger node identifier.

[0046] The system operation metrics data associated with alarm events are quantitative monitoring data that are correlated with the alarm events in time, space, or logic. Preferably, the system operation metrics data include system component operation data (such as CPU utilization, memory usage, etc.) and business metric data (such as business transaction volume, business transaction response time, etc.).

[0047] In this implementation, upon receiving event information of a newly triggered alarm event, the system operation indicator data associated with the alarm event is determined based on the event information, and the system operation indicator data is acquired.

[0048] For example, based on the alarm time of an alarm event, system component operation data and business indicator data before and after the alarm time can be obtained. It should be noted that the obtained system component operation data and business indicator data can be the operation data of all system components or the data of all business indicators. In other implementations, data with high correlation can be selected from all system component operation data and business indicator data for subsequent processing.

[0049] In step S220, semantic features are extracted from the event information of the alarm event to generate a text semantic vector. The system operation index data is normalized to generate a standardized numerical vector. The text semantic vector and the standardized numerical vector are then concatenated to obtain the event feature vector corresponding to the alarm event.

[0050] In this implementation, system operation metrics data includes system component operation data and business metrics data. The operation and maintenance monitoring system integrates the event information of acquired alarm events with the system component operation data and business metrics data associated with those alarm events.

[0051] Specifically, for alarm event information, the operation and maintenance monitoring system extracts semantic features and converts the event information into corresponding text semantic vectors (which can be obtained through a trained large language model or the BERT (Bidirectional Encoder Representations from Transformers) model). For numerical system component operation data and business indicator data, the operation and maintenance monitoring system performs normalization processing to obtain corresponding standardized numerical vectors, thereby eliminating the differences in dimensions and orders of magnitude between different monitoring dimensions.

[0052] The operation and maintenance monitoring system concatenates the processed text semantic vector with the standardized numerical vector according to preset concatenation rules to obtain a multimodal event feature vector.

[0053] Therefore, by fusing unstructured alarm event information with structured system operation index data, a corresponding event feature vector is obtained. This allows the event feature vector to contain multimodal information related to the alarm event, thereby enabling more accurate differentiation between different alarm events.

[0054] In step S230, cluster analysis is performed on the event feature vectors of alarm events triggered within the first time range to determine the correlation strength between alarm events. Based on the correlation strength, the alarm events are divided into alarm clusters. Alarm events within the same alarm cluster are determined to be chain alarm events caused by the same fault cause, and the correlation strength between the alarm events within the alarm cluster and at least some alarm events within the same alarm cluster is greater than or equal to the strength threshold.

[0055] In this implementation, the operation and maintenance monitoring system, based on clustering triggering rules (such as triggering clustering analysis periodically at fixed intervals or triggering clustering analysis every time a new alarm event is triggered), uses the current system time as a reference to obtain the event feature vectors of alarm events triggered within a first time range (i.e., the feature vectors of alarm events whose trigger times fall within this first time range). It should be noted that this first time range is a preset sliding time window (e.g., 15 minutes), and the length of this sliding time window can be dynamically adjusted according to the system alarm frequency to define the time boundaries of alarm events participating in the clustering analysis.

[0056] After obtaining the event feature vectors of alarm events triggered within the first time range, a preset clustering analysis algorithm is used to perform clustering analysis on all event feature vectors to determine the correlation strength between alarm events. Alarm clusters are then formed based on the correlation strength. Alarm events grouped into the same alarm cluster are identified as cascading alarm events caused by the same fault. Furthermore, the correlation strength between alarm events within the same alarm cluster and at least some alarm events within the same alarm cluster is greater than or equal to a preset strength threshold. The "some alarm events within the same alarm cluster" mentioned in this disclosure can be one or more alarm events within the same alarm cluster, without any specific limitation.

[0057] Preferably, the operation and maintenance monitoring system combines alarm events triggered within the first time range into pairs to obtain several alarm event pairs. For each alarm event pair, the operation and maintenance monitoring system uses a clustering analysis algorithm to determine the correlation strength between the two alarm events. If the correlation strength is greater than or equal to a strength threshold, then any two alarm events are identified as cascading alarm events caused by the same fault and are assigned to the same alarm cluster.

[0058] It is worth noting that if an alarm event has a correlation strength greater than or equal to a certain threshold only with some alarm events in an already divided alarm cluster, then the alarm event will also be classified into that alarm cluster. For example, if the correlation strength between alarm event A and alarm event B is greater than or equal to the strength threshold, and the correlation strength between alarm event B and alarm event C is also greater than or equal to the strength threshold, then even if the correlation strength between alarm event A and alarm event C is less than the strength threshold, alarm events A, B, and C will still be classified into the same alarm cluster.

[0059] In step S240, the trigger time or trigger node of each alarm event in the alarm cluster is determined according to the event information of each alarm event in the alarm cluster, and the main alarm event is identified from the multiple alarm events in the alarm cluster according to the trigger time or trigger node. The main alarm event is used to characterize the root cause of the fault.

[0060] Among them, the main alarm event is the alarm event that represents the root cause of the fault in the alarm cluster, and it is also the starting alarm event that triggers other alarm events in the alarm cluster.

[0061] In this implementation, the operation and maintenance monitoring system determines the event information of all alarm events within each generated alarm cluster, and identifies the primary alarm event of the alarm cluster based on the event information of all alarm events. Preferably, the operation and maintenance monitoring system determines the trigger time or trigger node of each alarm event in the alarm cluster, and identifies the primary alarm event from multiple alarm events in the alarm cluster based on the trigger time or trigger node of each alarm event. For example, the alarm event with the earliest trigger time is identified as the primary alarm event, or the alarm event whose trigger node is at the lowest level of the system architecture is identified as the primary alarm event, etc.

[0062] In step S250, the main alarm event in the alarm cluster is output, and when the main alarm event is output, the event information of other alarm events in the alarm cluster besides the main alarm event is compressed and displayed. The compressed display includes folded display or aggregated statistical display.

[0063] In this implementation, after identifying the primary alarm event in the alarm cluster, the primary alarm event is prioritized and output as the representative event of the alarm cluster (e.g., sent to the maintenance personnel's terminal device in the form of a pop-up window). Simultaneously, the event information of alarm events other than the primary alarm event within the alarm cluster is compressed and displayed.

[0064] This compressed display simplifies the presentation of alarm events other than the primary alarm event (i.e., redundant alarm events) within an alarm cluster. Preferably, compressing the event information of redundant alarm events involves either collapsing the event information within the alarm cluster (e.g., compressing it into an expandable list) or displaying only the quantity statistics after aggregating and statistically analyzing the event information, rather than displaying it flatly and independently, thus avoiding information overload. It is worth noting that compressed display does not affect the storage and subsequent retrieval of the original event information of redundant alarm events.

[0065] Therefore, according to the noise reduction method for alarm events provided in this disclosure, in response to the event information of the received alarm event, the system operation index data associated with the alarm event is obtained, and the event information of the alarm event and the system operation index data are subjected to semantic feature extraction and normalization processing respectively. The obtained text semantic vector and standardized numerical vector are concatenated to obtain the event feature vector corresponding to the alarm event, thereby realizing the deep fusion of multimodal data and constructing a feature representation that can comprehensively and accurately characterize the essence of the alarm event.

[0066] Next, by clustering the event feature vectors of alarm events triggered within the first time frame, cascading alarm events caused by the same fault are grouped into the same alarm cluster. This effectively identifies and aggregates the massive amount of redundant alarms generated by the propagation of a single fault along the system node call chain. Then, the primary alarm event representing the root cause of the fault (i.e., the root cause alarm) is identified and output from the alarm cluster, and other alarm events in the alarm cluster, excluding the primary alarm event, are compressed and displayed. This allows maintenance personnel to directly focus on the root cause alarm, reducing alarm noise, alleviating alarm fatigue, and improving the efficiency of fault diagnosis and location.

[0067] In some embodiments of this disclosure, the event feature vectors of alarm events triggered within a first time range are input into a large language model. By constructing prompt words, the large language model analyzes the potential correlations (such as time proximity, topological correlation, etc.) between the input event feature vectors, identifies cascading alarm events caused by the same fault, and clusters them into an alarm cluster. Then, based on the formed alarm cluster, the large language model identifies and outputs the primary alarm event from the multiple alarm events contained in the alarm cluster. The remaining alarm events within the alarm cluster are marked as "redundant alarm events" and displayed in compressed format.

[0068] Preferably, the aforementioned large language model is obtained by fine-tuning a pre-trained large language model such as the GPT model. Specifically, alarm event records that have been confirmed as cascading alarms are collected from historical operation and maintenance data (including event feature vectors of each alarm event triggered in history) as positive sample clusters and labeled with the main alarm event identifier. The event information, system operation index data, system node call dependencies, etc. of each alarm event in the positive sample cluster are concatenated into input instructions according to the prompt template. Through instruction fine-tuning or adaptive parameter updates, the large language model implicitly learns the temporal and topological causal logic of fault propagation. In this way, it can identify cascading alarm events caused by the same fault from a large number of alarms, and further identify the main alarm event from the cascading alarm events.

[0069] In some embodiments of this disclosure, cluster analysis is performed on the event feature vectors of alarm events triggered within a first time range to determine the correlation strength between alarm events. Preferably, this includes steps S310 to S330. Please refer to [reference needed]. Figure 3 .

[0070] In step S310, the triggering time and triggering node of any two alarm events are determined from the event feature vectors of any two alarm events triggered within the first time range.

[0071] In step S320, the time proximity between two event feature vectors is determined based on the time difference between the trigger times of any two alarm events, wherein the time proximity is negatively correlated with the time difference. Additionally, the topological correlation between two event feature vectors is determined based on the path length of the shortest topological path in the system node call dependency relationship of the triggering nodes of any two alarm events, wherein the topological correlation is negatively correlated with the path length of the shortest topological path.

[0072] In step S330, the time proximity and the topological correlation are weighted and summed, and the weighted summation result is used as the correlation strength between any two alarm events.

[0073] In this implementation, the operation and maintenance monitoring system traverses the event feature vectors of all alarm events within the first time range to obtain the trigger time and trigger node corresponding to each alarm event. A set of all alarm event pairs to be evaluated is constructed using a pairwise combination method.

[0074] For each pair of alarm events, the time difference between the trigger times of the two alarm events is calculated, and the corresponding time proximity (presented as a score) is determined based on this time difference. This time proximity is negatively correlated with the time difference; that is, the smaller the time difference, the greater the time proximity, and vice versa. Preferably, the time difference is substituted into a preset time decay function to output the time proximity. This time decay function is configured such that the smaller the time difference, the higher the time proximity, and the time proximity is zero when the time difference exceeds a preset time boundary.

[0075] When calculating topology correlation, a preset system node call dependency relationship is retrieved to determine the position of the triggering nodes of the two alarm events in the system node call dependency relationship, thereby determining the path length of the shortest topology path between the two triggering nodes. Then, based on the path length of this shortest topology path, the topology correlation between the two alarm events is determined (presented as a score). This topology correlation is negatively correlated with the path length of the shortest topology path; that is, the shorter the path length, the greater the corresponding topology correlation, and vice versa.

[0076] After determining the temporal proximity and topological correlation, a weighted summation is performed based on these two factors, and the result of the weighted summation is used as the correlation strength between the two alarm events.

[0077] The operation and maintenance monitoring system compares the correlation strength with a preset strength threshold. If the correlation strength is greater than or equal to the strength threshold, the two alarm events are determined to be chain alarm events caused by the same fault and are classified into the same alarm cluster. If the correlation strength is less than the strength threshold, the event feature vectors of the two alarm events are determined to be not strongly correlated and remain independent.

[0078] Therefore, by using multi-dimensional fusion calculation of time proximity and topological correlation, the implicit coupling relationship between the event feature vectors of alarm events is accurately quantified, avoiding the defects of false clustering and missed clustering caused by relying solely on fixed time window sliding or simple keyword matching.

[0079] In other implementations, the operation and maintenance monitoring system calculates the similarity (such as cosine similarity) between any two event feature vectors based on the event feature vectors of alarm events triggered within the first time range, and uses this similarity as the correlation strength between the corresponding alarm events, or combines the aforementioned time proximity and topological correlation (such as calculating the weighted sum of the three) to determine the correlation strength between the corresponding alarm events.

[0080] In some embodiments of this disclosure, before performing cluster analysis on the event feature vectors of alarm events triggered within a first time range, the noise reduction processing method for the alarm events preferably further includes steps S410 to S420. Please refer to [link / reference]. Figure 4 .

[0081] In step S410, the similarity between the event feature vector of the newly triggered alarm event and the event feature vectors of each alarm event triggered within the second time range is calculated to determine the similarity between the two event feature vectors.

[0082] In step S420, if the similarity is greater than or equal to the similarity threshold, the newly triggered alarm event is identified as a duplicate alarm and suppressed.

[0083] In this implementation, after a new alarm event's event feature vector is generated, the operation and maintenance monitoring system uses the current system time as a reference to obtain the event feature vectors of alarm events triggered within a second time range (such as the previous month or 15 days).

[0084] Next, the similarity between the newly generated alarm event feature vector and the event feature vectors of each alarm event within the second time range is calculated (e.g., the cosine similarity between the two is calculated) to determine the similarity between the two event feature vectors.

[0085] The operation and maintenance monitoring system compares this similarity score with a pre-set similarity threshold. If the similarity score is greater than or equal to the threshold, the newly triggered alarm event is determined to be a duplicate alarm event (i.e., repeatedly triggered based on the same known problem). If the similarity score is less than the threshold, the newly triggered alarm event is determined to be a non-duplicate alarm event.

[0086] For alarm events identified as recurring alarm events, the operation and maintenance monitoring system suppresses them according to preset strategies.

[0087] Therefore, by comparing the similarity of event feature vectors, the operation and maintenance monitoring system can accurately identify duplicate alarm events, overcoming the shortcomings of being insensitive to differences in alarm text descriptions or fluctuations in indicators, and significantly improving the accuracy of duplicate alarm identification.

[0088] In some embodiments of this disclosure, before performing cluster analysis on the event feature vectors of alarm events triggered within a first time range, the noise reduction processing method for the alarm events preferably further includes steps S510 to S520. Please refer to [link / reference]. Figure 5 .

[0089] In step S510, the event type of the newly triggered alarm event is determined by identifying the event feature vector of the newly triggered alarm event. The event type includes fault alarm or non-fault alarm.

[0090] In step S520, if the event type is a non-fault alarm, the newly triggered alarm event is suppressed.

[0091] In this implementation, after a new alarm event's event feature vector is generated, the operation and maintenance monitoring system inputs the event feature vector into a pre-trained classifier (which is trained using historical operation and maintenance labeled data (including manually confirmed real fault samples and normal fluctuation / false alarm samples)). The classifier determines, based on the input event feature vector, whether the corresponding alarm event is a "fault alarm" representing a real fault or a "non-fault alarm" (i.e., a false alarm) caused only by normal system fluctuations.

[0092] If the classifier outputs an event type that is not a fault alarm, the operation and maintenance monitoring system will suppress the alarm event, such as not pushing it to operation and maintenance personnel, and only storing its event information and event feature vector. Similarly, if an alarm event is determined to be a non-fault alarm, its corresponding event feature vector will not undergo subsequent clustering analysis or other processes. If the classifier outputs an event type that is a fault alarm, then the subsequent clustering analysis and main alarm identification processes will begin.

[0093] It should be noted that in the technical solution disclosed herein, the identification of repeated alarm events and non-fault alarms described above can be carried out by one or a combination of the two methods (such as first detecting whether it is a repeated alarm event, and then detecting whether it is a non-fault alarm), and no special limitation is made in this regard.

[0094] Therefore, by identifying the event type of alarm events, non-fault alarms caused by normal system fluctuations can be accurately identified and suppressed, thereby reducing alarm noise.

[0095] In some embodiments of this disclosure, suppressing alarm events (such as repeated alarms or non-fault alarms) includes ignoring the alarm events or reducing the output frequency of the alarm events, and the event feature vectors of the alarm events do not participate in cluster analysis processing.

[0096] In this implementation, when an alarm event is determined to be a duplicate alarm or a non-fault alarm, the operation and maintenance monitoring system will perform a suppression operation on the event. This suppression operation includes one or more of the following strategies: First, ignore the alarm event, i.e., do not send it to any output channel (e.g., do not send it to operation and maintenance personnel), but retain relevant information about the alarm event (e.g., event information, event feature vector, system operation index data, etc., for subsequent processing); second, reduce the output frequency, for example, only outputting when the same type of alarm first appears within a preset time window, and subsequently updating the count for the same alarm (i.e., duplicate alarm) without pushing it separately or reducing the push frequency (e.g., if 5 duplicate alarms are received, only push 2 to operation and maintenance personnel, etc.).

[0097] Meanwhile, the event feature vectors of suppressed alarm events are no longer involved in subsequent cluster analysis, ensuring that cluster analysis is performed only on alarm events that truly require attention.

[0098] This reduces alarm noise, and the suppressed non-fault alarms do not participate in subsequent cluster analysis, saving computational resources and improving the effectiveness of cluster analysis results.

[0099] In some embodiments of this disclosure, step S210, in response to the received alarm event information, obtains system operation indicator data associated with the alarm event, preferably includes steps S211 to S212. Please refer to [reference needed]. Figure 6 .

[0100] In step S211, in response to the event information of the received alarm event, the fluctuation range of each system operation indicator data within the third time range is determined.

[0101] In step S212, the system operation indicator data with the fluctuation range greater than or equal to the fluctuation threshold are associated with the alarm event and acquired.

[0102] In this implementation, when the operation and maintenance monitoring system receives a new alarm event information, the operation and maintenance monitoring system uses the current system time as a reference to obtain the values ​​of all system operation indicator data within a third time range (such as the first 5 minutes of the current system time), and determines the fluctuation range of each system operation indicator data within the third time range (which can be determined based on the difference between the maximum and minimum values).

[0103] Next, the operation and maintenance monitoring system compares the fluctuation range with a pre-set fluctuation threshold (the fluctuation threshold may differ for different system operation indicator data). If the fluctuation range of a certain system operation indicator data within the third time range is greater than or equal to the corresponding fluctuation threshold, then the system operation indicator data is considered to be associated with the alarm event. If the fluctuation range is less than the corresponding fluctuation threshold, then the system operation indicator data is considered to be stable and unrelated to the alarm event.

[0104] For system operation indicator data that is identified as being associated with alarm events, the operation and maintenance monitoring system can acquire and record the system operation indicator data (or data sequence) within that third time range for subsequent processing.

[0105] Therefore, compared to collecting system operation index data across all dimensions, filtering out system operation index data associated with alarm events by considering fluctuation range can significantly reduce the collection of irrelevant index data, avoid interference from noise dimensions, and further improve the accuracy of subsequent event feature vector generation, cluster analysis processing, and main alarm event identification.

[0106] In some embodiments of this disclosure, identifying the main alarm event from multiple alarm events in the alarm cluster based on the trigger time or trigger node preferably includes: determining the alarm event with the earliest trigger time in the alarm cluster as the main alarm event.

[0107] In this implementation, for an already generated alarm cluster, the operation and maintenance monitoring system acquires the event information of all alarm events within the alarm cluster and extracts the trigger time of each alarm event. Then, by comparing the magnitudes of these trigger times, the operation and maintenance monitoring system identifies the alarm event with the earliest trigger time and determines it as the primary alarm event.

[0108] Thus, in a large number of alarm events, the subsequent alarm events are mostly chain alarms caused by the same fault. Therefore, identifying the main alarm event based on the trigger time conforms to the temporal evolution law of the fault spreading from the source to the upstream and downstream, ensuring the accuracy of the main alarm event identification results.

[0109] In other embodiments of this disclosure, identifying the main alarm event from multiple alarm events in the alarm cluster based on the trigger time or trigger node preferably includes: determining the position of the trigger node of each alarm event in the alarm cluster in the system node call dependency relationship, and determining the alarm event triggered by the trigger node at the downstream position in the system node call dependency relationship as the main alarm event.

[0110] The system node call dependency relationship is a directed upstream-downstream dependency relationship formed between services or components through call requests. That is, when one node (upstream) calls another node (downstream), the operating state of the upstream depends on the response of the downstream. Preferably, the system node call dependency relationship is presented in the form of a directed topology graph.

[0111] In this implementation, for an alarm cluster, the operation and maintenance monitoring system determines the triggering node of each alarm event within the alarm cluster (e.g., obtained from the event feature vector or event information of the alarm event). Then, the operation and maintenance monitoring system maps each triggering node to a preset system node call dependency relationship, determining the position of each triggering node within that system node call dependency relationship.

[0112] Based on the physical law that faults usually propagate from the bottom layer to the upstream business layer, the operation and maintenance monitoring system determines the alarm event that triggers the node at the downstream position of the system node call dependency relationship (i.e., the deepest dependency level and closest to the basic resource layer (such as database)) as the starting source of the alarm cluster, i.e. the main alarm event.

[0113] In this way, by identifying the main alarm event based on the system node call dependency relationship, the physical propagation path of the fault from the bottom layer to the top is directly restored, which effectively eliminates the risk of misjudgment of the main alarm event caused by timing interference and retry mechanism, and ensures the accuracy of the main alarm event identification result.

[0114] In some embodiments of this disclosure, after obtaining the event feature vector corresponding to the alarm event, the noise reduction processing method for the alarm event preferably further includes: persistently storing the event information and event feature vector of the alarm event in a vector database.

[0115] In this implementation, after extracting features from the event information and associated system operation metrics of alarm events and generating event feature vectors, the operation and maintenance monitoring system encapsulates the feature-extracted alarm events, using their alarm identifiers as the primary key, and encapsulates the event information and corresponding event feature vectors into structured records, which are then persistently stored in the vector database. Simultaneously, auxiliary indexes are established for metadata such as alarm events and trigger node identifiers in the event information to support subsequent time-range filtering and topology-related queries.

[0116] In this way, by associating and storing the event feature vectors and event information of alarm events in a vector database, the speed of filtering and obtaining alarm event-related information (including event feature vectors and event information) in different time ranges is improved in subsequent cluster analysis, duplicate alarm event identification, or non-fault alarm identification processes, thereby ensuring the computational efficiency of the corresponding processing processes.

[0117] Figure 7This is a schematic structural block diagram of an operation and maintenance monitoring system according to one embodiment of the present disclosure.

[0118] like Figure 7 As shown, the operation and maintenance monitoring system preferably includes a data acquisition module 710, a preprocessing module 720, and a noise reduction processing module 730.

[0119] Specifically, the data acquisition module 710 is used to obtain system operation index data associated with the alarm event in response to the event information of the received alarm event; The preprocessing module 720 is used to extract semantic features from the event information of the alarm event, generate a text semantic vector, normalize the system operation index data, generate a standardized numerical vector, and concatenate the text semantic vector and the standardized numerical vector to obtain the event feature vector corresponding to the alarm event. The noise reduction processing module 730 is used to perform cluster analysis on the event feature vectors of alarm events triggered within a first time range, determine the correlation strength between alarm events, and divide the alarm events into alarm clusters according to the correlation strength. Alarm events within the same alarm cluster are identified as chain alarm events caused by the same fault cause, and the correlation strength between alarm events within the alarm cluster and at least some alarm events within the same alarm cluster is greater than or equal to a strength threshold. Based on the event information of each alarm event in the alarm cluster, the trigger time or trigger node of each alarm event in the alarm cluster is determined, and the main alarm event is identified from multiple alarm events in the alarm cluster based on the trigger time or trigger node. The main alarm event is used to characterize the root cause of the fault. The main alarm event in the alarm cluster is output, and when outputting the main alarm event, the event information of other alarm events in the alarm cluster besides the main alarm event is compressed and displayed. The compressed display includes folded display or aggregated statistical display.

[0120] In some embodiments of this disclosure, before performing cluster analysis on the event feature vectors of alarm events triggered within a first time range, the noise reduction processing module 730 is further configured to: calculate the similarity between the event feature vector of the newly triggered alarm event and the event feature vector of the alarm event triggered within a second time range, and determine the similarity between the two event feature vectors; and if the similarity is greater than or equal to a similarity threshold, determine the newly triggered alarm event as a duplicate alarm and suppress it.

[0121] In some embodiments of this disclosure, before performing cluster analysis on the event feature vectors of alarm events triggered within a first time range, the noise reduction processing module 730 is further configured to: identify the event type of the newly triggered alarm event based on the event feature vector of the newly triggered alarm event, the event type including fault alarm or non-fault alarm; and suppress the newly triggered alarm event if the event type is a non-fault alarm.

[0122] In some embodiments of this disclosure, after obtaining the event feature vector corresponding to the alarm event, the preprocessing module 720 is further configured to: persistently store the event information and event feature vector of the alarm event in a vector database.

[0123] Figure 8 This is a schematic structural block diagram of an electronic device according to one embodiment of the present disclosure.

[0124] like Figure 8 As shown, the hardware structure of the electronic device 1000 can be implemented using a bus architecture. The bus architecture can include any number of interconnect buses and bridges, depending on the specific application and overall design constraints of the hardware. Bus 1100 connects various circuits including one or more processors 1200, memory 1300, and / or hardware modules. Bus 1100 can also connect various other circuits 1400 such as peripherals, voltage regulators, power management circuits, external antennas, etc. Bus 1100 can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of illustration, only one connection line is used in this figure, but this does not indicate that there is only one bus or one type of bus.

[0125] This disclosure also provides a readable storage medium storing a computer program that, when executed by a processor, is used to implement the methods described above. A "readable storage medium" can be any means that can contain a program for storage, communication, propagation, or transmission for use by or in conjunction with an instruction execution system, apparatus, or device. More specific examples of a readable storage medium include: an electrical connection with one or more wires (electronic device), a portable computer disk drive (magnetic device), random access memory (RAM), read-only memory (ROM), erasable and programmable read-only memory (EPROM or flash memory), fiber optic devices, and portable read-only memory (CDROM), etc.

[0126] This disclosure also provides a computer program product, the methods of which can be implemented wholly or partially through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented wholly or partially as a computer program product. The computer program product includes one or more computer programs or instructions. When the computer program or instructions are loaded and executed, all or part of the processes or functions of this disclosure are performed.

[0127] Computer programs or instructions can be stored in a readable storage medium or transferred from one readable storage medium to another. For example, the computer program or instructions can be transferred from one website, computer, server, or data center to another website, computer, server, or data center via wired or wireless means. The readable storage medium can be any available medium capable of access, or a data storage device such as a server or data center that integrates one or more available media. The available medium can be a magnetic medium, such as a floppy disk, hard disk, or magnetic tape; an optical medium, such as a digital video optical disc; or a semiconductor medium, such as a solid-state drive. The computer-readable storage medium can be a volatile or non-volatile storage medium, or it can include both volatile and non-volatile types of storage media.

[0128] Those skilled in the art will understand that embodiments of this disclosure can be provided as methods, systems, or computer program products. Therefore, this disclosure can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this disclosure can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0129] This disclosure is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to this disclosure. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0130] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0131] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0132] In the description of this specification, the references to terms such as "one embodiment / mode," "some embodiments / modes," "example," "specific example," or "some examples," etc., refer to specific features, structures, or characteristics described in connection with that embodiment / mode or example, which are included in at least one embodiment / mode or example of this disclosure. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment / mode or example. Moreover, the specific features, structures, or characteristics described may be combined in any suitable manner in one or more embodiments / modes or examples. Furthermore, without contradiction, those skilled in the art can combine and integrate the different embodiments / modes or examples described in this specification, as well as the features of different embodiments / modes or examples.

[0133] Those skilled in the art should understand that the above embodiments are merely for illustrating the present disclosure and are not intended to limit the scope of the disclosure. Those skilled in the art can make other changes or modifications based on the above disclosure, and these changes or modifications still fall within the scope of the present disclosure.

Claims

1. A noise reduction processing method for alarm events, characterized in that, include: In response to the received alarm event information, obtain system operation indicator data associated with the alarm event; Semantic features are extracted from the event information of the alarm event to generate a text semantic vector. The system operation index data is normalized to generate a standardized numerical vector. The text semantic vector and the standardized numerical vector are concatenated to obtain the event feature vector corresponding to the alarm event. Cluster analysis is performed on the event feature vectors of alarm events triggered within the first time range to determine the correlation strength between alarm events. The alarm events are then divided into alarm clusters based on the correlation strength. Alarm events within the same alarm cluster are identified as chain alarm events caused by the same fault cause, and the correlation strength between alarm events within the alarm cluster and at least some alarm events within the same alarm cluster is greater than or equal to the strength threshold. Based on the event information of each alarm event in the alarm cluster, the trigger time or trigger node of each alarm event in the alarm cluster is determined, and the main alarm event is identified from multiple alarm events in the alarm cluster based on the trigger time or trigger node. The main alarm event is used to characterize the root cause of the fault. as well as The main alarm event in the alarm cluster is output, and when the main alarm event is output, the event information of other alarm events in the alarm cluster other than the main alarm event is compressed and displayed. The compressed display includes folded display or aggregated statistics display.

2. The noise reduction processing method for alarm events as described in claim 1, characterized in that, Cluster analysis is performed on the event feature vectors of alarm events triggered within the first time frame to determine the correlation strength between alarm events, including: The triggering time and triggering node of any two alarm events are determined from the event feature vectors of any two alarm events triggered within the first time range; Based on the time difference between the trigger times of any two alarm events, a temporal proximity between the two event feature vectors is determined, wherein the temporal proximity is negatively correlated with the time difference. Furthermore, based on the path length of the shortest topological path in the system node call dependency relationship between the triggering nodes of any two alarm events, a topological correlation between the two event feature vectors is determined, wherein the topological correlation is negatively correlated with the path length of the shortest topological path. The time proximity and the topological correlation are weighted and summed, and the weighted sum is used as the correlation strength between any two alarm events.

3. The noise reduction processing method for alarm events as described in claim 1, characterized in that, Before performing cluster analysis on the event feature vectors of alarm events triggered within the first time range, the noise reduction method for the alarm events further includes: The similarity between the event feature vector of the newly triggered alarm event and the event feature vectors of all alarm events triggered within the second time range is calculated to determine the similarity between the two event feature vectors; and If the similarity is greater than or equal to the similarity threshold, the newly triggered alarm event is identified as a duplicate alarm and suppressed.

4. The noise reduction processing method for alarm events as described in claim 1, characterized in that, Before performing cluster analysis on the event feature vectors of alarm events triggered within the first time range, the noise reduction method for the alarm events further includes: The event type of the newly triggered alarm event is determined by identifying its event feature vector, which includes either a fault alarm or a non-fault alarm; and When the event type is a non-fault alarm, the newly triggered alarm event is suppressed.

5. The noise reduction processing method for alarm events as described in claim 3 or 4, characterized in that, Suppressing alarm events includes ignoring the alarm events or reducing the output frequency of the alarm events, and the event feature vectors of the alarm events are not involved in cluster analysis.

6. The noise reduction processing method for alarm events as described in claim 1, characterized in that, In response to the received alarm event information, obtain system operation indicator data associated with the alarm event, including: In response to the received alarm event information, determine the fluctuation range of each system operation indicator data within a third time range; and The system operation index data that determines the fluctuation range is greater than or equal to the fluctuation threshold is associated with the alarm event and acquired accordingly.

7. The noise reduction processing method for alarm events as described in claim 1, characterized in that, Identify the primary alarm event from multiple alarm events in the alarm cluster based on the trigger time or trigger node, including: The alarm event with the earliest trigger time in the alarm cluster is determined as the main alarm event; Alternatively, determine the position of the triggering node of each alarm event in the alarm cluster in the system node call dependency relationship, and determine the alarm event triggered by the triggering node at the lowest position in the system node call dependency relationship as the main alarm event.

8. The noise reduction processing method for alarm events as described in any one of claims 1-7, characterized in that, After obtaining the event feature vector corresponding to the alarm event, the noise reduction processing method for the alarm event further includes: The event information and event feature vector of the alarm event are persistently stored in the vector database.

9. An electronic device, characterized in that, include: The memory stores execution instructions; as well as A processor that executes execution instructions stored in the memory, causing the processor to perform the noise reduction processing method for the alarm event according to any one of claims 1 to 8.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the noise reduction processing method for alarm events as described in any one of claims 1 to 8.

Images