A containerized alarm push method and system based on dynamic association

Abstract

This invention discloses a method and system for precise push notifications of containerized alerts based on dynamic association. The method specifically includes: predicting container resource bottlenecks based on multi-dimensional monitoring metrics and historical time-series data during container runtime, analyzing container change frequency, and generating a first alert event; performing intelligent error correction and association mapping on fuzzy or modified service names involved in the first alert event, and outputting a second alert event; predicting and determining the optimal person responsible for the current event based on the second alert event, and generating a third alert event; and deploying a decision tree model to dynamically select the optimal notification channel and notification timing strategy based on the historical response channel preferences and response timeliness data of the person responsible determined in the third alert event. This invention achieves early detection, precise error correction, intelligent prediction of responsible persons, and dynamic selection of notification strategies for containerized alerts, effectively improving the timeliness and accuracy of alert processing and ensuring the stable operation of the container environment.

Description

Technical Field

[0001] This invention relates to the field of container service technology, and in particular to a method and system for precise push of containerized alerts based on dynamic association. Background Technology

[0002] In today's digital enterprise operating environment, container technology, especially Kubernetes, has become a mainstream trend. As businesses expand and change dynamically, they need to manage tens of thousands of containers that are automatically created or deleted at any time. This large-scale and frequently changing container environment presents significant challenges to traditional alert management methods, specifically in the following aspects: First, in traditional alarm management methods, alarm receivers need to be manually configured every time a new container is added. Due to the large number of containers and the frequent creation and deletion operations, this manual configuration method not only consumes significant manpower and time but is also highly prone to configuration errors or omissions. For example, during a promotional event, a large e-commerce company might create a large number of new container instances in a short period to support business operations and handle peak traffic. If manual alarm rule configuration is used, staff would need to complete alarm settings for a large number of new containers within a short timeframe, which is virtually impossible. Even if it were barely accomplished, the accuracy and timeliness of the configuration would be difficult to guarantee, thus affecting the stability and reliability of the entire system.

[0003] Secondly, when containers encounter problems, the traditional approach often involves sending mass alerts to dozens or even more people. This mass-sending method has serious drawbacks. On the one hand, receiving alerts from a large number of irrelevant personnel not only causes information overload and affects their normal work efficiency, but may also lead them to become desensitized to or ignore alerts. On the other hand, the person truly responsible for handling the alert may be overwhelmed by the large number of alerts, unable to obtain key information in a timely manner, thus delaying problem resolution and causing unnecessary losses to the enterprise. For example, in a financial trading system, if a container malfunctions and causes trading delays, sending the alert to the entire technical team might lead to team members failing to notice the important alert in time due to the sheer volume of messages, resulting in prolonged trading disruptions, impacting customer experience and the company's reputation.

[0004] Furthermore, with the dynamic creation and deletion of containers, newly added container service alerts are difficult to automatically and accurately associate with the corresponding responsible parties. Traditional methods lack an effective mechanism to track container changes and the correspondence between services and responsible parties in real time, making it impossible to quickly determine who should be responsible for handling the issue when an alert occurs. For example, in a cloud service provider's environment, a newly deployed container service may involve multiple teams and responsible parties. When an alert occurs for this service, the lack of an automatic association mechanism requires a significant amount of time for manual investigation and identification of the responsible party, which undoubtedly reduces problem-solving efficiency and increases system failure recovery time.

[0005] Finally, traditional alert push methods are relatively simplistic and do not fully consider the historical response channel preferences and response time data of responsible personnel. Different responsible personnel may prefer different notification channels (such as email, SMS, instant messaging tools, etc.), and their response times may vary for different types of alerts. Traditional methods cannot dynamically select the optimal notification channel and timing strategy based on this personalized information, resulting in alert messages not being delivered to responsible personnel in a timely and effective manner, affecting the timeliness of problem resolution. For example, a responsible person may prefer to receive emergency alert messages through instant messaging tools, while traditional methods uniformly send them via email, which may cause that responsible person to miss the alert information in time, thus delaying problem handling.

[0006] In summary, existing traditional alarm management methods have many drawbacks when facing large-scale and frequently changing container environments, and cannot meet enterprises' needs for efficient and accurate alarm management. Summary of the Invention

[0007] The purpose of this invention is to provide a method and system for accurate push notification of containerized alarms based on dynamic association, which realizes early detection, accurate error correction, intelligent prediction of responsible persons, and dynamic selection of notification strategies for containerized alarms, effectively improving the timeliness and accuracy of alarm processing, ensuring the stable operation of the container environment, and solving at least one of the above-mentioned problems of the prior art.

[0008] In a first aspect, the present invention provides a method for precise push notification of containerized alarms based on dynamic association, the method specifically including: Based on multi-dimensional monitoring metrics and historical time-series data of container runtime, a CNN-LSTM hybrid model is used to predict container resource bottlenecks, analyze container change frequency, and generate early warning events. For the first alarm event, a service knowledge graph is constructed based on the collected service metadata, service dependencies, and historical records of changes in responsible persons. By using graph neural networks to embed the service knowledge graph, intelligent error correction and association mapping are performed on the ambiguous or modified service names involved in the first alarm event, and the second alarm event is output. Based on the second alarm event, combined with the relationships extracted from the service knowledge graph, the current organizational structure data, and historical alarm response records, the XGBoost model is trained and applied to predict and determine the optimal person in charge of the current event, and a third alarm event is generated. Based on the historical response channel preferences and response time data of the person in charge identified in the third alarm event, a decision tree model is deployed to dynamically select the optimal notification channel and notification timing strategy. If no response is received within a preset time, an upgrade decision process is triggered based on the backup relationship or organizational level in the service knowledge graph.

[0009] Secondly, the present invention provides a containerized alarm precision push system based on dynamic association, the system specifically comprising: The container prediction module is used to predict container resource bottlenecks based on multi-dimensional monitoring metrics and historical time-series data during container runtime, using a CNN-LSTM hybrid model, analyzing container change frequency, and generating early warning events. The knowledge graph module is used to construct a service knowledge graph based on the collected service metadata, service dependencies, and historical owner change records for the first alarm event. The service correction module is used to embed the service knowledge graph into a graph neural network, perform intelligent error correction and association mapping on the ambiguous or modified service names involved in the first alarm event, and output the second alarm event. The responsible person association module is used to train and apply the XGBoost model to predict and determine the optimal responsible person for the current event based on the second alarm event, combined with the association relationship extracted from the service knowledge graph, the current organizational structure data, and historical alarm response records, and to generate the third alarm event. The channel notification module is used to dynamically select the optimal notification channel and notification timing strategy based on the historical response channel preferences and response time data of the person in charge identified in the third alarm event, and to trigger the escalation decision process based on the backup relationship or organizational level in the service knowledge graph if no response is received within a preset time.

[0010] Thirdly, the present invention provides a computer device, including: a memory and a processor, and a computer program stored in the memory, wherein when the computer program is executed on the processor, it implements the containerized alarm precision push method based on dynamic association as described in any of the above methods.

[0011] Fourthly, the present invention provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the containerized alarm precision push method based on dynamic association as described in any of the above methods.

[0012] Compared with the prior art, the present invention has at least one of the following technical effects: 1. This invention enables early detection, accurate error correction, intelligent prediction of responsible persons, and dynamic selection of notification strategies for containerized alarms, effectively improving the timeliness and accuracy of alarm processing and ensuring the stable operation of the container environment.

[0013] 2. This invention utilizes a CNN-LSTM hybrid model to predict container resource bottlenecks and change frequencies, generating the first alarm event in advance to achieve early warning of container resource problems and buy time for subsequent processing.

[0014] 3. This invention constructs a service knowledge graph based on multi-system data, clearly presenting services, responsible persons, and calling relationships, providing a comprehensive and accurate data foundation for subsequent precise push of alarms.

[0015] 4. This invention constructs and trains a relational graph attention network model, providing effective graph neural network support for subsequent intelligent error correction and association mapping of ambiguous or changed service names.

[0016] 5. This invention utilizes graph neural networks to embed service knowledge graphs for learning, enabling intelligent error correction and association mapping of ambiguous or changed service names in the first alarm event, ensuring accurate transmission of alarm information.

[0017] 6. This invention trains and applies the XGBoost model based on the second alarm event and related data to accurately predict and determine the optimal person in charge of the current event, thereby improving the pertinence and efficiency of alarm processing.

[0018] 7. This invention supervises the training of the XGBoost model by constructing a sample event pool and labeling training samples, ensuring that the model can accurately predict the optimal person in charge of alarm events.

[0019] 8. This invention deploys a decision tree model to dynamically select the optimal notification channel and timing strategy, improving the delivery rate and timeliness of alarm notifications based on the historical preferences of the person in charge and the real-time situation.

[0020] 9. If no response is received within a preset time, the present invention triggers an upgrade decision process based on the service knowledge graph to ensure that alarms are handled in a timely manner and to prevent the problem from escalating. Attached Figure Description

[0021] To more clearly illustrate the technical solutions in the embodiments of this application, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0022] Figure 1 This is a flowchart illustrating a containerized alarm precision push method based on dynamic association, provided in an embodiment of the present invention. Figure 2 This is a schematic diagram of the structure of a containerized alarm precision push system based on dynamic association provided in an embodiment of the present invention; Figure 3 This is a schematic diagram of the structure of a computer device provided in an embodiment of the present invention. Detailed Implementation

[0023] In the following description, specific details such as particular system architectures and techniques are set forth for illustrative purposes and not for limitation, in order to provide a thorough understanding of the embodiments of this application. However, those skilled in the art will understand that this application may also be implemented in other embodiments without these specific details. In other instances, detailed descriptions of well-known systems, apparatuses, circuits, and methods have been omitted so as not to obscure the description of this application with unnecessary detail.

[0024] It should be understood that, when used in this application specification and the appended claims, the term "comprising" indicates the presence of the described features, integrals, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or a collection thereof.

[0025] It should also be understood that the term “and / or” as used in this application specification and the appended claims means any combination of one or more of the associated listed items and all possible combinations, and includes such combinations.

[0026] As used in this application specification and the appended claims, the term "if" may be interpreted, depending on the context, as "when," "once," "in response to determination," or "in response to detection." Similarly, the phrase "if determined" or "if detected [the described condition or event]" may be interpreted, depending on the context, as meaning "once determined," "in response to determination," "once detected [the described condition or event]," or "in response to detection [the described condition or event]."

[0027] Furthermore, in the description of this application and the appended claims, the terms "first," "second," "third," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0028] References to "one embodiment" or "some embodiments" as described in this specification mean that one or more embodiments of this application include a specific feature, structure, or characteristic described in connection with that embodiment. Therefore, the phrases "in one embodiment," "in some embodiments," "in other embodiments," "in still other embodiments," etc., appearing in different parts of this specification do not necessarily refer to the same embodiment, but rather mean "one or more, but not all, embodiments," unless otherwise specifically emphasized. The terms "comprising," "including," "having," and variations thereof mean "including but not limited to," unless otherwise specifically emphasized.

[0029] In this application embodiment, the entity executing the process includes a terminal device. This terminal device includes, but is not limited to, devices capable of executing the methods disclosed in this application, such as servers, computers, smartphones, and tablets. Figure 1 A flowchart illustrating a containerized alarm precision push method based on dynamic association, as disclosed in an embodiment of the present invention, is shown below in detail: S101, based on multi-dimensional monitoring metrics and historical time-series data of container runtime, uses a CNN-LSTM hybrid model to predict container resource bottlenecks, analyzes container change frequency, and generates early warning events. S102, For the first alarm event, construct a service knowledge graph based on the collected service metadata, service dependencies and historical owner change records; S103, use graph neural network to embed the service knowledge graph, perform intelligent error correction and association mapping on the ambiguous or changed service names involved in the first alarm event, and output the second alarm event; S104. Based on the second alarm event, combined with the relationships extracted from the service knowledge graph, the current organizational structure data, and historical alarm response records, the XGBoost model is trained and applied to predict and determine the optimal person in charge of the current event, and a third alarm event is generated. S105: Based on the historical response channel preferences and response time data of the person in charge identified in the third alarm event, deploy a decision tree model to dynamically select the optimal notification channel and notification timing strategy. If no response is received within a preset time, trigger the upgrade decision process based on the backup relationship or organizational level in the service knowledge graph.

[0030] In this embodiment, a container monitoring system is constructed. This system can collect multi-dimensional monitoring metrics of container runtime in real time, such as CPU utilization, memory usage, and network bandwidth, while also collecting historical time-series data of these metrics. This data forms the basis for predicting container resource bottlenecks. Next, a CNN-LSTM hybrid model is used to analyze the collected multi-dimensional monitoring metrics and historical time-series data. The CNN part effectively extracts local features from the data, while the LSTM part can handle long-term dependencies in the time-series data. This hybrid model predicts container resource usage and determines whether there is a trend towards resource bottlenecks. Simultaneously, the frequency of container changes, such as the frequency of container creation, deletion, and migration, is analyzed. Combining the resource bottleneck prediction results and container change frequency analysis, when a potential resource bottleneck or frequent container changes that may cause problems are predicted, an early warning event is generated.

[0031] For the first alert event, it is necessary to further clarify the service information involved and the relevant responsible persons information. To this end, service metadata is collected, including the service name, function description, and module to which it belongs; service dependencies are collected, that is, clarifying the calling relationships and dependency levels between various services; and historical responsible person change records are compiled to understand the responsible persons for each service at different time periods. Based on this collected information, a service knowledge graph is constructed. In the service knowledge graph, services are used as nodes, dependencies between services are used as edges, and the service metadata and historical responsible person information are stored as node attributes.

[0032] In the first alert event, there might be instances where the service name is ambiguous or has changed due to container modifications. To accurately associate the service with the relevant service, a graph neural network is used to embed the constructed service knowledge graph. Graph neural networks can map the node and edge information in the service knowledge graph into a low-dimensional vector space, thereby better representing the relationships and features between services. Through embedding the service knowledge graph, intelligent error correction and association mapping are performed on the ambiguous or changed service names involved in the first alert event. For example, the service name mentioned in the first alert event might be an old name or a misspelled name. Through the analysis and mapping of the graph neural network, the corresponding correct service name can be found, and the relevant information is integrated before outputting the second alert event, ensuring that the service names involved in the second alert event are accurate.

[0033] Based on the second alarm event, it is necessary to determine the optimal person responsible for the event. Relationships are extracted from the service knowledge graph to clarify the connections between the service involved in the second alarm event and other services; current organizational structure data is obtained to understand the internal team divisions and personnel responsibilities; and historical alarm response records are collected, including information such as the response time and handling effectiveness of different responsible persons for various alarms. This data is used to train an XGBoost model. XGBoost is a highly efficient gradient boosting decision tree algorithm capable of handling multi-feature data and making accurate predictions. The trained XGBoost model is then used to analyze the second alarm event, predict and determine the optimal person responsible for the current event, and generate the third alarm event. For example, if historical alarm response records show that a certain responsible person is highly efficient in handling payment-related alarms, when the second alarm event involves payment services, the XGBoost model will predict that this responsible person is the optimal person responsible and record it in the third alarm event.

[0034] Based on the historical response channel preferences and response timeliness data of the responsible person identified in the third alarm event, a decision tree model is deployed. The decision tree model can make decisions based on different conditions; here, it dynamically selects the optimal notification channel and notification timing strategy based on the responsible person's historical data. For example, if a responsible person prefers to receive emergency alarm messages via instant messaging and responds quickly during morning working hours, the decision tree model will push the alarm message to that responsible person via instant messaging at an appropriate time based on this information. Simultaneously, a preset time is set. If no response is received from the responsible person within the preset time, an escalation decision process is triggered based on backup relationships or organizational hierarchy in the service knowledge graph. For example, if the primary responsible person does not respond within the specified time, the decision process will escalate the alarm message to the responsible person's backup personnel or superior, ensuring that the alarm information is handled promptly and preventing further escalation of the problem.

[0035] This embodiment enables precise push notifications for containerized alarms based on dynamic associations, effectively solving the problems of traditional alarm management methods and improving alarm processing efficiency and system stability in enterprise container environments.

[0036] In some embodiments, step S101 above, which involves using a CNN-LSTM hybrid model to predict container resource bottlenecks based on multi-dimensional monitoring metrics and historical time-series data during container runtime, analyzing container change frequency, and generating an early warning event, specifically includes: Based on multidimensional monitoring metrics and historical time-series data of container runtime, a convolutional neural network is used to extract the local spatial features of the multidimensional monitoring metrics in the time dimension, and input them into the first long short-term memory network to learn their long-term temporal dependencies, and output the predicted value of resource utilization rate at future time points. Historical change event sequences are extracted from multidimensional monitoring indicators and historical time series data. The second long short-term memory network is used to analyze the frequency and time series patterns of container change operations in order to predict the change density within future time windows. The predicted resource utilization rate is compared with the dynamic expansion threshold in real time to trigger the generation of the first type of predictive alarm event regarding resource bottlenecks; The change intensity is compared with a safety threshold set based on historical baselines to trigger the generation of a second type of predictive alert event regarding change storms; By summarizing the first type of predictive alarm events and the second type of predictive alarm events, we can obtain the first alarm events that can be detected in advance.

[0037] In this embodiment, a convolutional neural network (CNN) is used to process the collected multidimensional monitoring metrics. CNNs have powerful local feature extraction capabilities, enabling them to extract local spatial features from the time-dimensional data of multidimensional monitoring metrics. For example, changes in CPU utilization over a period of time may exhibit some local fluctuation patterns, which CNNs can effectively identify.

[0038] The local spatial features extracted by the CNN are input into the first Long Short-Term Memory (LSTM) network. LSTM excels at processing temporal data and can learn long-term temporal dependencies in the data. Through the learning of the input features by the first LSTM, a predicted value of resource utilization at a future time point can be output. For example, based on CPU utilization data from the past few hours, the CPU utilization for the next hour can be predicted.

[0039] From the collected multi-dimensional monitoring metrics and historical time-series data, historical change event sequences were further extracted. These historical change event sequences record information such as the time and type of container creation, deletion, migration, and other change operations over a period of time.

[0040] The extracted historical change event sequences were analyzed using a second Long Short-Term Memory (LSTM) network. The second LSTM can learn the temporal patterns of container change operations, that is, the distribution and trends of change operations across different time periods. For example, it might be found that container change operations are more frequent during a specific time period each day.

[0041] Based on the analysis results of the second LSTM, the change intensity within the future time window is predicted. Change intensity reflects the frequency of container change operations in the future, providing a basis for subsequent judgment on whether a change storm is likely to occur.

[0042] After obtaining the predicted resource utilization for future points in time, a dynamic scaling threshold needs to be set. This threshold can be dynamically adjusted based on factors such as the container's actual business needs, performance metrics, and historical experience. The predicted resource utilization is compared with the dynamic scaling threshold in real time. If the predicted resource utilization approaches or exceeds the dynamic scaling threshold at some future point in time, it indicates a potential resource bottleneck in the container, impacting normal business operations. In this case, the system will trigger a first-type predictive alert event regarding the resource bottleneck. For example, if it is predicted that a container's memory utilization will reach 90% within the next half hour, while the dynamic scaling threshold is 85%, a predictive alert event for a memory resource bottleneck will be generated.

[0043] In addition to considering resource bottlenecks, it's also necessary to pay attention to container changes. A safety threshold should be set based on a historical baseline. The historical baseline is the normal change frequency range obtained by analyzing a large amount of historical change data, while the safety threshold is determined by considering a certain fault tolerance range based on the historical baseline.

[0044] The predicted change intensity within the future time window is compared to a safety threshold. If the change intensity exceeds the safety threshold, it indicates that container changes may be too frequent in the near future, potentially triggering a change storm and causing system instability. In this case, the system will generate a second type of predictive alert event regarding the change storm. For example, if it is predicted that 50 container creation and deletion operations will occur within the next hour, while the safety threshold is 30, a predictive alert event for a change storm will be generated.

[0045] Finally, the first and second types of predictive alerts are aggregated. These aggregated alerts contain early warning information about container resource bottlenecks and change storms, forming the first type of early warning alerts. In this way, enterprises can receive early warnings before problems actually occur, giving them sufficient time to take appropriate measures, such as proactively scaling up resources and adjusting change plans, to ensure the stable operation of the container environment.

[0046] This embodiment can accurately predict container resource bottlenecks and changes based on multi-dimensional monitoring indicators and historical time-series data during container runtime, and generate early warning first alarm events, effectively solving the shortcomings of traditional alarm management methods when facing large-scale and frequently changing container environments.

[0047] In some embodiments, step S102 above, specifically constructing a service knowledge graph based on collected service metadata, service dependencies, and historical owner change records for the first alarm event, includes: By using data adapters deployed in the release system, configuration management system, and organizational structure system, the system collects service metadata, inter-service call dependencies, and the affiliation of responsible persons and teams, and performs identifier unification and schema standardization to output triple data streams. According to a predefined graph pattern, triple data streams are stored in a graph database to construct a service knowledge graph. The nodes of the service knowledge graph include microservices and their responsible persons, and the edges include the calling relationships between services and the attribution relationships between services and their responsible persons. When the person in charge of a service changes or the service name is modified, a historical expiration timestamp attribute is added to the original relationship in the service knowledge graph, and a new edge representing the new relationship with an effective timestamp attribute is created simultaneously.

[0048] In this embodiment, to comprehensively acquire the data required to construct the service knowledge graph, data adapters need to be deployed in the enterprise's publishing system, configuration management system, and organizational structure system. The publishing system manages service publishing and deployment information, the configuration management system records various configuration parameters of the services, and the organizational structure system defines the personnel and team structure within the enterprise. Through these data adapters, service metadata, such as service name, version, and function description, can be collected in real time; service call dependencies can also be obtained, such as the frequency and timing of service A calling service B; and the affiliation of responsible persons and teams can also be collected, such as the person in charge, Zhang San, belonging to development team A.

[0049] Because data collected from different systems may have inconsistent identifiers and data patterns—for example, service names in a publishing system might use abbreviations, while configuration management systems might use full names, and organizational structure systems might have different team naming conventions—it is necessary to unify the identifiers and standardize the patterns of the collected data. This process is like translating text from different languages ​​into a single language, ensuring that all data follows the same rules and format. After processing, a triplet data stream is output. A triple consists of a subject, a predicate, and an object, such as (Service A, call, Service B) or (Responsible Person Zhang San, Belongs to, Development Team A). These triplet data streams provide the foundational data for subsequently building a service knowledge graph.

[0050] After obtaining the triple data stream, it needs to be stored in a graph database according to a predefined graph schema to construct a service knowledge graph. The predefined graph schema specifies the structure and element types of the service knowledge graph. In this graph, nodes include microservices and responsible persons. Microservices are the specific implementation units of enterprise business, and responsible persons are the personnel who handle service-related issues. Edges include the calling relationships between services and the attribution relationships between services and responsible persons. The calling relationships reflect the interaction between services, and the attribution relationships clarify the corresponding connections between services and responsible persons.

[0051] By storing the triplet data stream in a graph database according to a graph schema, a service knowledge graph is formed. Graph databases have powerful graph structure storage and query capabilities, and can efficiently handle the relationships between nodes and edges. For example, when it is necessary to query all callers of a service and their corresponding responsible persons, the graph database can quickly return the results, providing strong data support for subsequent alarm processing.

[0052] A company's business is constantly evolving and changing; the person in charge of services may change, and service names may be modified. To ensure that the service knowledge graph reflects the company's actual situation in real time, it needs to be dynamically updated when these changes occur.

[0053] When the person in charge of a service changes, for example, Li Si, who was originally in charge of service A, is transferred to another position and Wang Wu takes over. In the service knowledge graph, a historical expiration timestamp attribute will be added to the original relationship (service A, home, person in charge Li Si) to record when the relationship became invalid; at the same time, a new edge representing the new relationship (service A, home, person in charge Wang Wu) with an effective timestamp attribute will be created to record when the new relationship becomes effective.

[0054] If a service name is modified, for example, service B is changed from "Order Processing Service" to "Order Core Processing Service," a historical expiration timestamp attribute will be added to the existing relationships in the service knowledge graph, and a new edge with an effective timestamp attribute will be created to represent the relationship between the new service name and related elements. In this way, the service knowledge graph can not only reflect the current service and responsible person relationships in real time, but also retain historical change records, providing a basis for subsequent problem tracing and analysis.

[0055] In some embodiments, step S103 above, which involves using a graph neural network to perform embedding learning on the service knowledge graph, intelligently correcting and associating the ambiguous or modified service names involved in the first alarm event, and outputting the second alarm event, further includes the following steps: Extract all node and edge data from the service knowledge graph. Based on the type and attributes of the nodes, generate initial feature vectors for different types of nodes using a word vector model, and construct a node feature matrix. A relational graph attention network model is constructed. This model is used to perform relation-specific transformations on the features of neighbor nodes during message passing by introducing a learnable parameter matrix associated with the graph edge type, and to calculate relation-aware attention weights to aggregate neighbor information. Based on the node feature matrix and relational graph attention network model, a multi-task self-supervised training framework is designed, which includes link prediction task and node attribute prediction task, and the loss function is combined to form the overall goal of model training. Based on the overall objective, the relational graph attention network model is iteratively trained using an optimization algorithm until the model converges, thus obtaining the trained graph neural network.

[0056] In this embodiment, after constructing the service knowledge graph, in order to enable the graph neural network to better process the information in the graph, all node data and edge data must first be extracted from the service knowledge graph. This node data contains rich information, such as the type of the node (whether it is a microservice node or a responsible node, etc.) and the attributes of the node (for microservice nodes, attributes may include the function and version of the service; for responsible nodes, attributes may include the name of the responsible person, the team they belong to, etc.).

[0057] Based on the type and attributes of nodes, a word vector model is used to generate initial feature vectors for different types of nodes. The word vector model can convert node-related text information into numerical vectors, enabling computers to process them. For example, for microservice nodes, text information such as service name and function description is input into the word vector model to generate corresponding initial feature vectors; for manager nodes, information such as manager's name and team is input into the word vector model to generate corresponding initial feature vectors.

[0058] The initial feature vectors of all nodes are arranged in a specific order to construct a node feature matrix. This matrix forms the basis for subsequent graph neural network processing; it integrates key information from all nodes in the service knowledge graph, providing data support for subsequent model training and inference.

[0059] To more effectively handle the complex edge relationships in service knowledge graphs, a relational graph attention network model is constructed. In a service knowledge graph, edges represent different relationships, such as service call relationships and service-to-person attribution relationships. This model introduces a learnable parameter matrix associated with the edge type to perform relationship-specific transformations on neighbor node features during message passing. This means that for different edge types, the model uses different parameter matrices to process the features of neighbor nodes, better capturing the impact of different relationships on node features. Simultaneously, the model calculates relationship-aware attention weights. These attention weights reflect the importance of neighbor nodes in the current node's feature aggregation process. By calculating the attention weights of different neighbor nodes under different relationships, the model can more accurately aggregate neighbor information, highlighting neighbor nodes that have a greater impact on the current node, thereby improving the model's understanding and processing capabilities of the graph structure.

[0060] To enable relational graph attention network models to better learn information from service knowledge graphs, a multi-task self-supervised training framework that includes link prediction and node attribute prediction tasks is designed.

[0061] The link prediction task aims to teach the model to predict whether edges exist between nodes in a service knowledge graph and what types of edges exist. For example, it can predict whether a call relationship exists between two microservice nodes, or whether an attribution relationship exists between a microservice node and a manager node. Through this task, the model can better understand the association patterns between nodes.

[0062] The node attribute prediction task involves enabling the model to predict node attributes based on node features and graph structure. For example, based on the features of a microservice node's neighboring nodes and edge relationships, it can predict attributes such as the microservice node's function or version. This task helps the model to deeply explore the intrinsic features of nodes and the impact of graph structure on node attributes.

[0063] The loss functions of these two tasks are combined to form the overall objective of model training. The loss function is a metric that measures the difference between the model's predictions and the actual results. By optimizing the overall objective, the model can improve its performance on both link prediction and node attribute prediction tasks, thereby better learning information from the service knowledge graph.

[0064] Based on the designed overall goal, an optimization algorithm is used to iteratively train the relational graph attention network model. The role of the optimization algorithm is to adjust the model's parameters to minimize the difference between the model's predictions and the actual results.

[0065] In each iteration, the model processes the input node feature matrix based on the current parameters, calculates the prediction result, and calculates the error between the prediction result and the actual result according to the loss function. Then, the optimization algorithm adjusts the model parameters based on the error, so that the model's prediction is more accurate in the next iteration.

[0066] This process is repeated until the model converges. Model convergence means that the model parameters no longer change significantly, and the prediction results tend to stabilize. At this point, a trained graph neural network is obtained. This network has learned the complex relationships and node features in the service knowledge graph and is able to intelligently correct and associate the ambiguous or modified service names involved in the first alarm event.

[0067] For example, when a vague service name appears in the first alarm event, the trained graph neural network can determine the specific service node that the vague name may correspond to based on the features of the nodes and the relationship of the edges in the service knowledge graph, and perform accurate association mapping, thereby outputting the second alarm event and providing more accurate information for subsequent alarm processing.

[0068] Furthermore, the method of using graph neural networks to embed the service knowledge graph, intelligently correcting and associating the ambiguous or modified service names involved in the first alarm event, and outputting the second alarm event specifically includes: Based on graph neural networks, an embedding vector that integrates its own semantics and the structural information of its neighbors is generated for each service node in the service knowledge graph, and a node vector index is established. Based on the first alarm event, the fuzzy service identifier or changed service identifier in the first alarm event is converted into a query vector of the same dimension through a text encoding model compatible with the encoding of graph neural networks. In the node vector index, perform an approximate nearest neighbor search based on the query vector to retrieve at least one candidate service node with the highest similarity to the query vector. By combining the context metadata in the first alarm event, the retrieved candidate service nodes are verified and reordered to determine the target associated service node; Replace the fuzzy or modified service identifier in the first alarm event with the standardized information of the target associated service node, and add an association confidence level to generate a second alarm event.

[0069] In this embodiment, after training the graph neural network, it is applied to the service knowledge graph. First, the trained graph neural network is used to process each service node in the service knowledge graph. The graph neural network can comprehensively consider the semantic information of the service node itself, such as the functional meaning implied by the service name and the features expressed by the textual information such as the service description. It also analyzes the structural information of neighboring nodes, including the types of neighboring nodes and their connection relationships. Through this comprehensive processing, an embedding vector is generated for each service node, integrating its own semantics and the structural information of its neighbors. This embedding vector is a multi-dimensional numerical vector that can accurately represent the features and location information of the service node in the knowledge graph in numerical form.

[0070] After generating the embedding vectors for all service nodes, a node vector index is built. The node vector index acts like an efficient lookup table, associating and storing the embedding vector of each service node with its corresponding service node information. This allows for quick retrieval of the corresponding service node based on the embedding vector during subsequent queries, improving query efficiency. For example, the node vector index can be constructed as a tree structure or a hash table structure, enabling rapid location of the service node corresponding to the target vector when faced with a large number of node vectors.

[0071] Upon receiving the first alarm event, it is necessary to process any ambiguous or modified service identifiers involved. To enable effective searching within the node vector index, a text encoding model compatible with graph neural network encoding is employed. This text encoding model converts the text-based service identifier into a query vector with the same dimension as the node embedding vector. For example, if the first alarm event contains a misspelled or incorrectly worded ambiguous service identifier, the text encoding model analyzes the characters and words in the identifier, converting it into a multi-dimensional numerical vector. The dimension of this query vector is consistent with the dimension of the previously generated node embedding vector, ensuring comparability in subsequent similarity comparisons. Similarly, for modified service identifiers, the text encoding model converts them into query vectors in the same way for retrieval within the node vector index.

[0072] After obtaining the query vector, an approximate nearest neighbor search is performed on the node vector index, using the query vector as the reference. Approximate nearest neighbor search is an efficient search algorithm that can quickly find at least one candidate service node with the highest similarity to the query vector from a large number of node vectors. Similarity can be calculated in various ways, such as cosine similarity or Euclidean distance. By calculating the similarity between the query vector and each vector in the node vector index, and sorting them from highest to lowest similarity, the service nodes corresponding to the vectors with the highest similarity are selected as candidate service nodes. For example, in a large cloud service knowledge graph, there may be tens of thousands of service nodes. The approximate nearest neighbor search algorithm can find the few candidate service nodes most similar to the query vector from these nodes in a short time, providing a basis for subsequent verification and reordering.

[0073] Because candidate service nodes obtained through near nearest neighbor search may contain some errors, it is necessary to verify and reorder the retrieved candidate service nodes by incorporating contextual metadata from the first alarm event. Contextual metadata includes information such as the time of the first alarm event, related service call relationships, and system status. For example, if the first alarm event occurred during a specific peak business period, service nodes related to the business during that period are more likely to be the target associated service node. By analyzing the matching degree between candidate service nodes and contextual metadata, the candidate service nodes are reordered. The candidate service nodes with the highest matching degree to contextual metadata are ranked first, while some candidate service nodes that clearly do not conform to the contextual information are excluded. This improves the accuracy of identifying the target associated service node.

[0074] After identifying the target associated service node, replace the ambiguous or modified service identifier in the first alarm event with the standardized information of the target associated service node. The standardized information includes accurate information such as the standard name and unique identifier of the service node, which makes the service identifier in the alarm event more accurate and clear.

[0075] Simultaneously, to reflect the accuracy and reliability of the replacement, a correlation confidence score is added. The correlation confidence score is a numerical value representing the degree of correlation between the target associated service node and the original service identifier in the first alarm event. A higher correlation confidence score indicates higher accuracy of the replacement. By adding a correlation confidence score, personnel handling subsequent alarm events can understand the reliability of the replacement and make more informed decisions. Finally, a second alarm event containing the accurate service identifier and correlation confidence score is generated, providing more accurate information for subsequent alarm handling and identification of responsible parties.

[0076] In some embodiments, in step S104 above, the step of training and applying an XGBoost model to predict and determine the optimal person in charge of the current event based on the second alarm event, combined with the relationships extracted from the service knowledge graph, the current organizational structure data, and historical alarm response records, and generating a third alarm event specifically includes: Based on the service node associated with the second alarm event, extract the current list of legitimate responsible persons from the service knowledge graph; For the second alarm event and each person in the candidate list of responsible persons, a multi-dimensional feature vector is calculated in real time. The multi-dimensional feature vector includes alarm event attributes, service graph attributes, real-time status attributes of responsible persons, and historical response performance attributes. The multi-dimensional feature vector of each person in charge is input into the pre-trained XGBoost model to obtain a matching probability score that represents each person in charge as the best person to handle the current alarm event. The person in charge with the highest matching probability score is identified as the predicted optimal person in charge. The identifier, confidence level, and ranking information of the predicted optimal person in charge are added to the second alarm event, and the third alarm event is output.

[0077] In this embodiment, upon receiving the second alarm event, since the associated service node is clearly identified, information is extracted from a pre-built service knowledge graph, using this service node as the entry point. The service knowledge graph stores the complex relationships between service nodes and their responsible parties. Through specific query algorithms and rules, it can accurately identify all responsible parties directly or indirectly associated with the service node, thereby generating a current list of legitimate responsible party candidates. For example, in a complex cloud service system, a service node may correspond to multiple responsible parties from different teams. These responsible parties may be responsible for different modules of the service or participate in service management at different stages. By querying the service knowledge graph, all these related responsible parties can be included in the candidate list, ensuring that no potentially optimal responsible party is overlooked.

[0078] For the second alarm event and each responsible person in the candidate list, a real-time combination calculation of multi-dimensional feature vectors is required. This multi-dimensional feature vector covers multiple aspects of information to comprehensively evaluate the degree of matching between each responsible person and the current alarm event.

[0079] The alarm event attributes include the alarm type, severity, and occurrence time. Different types of alarms may require personnel with different professional skills and experience to handle them. High-severity alarms require personnel who can respond quickly, while the occurrence time may affect the real-time status of the personnel in charge.

[0080] Service graph attributes involve the location of service nodes within the knowledge graph and their dependencies on other services. This information helps understand the importance and complexity of the service within the overall system, thereby determining whether the person in charge has the ability to handle related issues.

[0081] The real-time status attributes of the person in charge reflect their current work status, such as whether they are online or handling other urgent tasks. If the person in charge is currently busy, they may not be able to handle current alarm events in a timely manner, so this factor needs to be considered.

[0082] Historical response performance attributes record the manager's performance in handling similar alarm events in the past, including response time and processing effectiveness. By analyzing this historical data, it is possible to predict the manager's ability and efficiency in handling the current event.

[0083] By combining information from multiple dimensions, a unique multi-dimensional feature vector is generated for each person in charge. This vector can comprehensively and accurately describe the relevant characteristics of the person in charge and the current alarm event.

[0084] The multi-dimensional feature vectors calculated for each responsible person are input into a pre-trained XGBoost model. XGBoost is a powerful machine learning model known for its efficiency and accuracy in learning and prediction. During the pre-training phase, the model is trained using a large amount of historical alarm event data, responsible person information, and actual processing results, enabling it to learn the complex relationships between different features and the optimal responsible person.

[0085] When a new multi-dimensional feature vector is input, the XGBoost model evaluates the probability that each person in charge is the optimal person to handle the current alarm event based on the rules and patterns it has learned internally, and outputs a matching probability score. This score is a value between 0 and 1, with a higher value indicating a greater probability that the person in charge is the optimal person to handle the current alarm event.

[0086] After obtaining the matching probability score for each responsible person, these scores are compared and analyzed. The responsible person with the highest matching probability score is identified as the predicted optimal responsible person, who is most likely to have the capability and resources needed to handle the current alarm event.

[0087] To make subsequent alarm handling clearer and more traceable, the identification information of the predicted optimal responsible person, such as the person's name and employee ID, is added to the second alarm event. Simultaneously, to reflect the accuracy and reliability of the prediction, confidence information is added. The confidence score is calculated based on the matching probability score; the higher the score, the higher the confidence. Furthermore, to facilitate the selection and evaluation among multiple responsible persons, ranking information is added, sorting all responsible persons according to their matching probability scores from highest to lowest.

[0088] After the above processing, the second alarm event, with the addition of the optimal responsible person identifier, confidence level, and ranking information, is output as the third alarm event. This third alarm event provides a clear target responsible person for subsequent alarm handling, improving the efficiency and accuracy of problem resolution.

[0089] Furthermore, the pre-training steps of the XGBoost model specifically include: Retrieve a set of alarm events that have been processed within a preset time window from the historical event repository, and determine the actual responsible person for processing each alarm event in the alarm event set in order to build an original sample event pool; For each alarm event in the original sample event pool, based on the service knowledge graph and organizational structure snapshot at the time of the event, determine the set of all legitimate responsible persons for that alarm event at that time. Based on the set of legitimate responsible persons candidates and the actual effective responsible persons, the feature combination of the actual responsible person and the corresponding alarm event is labeled as a positive sample, and the feature combination of other candidates and the corresponding alarm event is labeled as a negative sample, thus constructing a training sample set; The XGBoost model is trained under supervision using the training sample set, and the optimal model parameters are selected through hyperparameter optimization and cross-validation.

[0090] In this embodiment, a large amount of historical alarm event data accumulates during the company's operations, and this data is stored in a historical event repository. To pre-train the XGBoost model, a set of alarm events that have been processed within a preset time window is first selected from the historical event repository. This preset time window can be reasonably set according to the company's business characteristics and data volume; for example, it could be the past year or the past six months.

[0091] For each selected alarm event, the person truly responsible for its effective handling needs to be identified. This person is defined as the individual who played a crucial role in resolving the alarm event and successfully addressed the issue. The person truly responsible for handling each alarm event can be accurately identified by reviewing relevant company records and log files, or by communicating with relevant personnel.

[0092] By combining all alarm events and their corresponding responsible parties for effective handling, a raw sample event pool is constructed. This raw sample event pool serves as the foundational data source for subsequent model training. It contains rich historical alarm handling information, providing valuable samples for model learning.

[0093] Because an enterprise's organizational structure and service knowledge graph change over time, the service knowledge graph and organizational structure are different at the time each alarm event occurs. Therefore, for each alarm event in the original sample event pool, it is necessary to determine the set of all legitimate responsible persons for that alarm event at that time based on the service knowledge graph and organizational structure snapshot at the time the event occurred.

[0094] The service knowledge graph snapshot records the relationships and service attributes between service nodes at the time the alarm event occurred, while the organizational structure snapshot records the company's personnel structure and team divisions at that time. By combining these two snapshots, the service nodes associated with the alarm event can be identified from the service knowledge graph, and then all possible responsible persons corresponding to these service nodes can be determined based on the organizational structure, thus forming a set of legitimate responsible persons candidates. For example, in a complex cloud service system, when an alarm event occurs, the service module involved can be identified through the service knowledge graph snapshot, and the teams and personnel responsible for these service modules can be found by combining the organizational structure snapshot. These personnel constitute the set of legitimate responsible persons candidates for the alarm event.

[0095] After determining the legitimate candidate set of responsible persons and the actual effective responsible persons for handling each alarm event, the training sample set is constructed. For each alarm event, its relevant feature information is extracted. This feature information includes alarm event attributes (such as alarm type, severity, occurrence time, etc.), service graph attributes (such as the location of service nodes in the knowledge graph, dependencies with other services, etc.), responsible person real-time status attributes (the responsible person's status at that time that can be obtained in historical events, such as whether they are online, workload, etc.), and historical response performance attributes (if the responsible person has handled similar alarm events in the past, their response time, handling effect, etc.).

[0096] The feature combinations of actual effective handlers and corresponding alarm events are labeled as positive samples. This indicates that there is a valid handling relationship between the handler and the alarm event, which is the correct matching pattern that the model needs to learn. The feature combinations of candidates and corresponding alarm events in other legitimate handler candidate sets are labeled as negative samples. This indicates that there is no valid handling relationship between these candidates and the alarm event, which is the pattern that the model needs to distinguish.

[0097] In this way, all alarm event samples are labeled as either positive or negative, thus constructing a complete training sample set. This training sample set contains rich information on positive and negative samples, providing ample data support for the supervised training of the XGBoost model.

[0098] The XGBoost model is trained under supervision using a pre-constructed training sample set. During training, the XGBoost model continuously adjusts its parameters based on the input sample features and annotation information to learn patterns and rules in the samples, thereby improving its ability to predict the matching relationship between responsible persons and alarm events.

[0099] To ensure optimal model performance and generalization ability, hyperparameter optimization and cross-validation are employed to select the best model parameters. Hyperparameter optimization involves adjusting and optimizing key parameters of the XGBoost model (such as learning rate, maximum tree depth, and subsample ratio) to find the optimal parameter combination. Cross-validation divides the training sample set into multiple subsets and evaluates the model's performance under different parameter combinations through multiple training and validation iterations, thereby selecting the optimal parameters.

[0100] Through hyperparameter optimization and cross-validation, a high-performance XGBoost model can be obtained. This model can accurately predict the optimal person responsible for handling each alarm event, providing strong support for subsequent accurate delivery of containerized alarms.

[0101] In some embodiments, step S105 above, which involves deploying a decision tree model to dynamically select the optimal notification channel and notification timing strategy based on the historical response channel preferences and response timeliness data of the person in charge determined in the third alarm event, specifically includes: Based on historical notification records, a multi-dimensional training dataset was constructed, which includes notification channels, recipient response behavior, time context, and alarm features, and was labeled with classification tags based on response latency. A decision tree model is used to train a multi-dimensional dataset to learn the predicted probability of triggering a recipient's response within an effective time window through a specific notification channel under different feature combinations. When a third alarm event is received, the current real-time context and the historical behavioral characteristics of the best person in charge are combined to generate a channel feature vector for each available notification channel and input it into the decision tree model to obtain the predicted response probability of each notification channel. Choose the notification channel with the highest predicted response probability as the optimal channel for the initial notification.

[0102] In this embodiment, a large number of historical notification records are accumulated during the daily alarm notification operation of an enterprise. These records contain a wealth of information, such as the notification channel used for each alarm notification (e.g., email, SMS, instant messaging tools, etc.), the person in charge who received the alarm and their response behavior (whether they responded within the specified time, response delay time, etc.), the time context of the notification (e.g., weekday, rest day, daytime, nighttime, etc.), and the characteristics of the alarm itself (e.g., alarm type, severity, etc.).

[0103] Based on these historical notification records, a multi-dimensional training dataset is constructed, encompassing notification channels, recipient response behavior, temporal context, and alarm features. Specifically, for each historical notification record, information from each of the aforementioned dimensions is extracted in detail and integrated into a single data sample. Simultaneously, each sample is labeled with a classification tag based on the recipient's response latency. For example, response latency can be categorized into "timely response" (responding within a preset short timeframe), "delayed response" (responding beyond a preset timeframe but still within an acceptable range), and "no response" (no response for a longer period), serving as classification tags to provide clear guidance for subsequent model training.

[0104] After constructing a multi-dimensional training dataset, the decision tree model is trained using this dataset. A decision tree model is a machine learning model capable of classification and prediction based on input features. It constructs a tree-structured set of decision rules by learning the relationship between features and classification labels in the data.

[0105] During training, the decision tree model analyzes various features in the multi-dimensional training dataset, including notification channels, recipient response behavior, temporal context, and alarm characteristics. It learns the predicted probability of triggering a recipient's response within a valid time window through a specific notification channel under different feature combinations. For example, the model might discover that when the alarm type is a critical fault, the time is during weekday daytime, and the recipient historically prefers instant messaging tools, notifying the recipient via instant messaging tools yields a higher probability of a timely response. Through continuous learning and adjustment, the decision tree model gradually develops a set of decision rules capable of accurately predicting the response probability of notification channels under different feature combinations.

[0106] When an enterprise receives a third alert event, it needs to generate a channel feature vector for each available notification channel and input it into a decision tree model to obtain the predicted response probability for each channel. First, combining current real-time context information, such as the current time (weekday or weekend, day or night), the characteristics of the third alert event (alert type, severity, etc.), and the historical behavioral characteristics of the optimal responsible person (their past channel preferences for different types of alerts, response time patterns, etc.), a channel feature vector is generated for each available notification channel (e.g., email, SMS, instant messaging tools). This channel feature vector contains various information related to the current alert and the responsible person, comprehensively reflecting the various factors influencing the use of this notification channel under the current circumstances. Then, the generated channel feature vectors for each notification channel are input into the pre-trained decision tree model. The decision tree model analyzes and judges each channel feature vector based on its internally learned decision rules, outputting the predicted response probability for each notification channel. This predicted response probability represents the likelihood that the responsible person will respond within the effective time window when using this notification channel to notify them, given the current combination of features.

[0107] After obtaining the predicted response probabilities for each notification channel, the channel with the highest predicted response probability is selected as the optimal channel for the initial notification. A higher predicted response probability means a greater likelihood that the responsible person will respond promptly under that notification channel, thus ensuring that alarm messages are delivered to the responsible person in a timely and effective manner, improving the timeliness of problem resolution. For example, if the decision tree model predicts a 90% response probability for instant messaging, 70% for email, and 60% for SMS, then instant messaging is selected as the optimal channel for the initial notification. Through this channel, relevant information about the third alarm event is promptly sent to the optimal responsible person so that they can quickly handle the alarm issue and ensure the stable operation of the enterprise system.

[0108] In some embodiments, step S105 above, which involves triggering an upgrade decision process based on backup relationships or organizational levels in the service knowledge graph when no response is received within a preset time, specifically includes: A joint decision is made based on the alarm severity level and the predicted response probability of the optimal channel to set an escalation waiting time threshold for the first notification; The alarm notification is sent through the optimal channel and timed monitoring is started. If no response is received within the upgrade waiting time threshold, the upgrade decision process is triggered. In the upgrade decision-making process, the channel feature vector is updated to reflect the state of no response to the initial notification, and the decision tree model is reused to predict the next optimal notification action from the remaining strategy options, which includes switching to another channel and notifying the backup person in charge.

[0109] In this embodiment, in the daily containerized alarm management scenario of an enterprise, different types of alarms have different severity levels, such as critical faults, general faults, and warning messages, and their urgency and impact on the system vary. Meanwhile, for the initially selected notification channel, its predicted response probability has been obtained through a decision tree model. This probability reflects the likelihood that the person in charge will respond promptly under that channel.

[0110] To more reasonably determine the waiting time for the responsible person to respond after the initial notification, a joint decision is made based on the alarm severity level and the predicted response probability of the optimal channel. Specifically, for alarms with high severity levels, which may have a significant impact on the system and require prompt handling, the escalation waiting time threshold is set relatively short; while for alarms with low severity levels, the escalation waiting time threshold can be appropriately extended. Simultaneously, considering the predicted response probability of the optimal channel, if the predicted response probability is low, it indicates a lower likelihood of timely response from the responsible person through that channel, thus the escalation waiting time threshold is also shortened accordingly; conversely, if the predicted response probability is high, the escalation waiting time threshold can be appropriately extended. This joint decision-making approach sets reasonable escalation waiting time thresholds for different types of alarms and notification channels with different predicted response probabilities, ensuring that the escalation decision process is triggered at the appropriate time and improving the timeliness of alarm handling.

[0111] After determining the upgrade waiting time threshold, an alarm notification is sent to the optimal responsible person through the initially selected optimal channel, and the timed monitoring function is activated simultaneously. The timed monitoring system accurately records the time from the sending of the alarm notification and compares it in real time with the preset upgrade waiting time threshold.

[0112] During timed monitoring, if the person in charge responds to the alarm notification within the upgrade waiting time threshold (e.g., acknowledging receipt of the alarm or initiating alarm processing), the timed monitoring system will stop timing and will not trigger the upgrade decision process again. The alarm handling process will then proceed as normal. However, if no response is received from the person in charge within the upgrade waiting time threshold, it means that notifying the person in charge through the current optimal channel failed to attract their attention in a timely manner, or that the person in charge is unable to handle the alarm in a timely manner for some reason. In this case, the timed monitoring system will determine it as a non-response situation and immediately trigger the upgrade decision process to ensure that the alarm is handled as soon as possible and to avoid greater impact on the system.

[0113] Once the escalation decision process is triggered, the notification strategy needs to be reconsidered to find a more effective notification method. First, the channel feature vector is updated to include the status information of the initial notification's lack of response. This status information is an important feature, reflecting the poor effectiveness of the initial notification and needing to be considered in subsequent decisions.

[0114] After updating the channel feature vectors, the pre-trained decision tree model is reused. The decision tree model analyzes and predicts based on the updated channel feature vectors and the remaining notification strategy options. These remaining notification strategy options include switching to other available notification channels; for example, if the initial notification was via email, switching to SMS or instant messaging could be considered. It also includes notifying the backup manager; the service knowledge graph records the backup manager information for each service, and if the initial manager does not respond, notifying the backup manager to handle the alert can be considered.

[0115] The decision tree model comprehensively considers various factors, such as the characteristics of remaining notification channels, the historical response history of the backup manager, and the characteristics of the current alarm, to predict the next optimal notification action from the remaining policy options. This optimal notification action aims to maximize the likelihood of the alarm being handled promptly, ensuring that the system can resume normal operation as quickly as possible. For example, if the decision tree model predicts that notifying the backup manager via instant messaging tools will yield a high probability of response, then this action will be selected as the next optimal notification action, and the alarm information will be sent to the backup manager through the appropriate channel.

[0116] Reference Figure 2 An embodiment of the present invention provides a containerized alarm precision push system 2 based on dynamic association, the system 2 specifically including: The container prediction module 201 is used to predict container resource bottlenecks based on multi-dimensional monitoring indicators and historical time-series data during container runtime, using a CNN-LSTM hybrid model, analyzing container change frequency, and generating early warning events. Knowledge graph module 202 is used to construct a service knowledge graph based on the collected service metadata, service dependencies and historical owner change records for the first alarm event. Service correction module 203 is used to perform embedding learning on the service knowledge graph using graph neural network, perform intelligent error correction and association mapping on the ambiguous or changed service names involved in the first alarm event, and output the second alarm event. The responsible person association module 204 is used to train and apply the XGBoost model to predict and determine the optimal responsible person for the current event based on the second alarm event, combined with the association relationship extracted from the service knowledge graph, the current organizational structure data and historical alarm response records, and generate the third alarm event. The channel notification module 205 is used to dynamically select the optimal notification channel and notification timing strategy based on the historical response channel preferences and response time data of the person in charge identified in the third alarm event, and to trigger the upgrade decision process based on the backup relationship or organizational level in the service knowledge graph if no response is received within a preset time.

[0117] It is understandable that, such as Figure 1 The content of the containerized alarm precision push method embodiment based on dynamic association shown is applicable to the containerized alarm precision push system embodiment based on dynamic association. The specific functions implemented by the containerized alarm precision push system embodiment based on dynamic association are the same as those shown in the example. Figure 1 The illustrated embodiment of the containerized alarm precision push method based on dynamic association is the same, and the beneficial effects achieved are the same as those shown. Figure 1 The beneficial effects achieved by the containerized alarm push method based on dynamic association shown in the embodiment are the same.

[0118] It should be noted that the information interaction and execution process between the above systems are based on the same concept as the method embodiments of the present invention. For details on their specific functions and technical effects, please refer to the method embodiments section, which will not be repeated here.

[0119] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional units and modules is merely an example. In practical applications, the above functions can be assigned to different functional units and modules as needed, that is, the internal structure of the system can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiments can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit. Furthermore, the specific names of the functional units and modules are only for easy differentiation and are not intended to limit the scope of protection of this application. The specific working process of the units and modules in the above system can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0120] Reference Figure 3 The present invention also provides a computer device 3, including: a memory 302 and a processor 301, and a computer program 303 stored on the memory 302. When the computer program 303 is executed on the processor 301, it implements the containerized alarm precise push method based on dynamic association as described in any of the above methods.

[0121] The computer device 3 may be a desktop computer, laptop, handheld computer, or cloud server, etc. The computer device 3 may include, but is not limited to, a processor 301 and a memory 302. Those skilled in the art will understand that... Figure 3 The computer device 3 is merely an example and does not constitute a limitation on the computer device 3. It may include more or fewer components than shown in the figure, or combine certain components, or different components, such as input / output devices, network access devices, etc.

[0122] The processor 301 can be a Central Processing Unit (CPU), but it can also be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor.

[0123] In some embodiments, the memory 302 may be an internal storage unit of the computer device 3, such as a hard disk or memory of the computer device 3. In other embodiments, the memory 302 may be an external storage device of the computer device 3, such as a plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, etc., equipped on the computer device 3. Furthermore, the memory 302 may include both internal and external storage units of the computer device 3. The memory 302 is used to store the operating system, applications, boot loader, data, and other programs, such as the program code of the computer program. The memory 302 can also be used to temporarily store data that has been output or will be output.

[0124] This invention also provides a computer-readable storage medium storing a computer program thereon. When the computer program is run by a processor, it implements the containerized alarm precision push method based on dynamic association as described in any of the above methods.

[0125] In this embodiment, if the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include at least: any entity or device capable of carrying computer program code to a photographing device / terminal device, a recording medium, a computer memory, a read-only memory (ROM), a random access memory (RAM), an electrical carrier signal, a telecommunication signal, and a software distribution medium. Examples include USB flash drives, portable hard drives, magnetic disks, or optical disks. In some jurisdictions, according to legislation and patent practice, computer-readable media cannot be electrical carrier signals or telecommunication signals.

[0126] In the above embodiments, the descriptions of each embodiment have different focuses. For parts that are not described in detail or recorded in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0127] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0128] In the embodiments disclosed in this application, it should be understood that the disclosed devices / terminal equipment and methods can be implemented in other ways. For example, the device / terminal equipment embodiments described above are merely illustrative. For instance, the division of modules or units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling or direct coupling or communication connection may be through some interfaces; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0129] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

Claims

1. A containerized alarm precision push method based on dynamic association, characterized in that, The method specifically includes: Based on multi-dimensional monitoring metrics and historical time-series data of container runtime, a CNN-LSTM hybrid model is used to predict container resource bottlenecks, analyze container change frequency, and generate early warning events. For the first alarm event, a service knowledge graph is constructed based on the collected service metadata, service dependencies, and historical records of changes in responsible persons. By using graph neural networks to embed the service knowledge graph, intelligent error correction and association mapping are performed on the ambiguous or modified service names involved in the first alarm event, and the second alarm event is output. Based on the second alarm event, combined with the relationships extracted from the service knowledge graph, the current organizational structure data, and historical alarm response records, the XGBoost model is trained and applied to predict and determine the optimal person in charge of the current event, and a third alarm event is generated. Based on the historical response channel preferences and response time data of the person in charge identified in the third alarm event, a decision tree model is deployed to dynamically select the optimal notification channel and notification timing strategy. If no response is received within a preset time, an upgrade decision process is triggered based on the backup relationship or organizational level in the service knowledge graph.

2. The method according to claim 1, characterized in that, The multi-dimensional monitoring metrics and historical time-series data based on container runtime are used to predict container resource bottlenecks using a CNN-LSTM hybrid model, analyze container change frequency, and generate early warning events. Specifically, this includes: Based on multidimensional monitoring metrics and historical time-series data of container runtime, a convolutional neural network is used to extract the local spatial features of the multidimensional monitoring metrics in the time dimension, and input them into the first long short-term memory network to learn their long-term temporal dependencies, and output the predicted value of resource utilization rate at future time points. Historical change event sequences are extracted from multidimensional monitoring indicators and historical time series data. The second long short-term memory network is used to analyze the frequency and time series patterns of container change operations in order to predict the change density within future time windows. The predicted resource utilization rate is compared with the dynamic expansion threshold in real time to trigger the generation of the first type of predictive alarm event regarding resource bottlenecks; The change intensity is compared with a safety threshold set based on historical baselines to trigger the generation of a second type of predictive alert event regarding change storms; By summarizing the first type of predictive alarm events and the second type of predictive alarm events, we can obtain the first alarm events that can be detected in advance.

3. The method according to claim 1, characterized in that, For the first alarm event, a service knowledge graph is constructed based on the collected service metadata, service dependencies, and historical owner change records, specifically including: By using data adapters deployed in the release system, configuration management system, and organizational structure system, the system collects service metadata, inter-service call dependencies, and the affiliation of responsible persons and teams, and performs identifier unification and schema standardization to output triple data streams. According to a predefined graph pattern, triple data streams are stored in a graph database to construct a service knowledge graph. The nodes of the service knowledge graph include microservices and their responsible persons, and the edges include the calling relationships between services and the attribution relationships between services and their responsible persons. When the person in charge of a service changes or the service name is modified, a historical expiration timestamp attribute is added to the original relationship in the service knowledge graph, and a new edge representing the new relationship with an effective timestamp attribute is created simultaneously.

4. The method according to claim 1, characterized in that, The process of using graph neural networks to embed the service knowledge graph, intelligently correcting and associating the ambiguous or modified service names involved in the first alarm event, and outputting the second alarm event, also includes: Extract all node and edge data from the service knowledge graph. Based on the type and attributes of the nodes, generate initial feature vectors for different types of nodes using a word vector model, and construct a node feature matrix. A relational graph attention network model is constructed. This model is used to perform relation-specific transformations on the features of neighbor nodes during message passing by introducing a learnable parameter matrix associated with the graph edge type, and to calculate relation-aware attention weights to aggregate neighbor information. Based on the node feature matrix and relational graph attention network model, a multi-task self-supervised training framework is designed, which includes link prediction task and node attribute prediction task, and the loss function is combined to form the overall goal of model training. Based on the overall objective, the relational graph attention network model is iteratively trained using an optimization algorithm until the model converges, thus obtaining the trained graph neural network.

5. The method according to claim 4, characterized in that, The method of using graph neural networks to embed the service knowledge graph, intelligently correcting and associating the ambiguous or modified service names involved in the first alarm event, and outputting the second alarm event specifically includes: Based on graph neural networks, an embedding vector that integrates its own semantics and the structural information of its neighbors is generated for each service node in the service knowledge graph, and a node vector index is established. Based on the first alarm event, the fuzzy service identifier or changed service identifier in the first alarm event is converted into a query vector of the same dimension through a text encoding model compatible with the encoding of graph neural networks. In the node vector index, perform an approximate nearest neighbor search based on the query vector to retrieve at least one candidate service node with the highest similarity to the query vector. By combining the context metadata in the first alarm event, the retrieved candidate service nodes are verified and reordered to determine the target associated service node; Replace the fuzzy or modified service identifier in the first alarm event with the standardized information of the target associated service node, and add an association confidence level to generate a second alarm event.

6. The method according to claim 1, characterized in that, Based on the second alarm event, combined with the relationships extracted from the service knowledge graph, current organizational structure data, and historical alarm response records, an XGBoost model is trained and applied to predict and determine the optimal person in charge for the current event, generating a third alarm event, specifically including: Based on the service node associated with the second alarm event, extract the current list of legitimate responsible persons from the service knowledge graph; For the second alarm event and each person in the candidate list of responsible persons, a multi-dimensional feature vector is calculated in real time. The multi-dimensional feature vector includes alarm event attributes, service graph attributes, real-time status attributes of responsible persons, and historical response performance attributes. The multi-dimensional feature vector of each person in charge is input into the pre-trained XGBoost model to obtain a matching probability score that represents each person in charge as the best person to handle the current alarm event. The person in charge with the highest matching probability score is identified as the predicted optimal person in charge. The identifier, confidence level, and ranking information of the predicted optimal person in charge are added to the second alarm event, and the third alarm event is output.

7. The method according to claim 6, characterized in that, The pre-training steps of the XGBoost model specifically include: Retrieve a set of alarm events that have been processed within a preset time window from the historical event repository, and determine the actual responsible person for processing each alarm event in the alarm event set in order to build an original sample event pool; For each alarm event in the original sample event pool, based on the service knowledge graph and organizational structure snapshot at the time of the event, determine the set of all legitimate responsible persons for that alarm event at that time. Based on the set of legitimate responsible persons candidates and the actual effective responsible persons, the feature combination of the actual responsible person and the corresponding alarm event is labeled as a positive sample, and the feature combination of other candidates and the corresponding alarm event is labeled as a negative sample, thus constructing a training sample set; The XGBoost model is trained under supervision using the training sample set, and the optimal model parameters are selected through hyperparameter optimization and cross-validation.

8. The method according to any one of claims 1 to 7, characterized in that, The step of dynamically selecting the optimal notification channel and notification timing strategy based on the historical response channel preferences and response timeliness data of the person in charge identified in the third alarm event, using a decision tree model, specifically includes: Based on historical notification records, a multi-dimensional training dataset was constructed, which includes notification channels, recipient response behavior, time context, and alarm features, and was labeled with classification tags based on response latency. A decision tree model is used to train a multi-dimensional dataset to learn the predicted probability of triggering a recipient's response within an effective time window through a specific notification channel under different feature combinations. When a third alarm event is received, the current real-time context and the historical behavioral characteristics of the best person in charge are combined to generate a channel feature vector for each available notification channel and input it into the decision tree model to obtain the predicted response probability of each notification channel. Choose the notification channel with the highest predicted response probability as the optimal channel for the initial notification.

9. The method according to claim 8, characterized in that, If no response is received within the preset time, an upgrade decision process is triggered based on the backup relationship or organizational hierarchy in the service knowledge graph, specifically including: A joint decision is made based on the alarm severity level and the predicted response probability of the optimal channel to set an escalation waiting time threshold for the first notification; The alarm notification is sent through the optimal channel and timed monitoring is started. If no response is received within the upgrade waiting time threshold, the upgrade decision process is triggered. In the upgrade decision-making process, the channel feature vector is updated to reflect the state of no response to the initial notification, and the decision tree model is reused to predict the next optimal notification action from the remaining strategy options, which includes switching to another channel and notifying the backup person in charge.

10. A containerized alarm precision push system based on dynamic association, characterized in that, The system specifically includes: The container prediction module is used to predict container resource bottlenecks based on multi-dimensional monitoring metrics and historical time-series data during container runtime, using a CNN-LSTM hybrid model, analyzing container change frequency, and generating early warning events. The knowledge graph module is used to construct a service knowledge graph based on the collected service metadata, service dependencies, and historical owner change records for the first alarm event. The service correction module is used to embed the service knowledge graph into a graph neural network, perform intelligent error correction and association mapping on the ambiguous or modified service names involved in the first alarm event, and output the second alarm event. The responsible person association module is used to train and apply the XGBoost model to predict and determine the optimal responsible person for the current event based on the second alarm event, combined with the association relationship extracted from the service knowledge graph, the current organizational structure data, and historical alarm response records, and to generate the third alarm event. The channel notification module is used to dynamically select the optimal notification channel and notification timing strategy based on the historical response channel preferences and response time data of the person in charge identified in the third alarm event, and to trigger the escalation decision process based on the backup relationship or organizational level in the service knowledge graph if no response is received within a preset time.

Images