A cloud resource alarm intelligent research and judgment method and system

Abstract

The application discloses a kind of cloud resource alarm intelligent research and judgment methods, comprising the following steps: step 1, constructs historical alarm database;Step 2, iteration updates reference sample;Step 3, reference alarm sample is classified;Step 4, reference alarm sample is post-processed;Step 5, cloud resource alarm intelligent classification;Step 6, quickly match cloud resource node.The application also discloses a kind of cloud resource alarm intelligent research and judgment method system, including historical alarm database;Reference sample extraction module;Sample iteration update module;Sample classification module;Sample post-processing module;Alarm research and judgment module;Resource addressing model storage module;Resource information acquisition module.The application is configured by three different alarm characteristic values, respectively represents severity correlation, disposal timeliness correlation, alarm frequency correlation, and realizes the individualization of characteristic value by combining self-defined weight coefficient, which meets the cloud resource monitoring needs of different enterprises.

Description

Technical Field

[0001] This invention relates to the field of cloud resource monitoring technology, and in particular to a method and system for intelligent analysis of cloud resource alarms. Background Technology

[0002] With the rapid development of cloud computing technology, the scale and complexity of enterprise cloud resources are constantly increasing. During operation, various cloud resources such as cloud servers, cloud databases, cloud storage, and container clusters will generate a large number of alarm messages. The alarm types cover a variety of issues, including core service interruption, resource overload, network link anomaly, hardware failure, and configuration deviation.

[0003] Traditional cloud resource alarm analysis methods generally employ a uniform and undifferentiated analysis logic, handling alarms solely based on their chronological order. This leads to urgent alarms being buried under a large number of general and minor alarms, resulting in delayed response and causing cloud resource service failures or even business interruptions. Furthermore, traditional methods lack a standardized sample reference system based on historical alarm data, relying on human experience for analysis, leading to high subjectivity and low accuracy. The matching of cloud resources with management nodes also involves a cumbersome and time-consuming global traversal, further reducing the overall efficiency of cloud resource alarm processing. Therefore, this invention proposes an intelligent cloud resource alarm analysis method and system. Summary of the Invention

[0004] The purpose of this invention is to address the shortcomings of existing technologies by proposing a cloud resource alarm intelligent judgment method and system.

[0005] To achieve the above objectives, the present invention adopts the following technical solution:

[0006] A cloud resource alarm intelligent assessment method includes the following steps:

[0007] Step 1: Construct a historical alarm database and extract reference alarm samples. The historical alarm database stores historical alarm entries, which include cloud resource information, alarm type information, alarm content information, and alarm characteristic information; randomly select... One historical alarm entry is used as the initial reference alarm sample and mapped to a two-dimensional coordinate system. Using a set of coordinates, the initial reference alarm sample is deleted from the historical alarm database to generate the first alarm set. ;

[0008] Step 2: Iteratively update the reference alarm sample. Select a historical alarm entry from the first alarm set as the iterative alarm sample, calculate the Euclidean distance between the iterative alarm sample and the reference alarm sample, select the closest reference alarm sample as the core alarm sample, and update the feature value of the core alarm sample based on the feature value of the iterative alarm sample until all historical alarm entries in the first alarm set have completed the iteration or the updated weight coefficient is less than the set threshold.

[0009] Step 3: Classify the updated reference alarm samples. For each reference alarm sample, extract historical alarm entries with a distance less than the first distance threshold from the first alarm set to generate a second alarm set. Based on the proportion of different types of alarms in the second alarm set, classify the reference alarm samples into the first category of emergency alarms, the second category of general alarms, and the third category of minor alarms. Delete reference alarm samples that do not meet the classification conditions.

[0010] Step 4: Post-process the reference alarm samples to generate the final reference alarm sample set. Iterate through all categorized reference alarm samples. If the distance between the two-dimensional coordinates of two reference alarm samples of the same category is less than or equal to... If one of them is marked, the marked reference alarm sample will be deleted after the traversal is completed.

[0011] Step 5: Perform intelligent hierarchical analysis on the cloud resource alarms to be analyzed, extract the alarm feature values ​​of the alarms to be analyzed, calculate the distance parameters between them and each sample in the final reference alarm sample set, assign the category of the reference alarm sample with the smallest distance parameter to the alarm to be analyzed, and complete the intelligent analysis of the alarms.

[0012] Step 6: Based on the cloud resource addressing model, quickly match the cloud resource node information corresponding to the alarm to be analyzed, and obtain the control node information of the cloud resources in order of priority according to the alarm analysis category.

[0013] Preferably, the alarm feature information in step 1 includes a first feature value. Second eigenvalue Third eigenvalue These represent the correlation between the severity of cloud resource alarms, the timeliness of handling, and the frequency of alarms, respectively.

[0014] First eigenvalue The calculation formula is:

[0015]

[0016] In the formula, This represents the total number of all historical alert entries associated with this cloud resource. This represents the number of emergency alarm entries. This represents the number of general alarm entries. This represents the number of minor alert entries. To customize the weighting coefficients, These represent the weighting percentages for emergency alarms and general alarms, respectively.

[0017] Second eigenvalue The calculation formula is:

[0018]

[0019] In the formula, The preset average alarm handling time for the cloud resource monitoring platform. This refers to the actual processing time for the last alarm on this cloud resource. To prevent zero offset, the value is set to 1;

[0020] Third eigenvalue The calculation formula is:

[0021]

[0022] In the formula, This represents the time interval between the current alarm and the previous alarm for this cloud resource. The maximum historical time interval for this type of cloud resource alert is calculated using the natural logarithm. Implement numerical normalization.

[0023] Preferably, the Euclidean distance between the iterative alarm sample and the reference alarm sample in step 2 is... The calculation formula is:

[0024]

[0025] In the formula, The three feature values ​​of the iterative alarm sample are: Three characteristic values ​​are used as a reference for the alarm sample; For eigenvalue weights, The core logic of prioritizing severity in matching cloud resource alarm analysis;

[0026] The update formula for the core alarm sample feature values ​​is:

[0027]

[0028] In the formula, , corresponding to three feature value dimensions; The first core alarm sample before the update 1 eigenvalue, The first core alarm sample after the update 1 eigenvalue, The first iteration of the alarm sample One eigenvalue; The learning rate is dynamic and adjusts dynamically with the number of iterations. The calculation formula is:

[0029]

[0030] In the formula, The initial learning rate is defined as (0, 1); This represents the current iteration update number; The Euclidean distance between the reference alarm sample and the core alarm sample's mapped coordinates.

[0031] Preferably, the classification criteria for the reference alarm samples in step 3 are:

[0032] First condition: Emergency alarms account for ≥70% of the second alarm set, and If the condition is met, it is classified as a first-category emergency alarm sample;

[0033] The second condition is that in the second alarm set, the proportion of emergency alarms is <70%, the proportion of general alarms is >40%, and the ratio of general alarms to minor alarms is [missing information]. If the condition is met, it is classified as a second category of general alarm sample;

[0034] The third condition: In the second alarm set, the proportion of emergency alarms is <70%, the proportion of minor alarms is ≥40%, and the ratio of minor alarms to general alarms is <70%. If the condition is met, it is classified as a third type of minor alarm sample;

[0035] Reference alarm samples that do not meet the above conditions will be deleted directly.

[0036] Preferably, the distance parameter between the alarm to be analyzed and the reference alarm sample in step 5... The calculation formula is:

[0037]

[0038] In the formula, The three characteristic values ​​of the alarm to be analyzed are: Three characteristic values ​​are used as a reference for the alarm sample; To determine the weights of the feature values ​​in the evaluation stage, and the weights in the sample update stage. Maintain consistency, that is ; The formula for calculating the sample confidence weighting coefficient for the reference alarm samples is as follows:

[0039]

[0040] In the formula, The number of valid samples in the associated sample set to which the reference alarm sample belongs, wherein the two-dimensional coordinate points mapped to the reference alarm samples in the associated sample set can be connected by a length. The line segments are connected. The larger the value, the higher the confidence level of the sample, and the better the fit of the weighting coefficient.

[0041] Preferably, the cloud resource addressing model in step 6 is a three-layer structure, with the first layer storing the first addressing node associated with the resource segment identifier of the cloud resource, the second layer storing the second addressing node associated with the regional deployment code of the cloud resource, and the third layer storing the third addressing node associated with the instance unique code of the cloud resource.

[0042] A system for intelligent analysis of cloud resource alarms includes:

[0043] A historical alarm database is used to store historical alarm entries for cloud resources. The historical alarm entries include cloud resource information, alarm type information, alarm content information, and alarm characteristic information.

[0044] The reference sample extraction module is connected to the historical alarm database and is used to extract the initial reference alarm sample and generate the first alarm set, mapping the initial reference alarm sample to a two-dimensional coordinate system.

[0045] The sample iteration update module, connected to the reference sample extraction module, is used to select iterative alarm samples from the first alarm set, calculate the Euclidean distance with feature weights and determine the core alarm samples, and iteratively update the feature values ​​of the reference alarm samples based on the dynamic learning rate.

[0046] The sample classification module, connected to the sample iteration update module, is used to generate a second alarm set for the reference alarm samples and divide the reference alarm samples into three categories based on the multi-condition alarm ratio rule, and delete invalid samples.

[0047] The sample post-processing module, connected to the sample classification module, is used to deduplicatize the classified reference alarm samples and generate the final reference alarm sample set.

[0048] The alarm analysis module, connected to the sample post-processing module, is used to extract the feature values ​​of the alarms to be analyzed, calculate the distance parameters weighted by the sample confidence level, and match the alarm categories to complete the intelligent hierarchical analysis.

[0049] The resource addressing model storage module is used to store the three-tier cloud resource addressing model.

[0050] The resource information acquisition module is connected to the alarm analysis module and the resource addressing model storage module, respectively. It is used to search and acquire full information of cloud resource management nodes layer by layer according to the priority of alarm categories and based on the cloud resource addressing model.

[0051] Preferably, the resource information acquisition module includes:

[0052] The first identification unit is a resource segment identifier used to identify cloud resources;

[0053] The second identification unit is the regional deployment code used to identify cloud resources;

[0054] The third identification unit is used to identify the unique instance code of cloud resources, and the code is split into segments and hashed modulo 2048 to obtain the hash value;

[0055] The matching unit is connected to three identification units and is used to search layer by layer in the cloud resource addressing model based on the identification information to obtain full information of cloud resource management nodes. It also supports caching and real-time updating of addressing results.

[0056] Preferably, it also includes an alarm feature generation module, which is connected to the historical alarm database and the alarm analysis module, respectively. This module generates standardized alarm feature information for historical alarm entries and alarms to be analyzed based on the feature value calculation formula of claim 2, and supports weighting coefficients. Custom configuration.

[0057] Preferably, it also includes an addressing model generation module, which is connected to the historical alarm database and the resource addressing model storage module, respectively. It is used to generate a three-layer cloud resource addressing model based on the full information of cloud resources provided by the cloud resource monitoring platform and store it in the resource addressing model storage module. It also supports dynamic expansion of the addressing model and node updates when cloud resources are scaled up or down.

[0058] The present invention has the following beneficial effects:

[0059] 1. Three differentiated alarm feature values ​​are used to represent the correlation of severity, the correlation of handling timeliness, and the correlation of alarm frequency, respectively. Combined with custom weight coefficients, the feature values ​​can be configured in a personalized manner to meet the cloud resource monitoring needs of different enterprises and provide accurate feature basis for analysis.

[0060] 2. During the sample iteration and update stage, Euclidean distance calculation with feature weights is adopted to highlight the core role of severity correlation. At the same time, a dynamic learning rate is designed to adaptively adjust with the number of iterations and coordinate distance to avoid overfitting or underfitting of sample updates and improve the accuracy of reference samples.

[0061] 3. By classifying reference samples through multi-condition proportion rules, the analysis dimensions are more comprehensive compared to single proportion judgment, and the sample classification results are more in line with the actual alarm scenarios. In the alarm analysis stage, a sample confidence weighting coefficient is introduced, and the weighting value is adjusted according to the number of related samples. The higher the sample confidence, the larger the weighting coefficient, which further improves the accuracy of alarm category matching.

[0062] 4. Through a three-layer cloud resource addressing model, cloud resource information is stored in layers according to resource segment identifier, regional deployment code, and instance unique code. Combined with modulo 2048 hash operation, the storage bits are accurately mapped, which greatly improves the search efficiency of cloud resource management node information. The system has clear logic, strong operability, and supports custom configuration of parameters such as weight coefficient and number of addressing nodes. It can be adapted to cloud resource monitoring platforms of different scales and types and has a wide range of application scenarios. Attached Figure Description

[0063] Figure 1 This is a logical block diagram of a cloud resource alarm intelligent judgment method proposed in this invention;

[0064] Figure 2 This is a cloud resource analysis layer diagram of the intelligent judgment method for cloud resource alarms in this invention;

[0065] Figure 3 This is a cloud resource acquisition logic diagram of the intelligent judgment method for cloud resource alarms in this invention;

[0066] Figure 4 This is a diagram showing the collaborative operation of the modules in the cloud resource alarm intelligent analysis system of this invention. Detailed Implementation

[0067] The technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments.

[0068] Reference Figure 1 A cloud resource alarm intelligent assessment method includes the following steps:

[0069] I. Parameter Preset

[0070] The preset core parameters are as follows:

[0071] Eigenvalue weights: ,and and Maintain consistency;

[0072] Treatment benchmark and offset coefficient: =30 minutes (platform preset average processing time for cloud resource alarms). ;

[0073] Dynamic learning rate: Initial learning rate ;

[0074] Distance thresholds: The first distance threshold is 1.2 (Euclidean distance), and the distance judgment threshold for reference sample coordinate points is... ;

[0075] Addressing model parameters: The unique code of a cloud resource instance is divided into 4 segments, each segment is 8 characters long, and a hash operation modulo 2048 is performed to obtain a hash value of 0-2047; one second addressing node connects to 2048 third addressing nodes, and one third addressing node connects to 50 storage bits.

[0076] II. Intelligent Analysis Methods for Cloud Resource Alarms

[0077] Step 1: Refer to Figure 2 and Figure 3 Build a historical alarm database and extract reference alarm samples.

[0078] Historical Alarm Database Construction: An enterprise-grade cloud resource historical alarm database is built to store historical alarm entries for three core cloud resources within one year of platform operation. Each historical alarm entry contains four core pieces of information:

[0079] Cloud resource information: resource type (cloud server / cloud database / cloud storage), resource segment identifier (e.g., 192.168 / 172.16), regional deployment code (e.g., East China-01, North China-02, South China-03), instance unique code (e.g., YUN01-SVR-20240101).

[0080] Alarm type information: Emergency alarm, general alarm, minor alarm (labeled according to platform preset rules);

[0081] Alarm information: detailed description of the alarm, time of alarm occurrence, and original alarm data;

[0082] Alarm feature information: calculated by the alarm feature generation module based on the formula described in claim 2. Three feature values ​​are used, and after the feature values ​​are calculated, they are associated with and stored in historical alarm entries.

[0083] Initial reference alarm sample extraction: randomly selected from the historical alarm database One historical alarm entry was used as the initial reference alarm sample. Satisfying claim 1 The requirements are as follows: 256 initial reference alarm samples are mapped one by one to 256 coordinate points in a two-dimensional coordinate system. The coordinate points are distributed in a matrix and the coordinate values ​​are (1,1) to (16,16); these 256 initial reference alarm samples are deleted from the historical alarm database, and the remaining historical alarm entries are integrated to generate the first alarm set. In this embodiment, the first alarm set contains a total of 8964 historical alarm entries.

[0084] Step 2: Iteratively update the reference alarm sample

[0085] Iterative alarm sample selection: Randomly select one historical alarm entry from the first alarm set as the iterative alarm sample, and extract its three feature values. ;

[0086] Weighted Euclidean distance calculation: as described in claim 3 The calculation formula calculates the feature-weighted Euclidean distance between the iterative alarm sample and each of the 256 reference alarm samples. During the calculation, preset weights are substituted. , ,protrude The core weight of (severity correlation);

[0087] Core alarm sample determination: Selected alarm samples from 256 reference alarm samples and iterative alarm samples. The reference alarm sample with the smallest value is used as the core alarm sample, and its current feature value is extracted. ;

[0088] Dynamic learning rate calculation: Calculate the Euclidean distance between the mapped coordinates of the core alarm sample and the corresponding reference alarm sample. ,like Then, the dynamic learning rate is calculated according to the formula described in claim 3. , The current iteration number (initial value) Each iteration Increment by 1), substitute ;like ,but No feature value update is performed;

[0089] Core alarm sample feature value update: Substitute the feature value update formula according to claim 3 into... Iterative alarm sample feature values (Right now ), original feature values ​​of core alarm samples Calculate the updated eigenvalues Complete the feature value update of this core alarm sample;

[0090] Iteration Termination Determination: Repeat steps 1-5 above, sequentially selecting all historical alarm entries from the first alarm set as iterative alarm samples, until all 8964 entries have completed the iteration. In this embodiment, the final iteration count is... The iterative updates of all reference alarm samples were completed, and the optimized reference alarm sample feature values ​​are more in line with the actual alarm scenarios of the platform.

[0091] Step 3: Categorize the updated reference alarm samples

[0092] Second alarm set generation: For each updated reference alarm sample, according to the rule described in claim 1, extract historical alarm entries from the first alarm set whose Euclidean distance from the sample is less than the first distance threshold of 1.2, and generate a second alarm set separately for each reference alarm sample;

[0093] Multi-condition percentage determination: For each reference alarm sample corresponding to the second alarm set, count the number of emergency alarms. General alarms Minor alarm The quantity is determined one by one according to the three conditions described in claim 4:

[0094] First condition: If the proportion of emergency alarms is high ,and If so, the reference alarm sample is classified as the first category (emergency alarm sample);

[0095] Second condition: If the proportion of emergency alarms is... General alarm percentage ,and If so, the reference alarm sample is classified as the second category (general alarm sample).

[0096] Third condition: If the proportion of emergency alarms is high Minor alarm percentage ,and If so, the reference alarm sample is classified as the third category (minor alarm sample);

[0097] Invalid sample deletion: If the second alarm set corresponding to a certain reference alarm sample does not meet the above three conditions, it is determined to be an invalid sample and deleted directly; In this embodiment, after the 256 updated reference alarm samples are judged, 32 invalid samples are deleted, and 224 valid samples remain, including 68 first-class samples, 96 second-class samples, and 60 third-class samples.

[0098] Step 4: Post-process the reference alarm samples to generate the final reference alarm sample set.

[0099] Reference alarm sample traversal: Traverse the first, second and third categories of reference alarm samples in sequence according to category, and compare the Euclidean distance between the mapped two-dimensional coordinate points of the same category samples one by one;

[0100] Duplicate sample labeling: If the coordinates of two reference alarm samples of the same category are Euclidean distance apart... If the sample is identified as a duplicate sample, the sample with fewer feature value updates is marked (this marking rule is used in this embodiment, but a random marking rule can also be used, both of which are within the scope of protection of this invention), and the same reference alarm sample is marked only once to avoid duplicate marking.

[0101] Duplicate sample deletion: After all 224 valid samples have been traversed, all marked duplicate samples are deleted; in this embodiment, a total of 24 duplicate samples are marked and deleted, including 8 samples of the first category, 10 samples of the second category, and 6 samples of the third category;

[0102] Final sample set generation: After deleting duplicate samples, the remaining 200 reference alarm samples are integrated into the final reference alarm sample set, which includes 60 samples of the first category (emergency alarm), 86 samples of the second category (general alarm), and 54 samples of the third category (minor alarm). This set provides the final standardized reference for subsequent alarm analysis.

[0103] Step 5: Perform intelligent hierarchical analysis on cloud resource alarms to be analyzed.

[0104] Feature value extraction of the alarm to be analyzed: The alarm feature generation module collects the cloud resource information and alarm-related historical data of the alarm to be analyzed, and calculates its feature value based on the three feature value calculation formulas described in claim 2. , ,in:

[0105] This cloud server is associated with all historical alerts. Substitute Calculated;

[0106] Platform preset Minutes, the actual processing time for a single alarm on this cloud server Minutes, substitute Calculated;

[0107] The time interval between the current alarm and the last alarm on this cloud server. The longest historical time interval for alarms from this type of cloud server (hourly). The hour is calculated by substituting into the natural logarithm formula;

[0108] Sample confidence weighting coefficient calculation: For the 200 samples in the final reference alarm sample set, pre-divide the associated sample set according to the rules described in claim 5 (the sample coordinate points can be separated by length). (Connecting line segments), count the number of valid samples s in the associated sample set to which each sample belongs, and calculate the sample confidence weighting coefficient M for each sample according to the formula; In this embodiment, 60 first-class samples are divided into 12 associated sample sets, 86 second-class samples are divided into 17 associated sample sets, and 54 third-class samples are divided into 9 associated sample sets.

[0109] Distance parameter calculation: as described in claim 5 Calculation formula, substitute the alarm feature value to be analyzed Final reference alarm sample feature values Feature weights and the weighting coefficients of each sample Calculate the distance parameters between each alarm to be analyzed and 200 reference alarm samples. ;

[0110] Alarm category matching: Select alarms that match the categories to be analyzed from 200 reference alarm samples. The reference alarm sample with the smallest value is assigned the category of the alarm to be analyzed. In this embodiment, the alarm to be analyzed is compared with a certain second-category (general alarm) sample in the final reference alarm sample set. The value is the smallest, therefore the alarm to be analyzed is determined to be a general alarm, and the intelligent hierarchical analysis is completed.

[0111] Step 6: Quickly match the cloud resource node information corresponding to the alarm to be analyzed based on the cloud resource addressing model.

[0112] Cloud resource addressing model pre-generation: Based on the full information of cloud resources provided by the platform services, the addressing model generation module generates a three-layer cloud resource addressing model according to the rules described in claim 6, and stores it in the resource addressing model storage module.

[0113] First layer: Generate the first addressing node based on the cloud resource segment identifier (such as 192.168, 172.16). In this embodiment, two first addressing nodes are generated.

[0114] The second layer: Based on the cloud resource regional deployment codes (East China-01, North China-02, South China-03), a second addressing node is generated. In this embodiment, three second addressing nodes are generated, and each first addressing node is associated with three second addressing nodes.

[0115] The third layer: The unique code of the cloud resource instance is split into 4 segments (8 bits each), and a modulo 2048 hash operation is performed to obtain a hash value from 0 to 2047. The unique code of the instance with the same hash value is associated with a third addressing node. In this embodiment, 2048 third addressing nodes are generated. One second addressing node connects to 2048 third addressing nodes. One third addressing node connects to 50 storage bits. The storage bits store the full amount of management data, such as the management node IP, handling port, responsible person information, and fault handling link corresponding to the cloud resource.

[0116] Cloud resource information identification: The three identification units of the resource information acquisition module respectively identify the cloud resource information to be analyzed and alerted.

[0117] First identification unit: Identifies resource segment identifier as 192.168;

[0118] Second identification unit: Identifies the regional deployment code as East China-01;

[0119] The third identification unit: It identifies the unique code of the instance as YUN01-SVR-20240101, splits it into 4 segments, performs a modulo 2048 hash operation, and obtains a hash value of 128.

[0120] Control node information is searched layer by layer: Based on the above identification information, the matching unit searches layer by layer from the cloud resource addressing model:

[0121] Step 1: Locate the first addressable node corresponding to 192.168 in the first layer;

[0122] Step 2: Under the first addressing node, find the second addressing node corresponding to East China-01;

[0123] Step 3: Under the second addressing node, find the third addressing node corresponding to the hash value 128;

[0124] Step 4: Under the third addressing node, find the storage location corresponding to the unique code of the cloud server instance, and extract all management data from the storage location, including the management node IP (192.168.0.100), handling port (8080), responsible person, and fault handling link (platform alarm system, server management console, load balancing module);

[0125] Information is pushed according to priority: The resource information acquisition module pushes the control node information of the alarm to be analyzed to the platform alarm handling terminal according to the priority of alarm category (first category > second category > third category). Alarms of the same category are pushed in the order of alarm generation time. In this embodiment, the general alarm is pushed in the current general alarm queue to be handled in the order of time. The handling personnel can quickly carry out alarm handling based on the acquired control node information.

[0126] III. Reference Figure 4 Perform module collaboration in the cloud resource alarm intelligent analysis system

[0127] The historical alarm database provides basic data support for the reference sample extraction module, alarm feature generation module, and addressing model generation module.

[0128] The alarm feature generation module generates standardized alarm feature information for the historical alarm database and alarm analysis module, which is the core feature foundation for sample construction and alarm analysis.

[0129] The reference sample extraction module provides the initial reference alarm samples and the first alarm set for the sample iteration update module;

[0130] The sample iteration update module provides optimized reference alarm samples for the sample classification module;

[0131] The sample classification module provides the sample post-processing module with valid reference alarm samples determined by multiple conditions;

[0132] The sample post-processing module provides the alarm analysis module with the final reference alarm sample set, which is the core reference basis for intelligent alarm analysis;

[0133] The addressing model generation module provides a pre-generated three-layer cloud resource addressing model for the resource addressing model storage module;

[0134] The alarm analysis module provides the resource information acquisition module with information on the category of alarms to be analyzed and basic cloud resource information;

[0135] The resource addressing model storage module provides addressing model support for the resource information acquisition module, which completes the search and push of control node information based on alarm category priority.

[0136] Meanwhile, this system supports custom parameter configuration (such as...) Equal weighting coefficients, dynamic scaling of the addressing model (the addressing model generation module automatically updates the addressing nodes when cloud resources are scaled up or down), and addressing result caching (the resource information acquisition module caches the management node information that is frequently searched, improving the efficiency of subsequent searches) further enhance the system's adaptability and processing efficiency.

[0137] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A method for intelligent analysis of cloud resource alarms, characterized in that, Includes the following steps: Step 1: Construct a historical alarm database and extract reference alarm samples. The historical alarm database stores historical alarm entries, which include cloud resource information, alarm type information, alarm content information, and alarm characteristic information; randomly select... One historical alarm entry is used as the initial reference alarm sample and mapped to a two-dimensional coordinate system. Using a set of coordinates, the initial reference alarm sample is deleted from the historical alarm database to generate the first alarm set. ; Step 2: Iteratively update the reference alarm sample. Select a historical alarm entry from the first alarm set as the iterative alarm sample, calculate the Euclidean distance between the iterative alarm sample and the reference alarm sample, select the closest reference alarm sample as the core alarm sample, and update the feature value of the core alarm sample based on the feature value of the iterative alarm sample until all historical alarm entries in the first alarm set have completed the iteration or the updated weight coefficient is less than the set threshold. Step 3: Classify the updated reference alarm samples. For each reference alarm sample, extract historical alarm entries with a distance less than the first distance threshold from the first alarm set to generate a second alarm set. Based on the proportion of different types of alarms in the second alarm set, classify the reference alarm samples into the first category of emergency alarms, the second category of general alarms, and the third category of minor alarms. Delete reference alarm samples that do not meet the classification conditions. Step 4: Post-process the reference alarm samples to generate the final reference alarm sample set. Iterate through all categorized reference alarm samples. If the distance between the two-dimensional coordinates of two reference alarm samples of the same category is less than or equal to... If one of them is marked, the marked reference alarm sample will be deleted after the traversal is completed. Step 5: Perform intelligent hierarchical analysis on the cloud resource alarms to be analyzed, extract the alarm feature values ​​of the alarms to be analyzed, calculate the distance parameters between them and each sample in the final reference alarm sample set, assign the category of the reference alarm sample with the smallest distance parameter to the alarm to be analyzed, and complete the intelligent analysis of the alarms. Step 6: Based on the cloud resource addressing model, quickly match the cloud resource node information corresponding to the alarm to be analyzed, and obtain the control node information of the cloud resources in order of priority according to the alarm analysis category.

2. The intelligent analysis method and system for cloud resource alarms according to claim 1, characterized in that, The alarm feature information mentioned in step 1 includes a first feature value. Second eigenvalue Third eigenvalue These represent the correlation between the severity of cloud resource alarms, the timeliness of handling, and the frequency of alarms, respectively. First eigenvalue The calculation formula is: In the formula, This represents the total number of all historical alert entries associated with this cloud resource. This represents the number of emergency alarm entries. This represents the number of general alarm entries. This represents the number of minor alert entries; To customize the weighting coefficients, These represent the weighting percentages for emergency alarms and general alarms, respectively. Second eigenvalue The calculation formula is: In the formula, The preset average alarm handling baseline time for the cloud resource monitoring platform. This refers to the actual processing time for the last alarm on this cloud resource. To prevent zero offset, the value is set to 1; Third eigenvalue The calculation formula is: In the formula, This represents the time interval between the current alarm and the previous alarm for this cloud resource. The maximum historical time interval for this type of cloud resource alert is calculated using the natural logarithm. Implement numerical normalization.

3. The intelligent judgment method for cloud resource alarms according to claim 1, characterized in that, The Euclidean distance between the iterative alarm sample and the reference alarm sample mentioned in step 2 The calculation formula is: In the formula, The three feature values ​​of the iterative alarm sample are: Three characteristic values ​​are used as a reference for the alarm sample; For eigenvalue weights, The core logic of prioritizing severity in matching cloud resource alarm analysis; The update formula for the core alarm sample feature values ​​is: In the formula, , corresponding to three feature value dimensions; The first core alarm sample before the update 1 eigenvalue, The first core alarm sample after the update 1 eigenvalue, The first iteration of the alarm sample One eigenvalue; The learning rate is dynamic and adjusts dynamically with the number of iterations. The calculation formula is: In the formula, The initial learning rate is defined as (0, 1); This represents the current iteration update number; The Euclidean distance between the reference alarm sample and the core alarm sample's mapped coordinates.

4. The intelligent analysis method for cloud resource alarms according to claim 1, characterized in that, The classification criteria for the reference alarm samples mentioned in step 3 are as follows: First condition: Emergency alarms account for ≥70% of the second alarm set, and If the condition is met, it is classified as a first-category emergency alarm sample; The second condition is that in the second alarm set, the proportion of emergency alarms is <70%, the proportion of general alarms is >40%, and the ratio of general alarms to minor alarms is [missing information]. If the condition is met, it is classified as a second category of general alarm sample; The third condition: In the second alarm set, the proportion of emergency alarms is <70%, the proportion of minor alarms is ≥40%, and the ratio of minor alarms to general alarms is <70%. If the condition is met, it is classified as a third category of minor alarm samples; Reference alarm samples that do not meet the above conditions will be deleted directly.

5. The intelligent analysis method for cloud resource alarms according to claim 1, characterized in that, The distance parameter between the alarm to be analyzed and the reference alarm sample mentioned in step 5 The calculation formula is: In the formula, The three characteristic values ​​of the alarm to be analyzed are: Three characteristic values ​​are used as a reference for the alarm sample; To determine the weights of the feature values ​​in the evaluation stage, and the weights in the sample update stage. Maintain consistency, that is ; The formula for calculating the sample confidence weighting coefficient for the reference alarm samples is as follows: In the formula, The number of valid samples in the associated sample set to which the reference alarm sample belongs, wherein the two-dimensional coordinate points mapped to the reference alarm samples in the associated sample set can be connected by a length. The line segments are connected. The larger the value, the higher the confidence level of the sample, and the better the fit of the weighting coefficient.

6. The intelligent analysis method for cloud resource alarms according to claim 1, characterized in that, The cloud resource addressing model described in step 6 is a three-layer structure. The first layer stores the first addressing node associated with the resource segment identifier of the cloud resource, the second layer stores the second addressing node associated with the regional deployment code of the cloud resource, and the third layer stores the third addressing node associated with the instance unique code of the cloud resource. The cloud resource addressing model is generated as follows: the first addressing node is generated based on the cloud resource segment identifier of the cloud resource monitoring platform service, the second addressing node is generated based on the regional deployment code, the unique code of the cloud resource instance is split into segments and a modulo 2048 hash operation is performed to obtain a hash value of 0-2047, and the unique code of instances with the same hash value is associated with a third addressing node. One second addressing node connects to 2048 third addressing nodes, and one third addressing node connects to 50 storage slots. The storage slots store all management data corresponding to the cloud resources, including the IP address of the management node, the handling port, and the information of the responsible person.

7. A system for implementing the intelligent analysis method for cloud resource alarms as described in any one of claims 1-6, characterized in that, include: A historical alarm database is used to store historical alarm entries for cloud resources. The historical alarm entries include cloud resource information, alarm type information, alarm content information, and alarm characteristic information. The reference sample extraction module is connected to the historical alarm database and is used to extract the initial reference alarm sample and generate the first alarm set, mapping the initial reference alarm sample to a two-dimensional coordinate system. The sample iteration update module, connected to the reference sample extraction module, is used to select iterative alarm samples from the first alarm set, calculate the Euclidean distance with feature weights and determine the core alarm samples, and iteratively update the feature values ​​of the reference alarm samples based on the dynamic learning rate. The sample classification module, connected to the sample iteration update module, is used to generate a second alarm set for the reference alarm samples and divide the reference alarm samples into three categories based on the multi-condition alarm ratio rule, and delete invalid samples. The sample post-processing module, connected to the sample classification module, is used to deduplicatize the classified reference alarm samples and generate the final reference alarm sample set. The alarm analysis module, connected to the sample post-processing module, is used to extract the feature values ​​of the alarms to be analyzed, calculate the distance parameters weighted by the sample confidence level, and match the alarm categories to complete the intelligent hierarchical analysis. The resource addressing model storage module is used to store the three-tier cloud resource addressing model. The resource information acquisition module is connected to the alarm analysis module and the resource addressing model storage module, respectively. It is used to search and acquire full information of cloud resource management nodes layer by layer according to the priority of alarm categories and based on the cloud resource addressing model.

8. The system of the intelligent judgment method for cloud resource alarms according to claim 7, characterized in that, The resource information acquisition module includes: The first identification unit is a resource segment identifier used to identify cloud resources. The second identification unit is the regional deployment code used to identify cloud resources; The third identification unit is used to identify the unique instance code of cloud resources, and the code is split into segments and hashed modulo 2048 to obtain the hash value; The matching unit is connected to three identification units and is used to search layer by layer in the cloud resource addressing model based on the identification information to obtain full information of cloud resource management nodes. It also supports caching and real-time updating of addressing results.

9. The system of the intelligent judgment method for cloud resource alarms according to claim 7, characterized in that, It also includes an alarm feature generation module, which is connected to the historical alarm database and the alarm analysis module, respectively. This module generates standardized alarm feature information for historical alarm entries and alarms to be analyzed based on the feature value calculation formula of claim 2, and supports weighting coefficients. Custom configuration.

10. The system of the intelligent judgment method for cloud resource alarms according to claim 7, characterized in that, It also includes an addressing model generation module, which is connected to the historical alarm database and the resource addressing model storage module, respectively. It is used to generate a three-layer cloud resource addressing model based on the full information of cloud resources provided by the cloud resource monitoring platform and store it in the resource addressing model storage module. It also supports dynamic expansion of the addressing model and node updates when cloud resources are scaled up or down.

Images