Alarm information graph construction method and device, computer device, readable storage medium and program product

Abstract

The application relates to a method and device for constructing an alarm information graph, computer equipment, a readable storage medium and a program product, and relates to the technical field of knowledge graphs; the method comprises the following steps: determining the semantic similarity between a plurality of alarm information generated in the system running process; the alarm information comprises fault information of at least one target node element in the system; obtaining the network topology relationship between each node element in the system and the physical position setting relationship of each physical hardware of each node element in the system; based on the semantic similarity, the network topology relationship and the physical position setting relationship, an alarm information graph taking each alarm information as a graph node is constructed; in this way, the correlation between the plurality of alarm information and the closeness of the correlation are clarified, which is beneficial to the operation and maintenance personnel to quickly locate a plurality of alarm information caused by the same fault problem, so that the fault positioning accuracy is improved, and the number of faults to be processed is reduced.

Description

Technical Field

[0001] This application relates to the field of knowledge graph technology, and in particular to a method, apparatus, computer device, readable storage medium, and program product for constructing an alarm information graph. Background Technology

[0002] During the operation of large-scale physical machine or virtual machine clusters, it is necessary to monitor abnormal alarm information generated during system operation and promptly notify operation and maintenance personnel of alarm issues that need to be addressed to ensure the healthy and stable operation of the system.

[0003] However, it is difficult to accurately filter out alarms with correlations from a large number of alarms. The alarm analysis methods in related technologies only apply some simple algorithms or rules to classify alarms, and there is still room for improvement in the quality and quantity of alarms. Summary of the Invention

[0004] Therefore, it is necessary to provide a method, apparatus, computer equipment, computer-readable storage medium, and computer program product for constructing an alarm information map that can improve the quality of abnormal alarms during system operation, in order to address the above-mentioned technical problems.

[0005] Firstly, this application provides a method for constructing an alarm information graph, the method comprising:

[0006] For multiple alarm messages generated during system operation, the semantic similarity between the multiple alarm messages is determined; the alarm messages include fault information of at least one target node component in the system;

[0007] Obtain the network topology relationship between each node element in the system, as well as the physical location settings of each node element in the system's physical hardware.

[0008] Based on the semantic similarity, the network topology, and the physical location settings, an alarm information graph is constructed with each alarm message as a graph node.

[0009] In this embodiment, firstly, multiple alarm messages generated during system operation are acquired. Each alarm message includes fault information of at least one target node component involved in the system operation. Then, the semantic similarity between the multiple alarm messages is calculated. Next, the network topology relationship between each node component in the system is acquired to understand the network communication connection relationship between each node component in the system. The physical location settings of each node component in the system's physical hardware are also acquired to understand the configuration of each node component in the system's physical hardware. Finally, based on the semantic similarity between the multiple alarm messages, the network topology relationship between each node component, and the physical location settings, an alarm information graph is constructed, where each graph node represents a specific alarm message. The alarm information graph constructed in this way clarifies the correlation and tightness of the relationships between multiple alarm messages, thereby helping maintenance personnel quickly locate multiple alarm messages caused by the same fault problem. This reduces the number of fault problems that need to be handled, improves the accuracy of fault location, and allows maintenance personnel to handle more fault problems within a limited time.

[0010] In one embodiment, constructing an alarm information graph with each alarm message as a graph node based on the semantic similarity, the network topology, and the physical location settings includes:

[0011] Based on the network topology, obtain the topology values ​​between each of the target node components;

[0012] Based on the physical location settings, obtain the physical hardware corresponding to each target node element;

[0013] Based on the semantic similarity, the topology value corresponding to the target node element, and the physical hardware, an alarm information graph is constructed with each alarm information as a graph node.

[0014] In this embodiment, firstly, based on the network topology relationship between each node element in the system, the topology value between the target node elements included in the alarm information is obtained. Then, based on the physical location setting relationship between each node element in the system, the physical hardware corresponding to each target node element included in the alarm information is obtained. Finally, based on the semantic similarity between multiple alarm information, the topology value between each target node element, and the setting relationship of each target node element on multiple physical hardware, an alarm information graph with each alarm information as a graph node is constructed. The alarm information graph constructed in this way can clearly show the correlation between multiple alarm information and highlight the physical location setting of the target node element that caused the alarm information on each physical hardware in the system. This is beneficial for relevant operation and maintenance personnel to quickly and accurately locate multiple alarm information caused by the same fault problem, thereby reducing the number of fault problems that need to be handled and improving the accuracy and reliability of fault location.

[0015] In one embodiment, the method further includes:

[0016] Obtain each node element and each physical hardware in the system, and determine the configuration relationship between each node element and each physical hardware;

[0017] Based on the configuration relationship between each node element and each physical hardware, the physical location configuration relationship between the node elements is constructed.

[0018] In this embodiment, the system first acquires all node components and the physical hardware used to install them, and determines the installation and configuration relationships between each node component and the physical hardware, thereby identifying which node components are specifically installed in each physical hardware. Then, based on the installation and configuration relationships between each node component and the physical hardware, the physical location configuration relationships between all node components in the system are constructed. This provides strong support for the subsequent construction of an alarm information map, enabling the alarm information map to highlight the physical location configuration of the target node component causing the alarm in each physical hardware in the system. This helps relevant maintenance personnel quickly locate multiple alarm messages caused by related faults in the same physical hardware, thereby reducing the number of faults that need to be handled.

[0019] In one embodiment, the method further includes:

[0020] Obtain the node components in the system, as well as the communication connections between them;

[0021] Based on the node elements and the communication connection relationships, a network topology relationship is constructed between the node elements.

[0022] In this embodiment, the system first acquires all node components and their communication connections, thus revealing the communication connections between any two node components. Then, based on these node components and their communication connections, the network topology of all node components in the system is constructed. This provides strong support for the subsequent construction of an alarm information graph, enabling the graph to highlight the target node component causing the alarm and its specific communication connections within the network topology. This facilitates maintenance personnel in quickly locating multiple alarm messages caused by faults associated with the same target node component, thereby identifying multiple alarm messages caused by the same fault and reducing the number of faults requiring processing.

[0023] In one embodiment, determining the semantic similarity among the plurality of alarm messages includes:

[0024] The semantic similarity between multiple alarm messages is determined based on a preset semantic similarity algorithm; wherein, the preset semantic similarity algorithm is determined based on an alarm word segmentation library constructed from historical alarm information.

[0025] In this embodiment, a preset semantic similarity algorithm is first obtained based on the alarm word segmentation library of the system, wherein the alarm word segmentation library is constructed based on at least part of the alarm information of the system; then, the semantic similarity between multiple alarm information is calculated based on the preset semantic similarity algorithm; this provides strong support for the subsequent construction of the alarm information graph, so that the correlation between each alarm information can be accurately known during the construction of the alarm information graph, so as to determine the specific location of each alarm information in the alarm information graph.

[0026] In one embodiment, the method further includes:

[0027] Acquire multiple historical alarm messages generated during system operation;

[0028] The historical alarm information is preprocessed, and a corresponding alarm word segmentation library is constructed.

[0029] Based on the keywords and key terms in the alarm word segmentation library, a preset semantic similarity algorithm associated with the system is determined.

[0030] In this embodiment, multiple historical alarm messages generated by the relevant system during its historical operation can be obtained first. Then, each historical alarm message is preprocessed, and an alarm word segmentation library for the system is constructed based on the preprocessed historical alarm messages. Subsequently, based on the keywords and key data included in the alarm word segmentation library, a preset semantic similarity algorithm suitable for the system can be determined to improve the adaptability of the determined preset semantic similarity algorithm to the system, thereby improving the accuracy of the semantic similarity between multiple alarm messages determined based on the preset semantic similarity algorithm.

[0031] Secondly, this application also provides an apparatus for constructing an alarm information graph, the apparatus comprising:

[0032] A semantic similarity determination module is used to determine the semantic similarity between multiple alarm messages generated during system operation; the alarm messages include fault information of at least one target node component in the system;

[0033] The node relationship determination module is used to obtain the network topology relationship between each node element in the system, as well as the physical location setting relationship of each node element in the system's physical hardware.

[0034] The graph construction module is used to construct an alarm information graph with each alarm information as a graph node based on the semantic similarity, the network topology relationship, and the physical location setting relationship.

[0035] Thirdly, this application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to perform the following steps:

[0036] For multiple alarm messages generated during system operation, the semantic similarity between the multiple alarm messages is determined; the alarm messages include fault information of at least one target node component in the system;

[0037] Obtain the network topology relationship between each node element in the system, as well as the physical location settings of each node element in the system's physical hardware.

[0038] Based on the semantic similarity, the network topology, and the physical location settings, an alarm information graph is constructed with each alarm message as a graph node.

[0039] Fourthly, this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, performs the following steps:

[0040] For multiple alarm messages generated during system operation, the semantic similarity between the multiple alarm messages is determined; the alarm messages include fault information of at least one target node component in the system;

[0041] Obtain the network topology relationship between each node element in the system, as well as the physical location settings of each node element in the system's physical hardware.

[0042] Based on the semantic similarity, the network topology, and the physical location settings, an alarm information graph is constructed with each alarm message as a graph node.

[0043] Fifthly, this application also provides a computer program product, including a computer program that, when executed by a processor, performs the following steps:

[0044] For multiple alarm messages generated during system operation, the semantic similarity between the multiple alarm messages is determined; the alarm messages include fault information of at least one target node component in the system;

[0045] Obtain the network topology relationship between each node element in the system, as well as the physical location settings of each node element in the system's physical hardware.

[0046] Based on the semantic similarity, the network topology, and the physical location settings, an alarm information graph is constructed with each alarm message as a graph node.

[0047] In the alarm information graph construction method, apparatus, computer device, computer-readable storage medium, and computer program product provided in this application, the alarm information graph construction method acquires multiple alarm messages generated during system operation, each alarm message including fault information of at least one target node component involved in system operation, and then calculates the semantic similarity between the multiple alarm messages. Next, it acquires the network topology relationship between each node component in the system to understand the network communication connection relationship between each node component, and acquires the physical location setting relationship of each node component in the system's physical hardware to understand the setting status of each node component in the system's physical hardware. Finally, based on the semantic similarity between the multiple alarm messages, the network topology relationship between each node component, and the physical location setting relationship, an alarm information graph is constructed, and each graph node in the alarm information graph represents a specific alarm message. The alarm information map constructed in this way can clearly show the correlation between multiple alarm information and the tightness of the correlation. This helps relevant operation and maintenance personnel to quickly locate multiple alarm information caused by the same fault, thereby reducing the number of faults that need to be handled and improving the accuracy of fault location, so that operation and maintenance personnel can handle more faults in a limited time. Attached Figure Description

[0048] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the drawings used in the description of the embodiments of this application or related technologies will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0049] Figure 1 This is an application environment diagram of a method for constructing an alarm information graph in one embodiment;

[0050] Figure 2 This is a flowchart illustrating a method for constructing an alarm information graph in one embodiment;

[0051] Figure 3 This is a flowchart illustrating the process of constructing an alarm information graph in one embodiment;

[0052] Figure 4 This is a structural block diagram of an alarm information graph construction device in one embodiment;

[0053] Figure 5 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0054] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0055] In related technologies, traditional alarm platforms often lack intelligent analysis capabilities, resulting in a large number of irrelevant alarms generated during the operation of large-scale physical or virtual machine clusters. This makes it difficult for operations and maintenance personnel to effectively process all the information. Furthermore, the lack of efficient correlation algorithms or intelligent analysis engines in these alarm systems prevents them from accurately determining the causal relationships and correlations between multiple alarms, making it difficult for operations and maintenance personnel to accurately assess the severity and priority of problems. Therefore, there is still room for improvement in both the quality and quantity of alarms.

[0056] In view of this, in order to improve the quality and quantity of abnormal alarms during system operation, this application provides a method for constructing an alarm information graph. First, for multiple alarm messages generated during system operation, the semantic similarity between the multiple alarm messages is determined. The alarm messages include fault information of at least one target node component in the system. Then, the network topology relationship between each node component in the system, as well as the physical location settings of each node component within the system's physical hardware, are obtained. Finally, based on semantic similarity, network topology relationship, and physical location settings, an alarm information graph is constructed with each alarm message as a graph node. In the process of constructing this alarm information graph, the semantic similarity between alarm messages, as well as the network topology relationship and physical location settings between system node components, can be combined to clarify the correlation and tightness between multiple alarm messages. The constructed alarm information graph helps relevant operation and maintenance personnel quickly locate multiple alarm messages caused by the same fault problem, thereby reducing the number of fault problems that need to be handled and improving the accuracy of fault problem location.

[0057] The alarm information graph construction method provided in this application embodiment can be applied to, for example, Figure 1The application environment is shown. Terminal 102 communicates with server 104 via a network. A data storage system can store the data that server 104 needs to process. The data storage system can be integrated onto server 104 or placed on the cloud or other network servers. The data storage system can at least store multiple alarm messages generated during system operation, the network topology relationships between nodes in the system, and the physical location settings of each node in the system's physical hardware. Terminal 102 can be, but is not limited to, various personal computers, laptops, smartphones, tablets, IoT devices, and portable wearable devices. IoT devices can be smart speakers, smart TVs, smart air conditioners, smart in-vehicle devices, projection devices, etc. Portable wearable devices can be smartwatches, smart bracelets, head-mounted devices, etc. Head-mounted devices can be virtual reality (VR) devices, augmented reality (AR) devices, smart glasses, etc. Server 104 can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing cloud computing services.

[0058] In one exemplary embodiment, such as Figure 2 As shown, a method for constructing an alarm information graph is provided, which can be applied to... Figure 1 Taking server 104 as an example, the explanation includes steps 201 to 203. It should be noted that this application does not limit the alarm information graph construction method provided to only be applied to servers; it can also be applied to terminals.

[0059] Step 201: For multiple alarm messages generated during system operation, determine the semantic similarity between the multiple alarm messages; the alarm messages include fault information of at least one target node component in the system.

[0060] The system can consist of a physical machine cluster or a virtual machine cluster. A physical machine cluster can include multiple physical servers connected via a network, forming a collection that can jointly undertake computing, storage, and network services. A virtual machine cluster can include multiple virtual machine instances created through virtualization technology. These virtual machine instances can work collaboratively to provide services and resources.

[0061] Alarm information can be, for example, a descriptive text indicating that a node in the system has failed. Taking a physical machine cluster as an example, nodes in the system can be, for example, the physical servers themselves, the modules within the physical servers, or the components within the physical servers; this application does not specifically limit this. The level of detail regarding nodes can be determined based on the required level of detail for the alarm information.

[0062] The node elements included in the alarm information are the target node elements, which are some of the node elements included in the system. They can also be described as node elements related to the fault situation, or node elements that have themselves failed.

[0063] An alarm message may include fault information for one target node element or fault information for multiple target node elements; that is, this application does not specifically limit the number of target node elements involved in an alarm message.

[0064] Semantic similarity refers to the degree of semantic similarity between two alarm messages, and can be used to determine the closeness of the association between the two alarm messages.

[0065] In this embodiment, multiple alarm messages generated during system operation can be obtained first. Each alarm message includes fault information of at least one target node component involved in the system operation. Then, the semantic similarity between the multiple alarm messages can be calculated to determine the degree of similarity in semantics between the multiple alarm messages.

[0066] Two alarm messages with a high degree of semantic similarity may be caused by the same specific fault. For operations and maintenance personnel, resolving this fault will simultaneously resolve both alarms, rather than requiring separate solutions for each alarm and multiple faults. Therefore, this application, by calculating the degree of semantic similarity among multiple alarm messages, helps identify at least two strongly related alarm messages, thereby reducing the number of faults that operations and maintenance personnel need to handle in actual problem-solving.

[0067] Step 202: Obtain the network topology relationship between each node element in the system, as well as the physical location settings of each node element in the system's physical hardware.

[0068] The network topology relationship is used to characterize the communication connection relationship between each node element in the system, and the physical location setting relationship is used to characterize the location setting of each node element in each physical hardware in the system. This application does not limit the representation method of the network topology relationship and the physical location setting relationship, such as graph method, table method, mapping graph method, etc.

[0069] In this embodiment, the network topology relationship between each node element in the system is obtained to understand the network communication connection relationship between each node element in the system, and the physical location setting relationship of each node element in the system in each physical hardware is obtained to understand the setting of each node element in the system in each physical hardware.

[0070] In a system where two nodes connected via the same network communication link may generate separate alarm messages if that link fails. However, for maintenance personnel, resolving the network communication link failure resolves both alarm messages simultaneously, rather than requiring separate solutions for each alarm message. Therefore, this application, by acquiring the network topology relationships between nodes in the system, helps identify at least two closely related alarm messages, thereby reducing the number of faults maintenance personnel need to address.

[0071] Correspondingly, when multiple node components are installed in the same rack, and the rack is damaged for some reason, these node components may generate multiple corresponding alarm messages. However, for the actual handling process of maintenance personnel, solving the problem of rack damage can simultaneously resolve multiple alarm messages, rather than requiring the resolution of multiple faults for each alarm message. Therefore, this application, by obtaining the physical location settings of each node component in the system across different physical hardware, helps to identify at least two alarm messages with closely related physical locations, thereby reducing the number of faults that maintenance personnel need to handle in actual problem-solving.

[0072] Step 203: Based on semantic similarity, network topology, and physical location settings, construct an alarm information graph with each alarm message as a graph node.

[0073] The alarm information graph is used to represent the relationships between multiple alarm messages.

[0074] In this embodiment, based on the semantic similarity between multiple alarm messages, the network topology relationship between each node component in the system, and the physical location setting relationship, an alarm information graph is constructed with each alarm message as a graph node, so as to display the correlation relationship between each alarm message based on the alarm information graph.

[0075] It should be emphasized that each node in the alarm information graph constructed in this application is an alarm information, which includes the fault information of the specific target node component. Therefore, through the alarm information graph constructed in this application, the correlation between multiple alarm information and the tightness of the correlation can be known. It is also possible to obtain the specific target node component involved in each alarm information. In addition, the configuration relationship of the target node component in the physical hardware and the network communication relationship between the target node components can be further reflected in the alarm information graph.

[0076] In this embodiment, the alarm information map constructed, which is associated with multiple alarm information generated during system operation, can clearly clarify the correlation between multiple alarm information and the tightness of the correlation. It can also highlight the physical location of the target node component that caused the alarm information in each physical hardware in the system, and the network connection relationship between the target node component that caused the alarm information. This helps relevant operation and maintenance personnel to quickly locate multiple alarm information caused by the same fault, thereby reducing the number of faults that need to be handled, improving the accuracy of fault location, and enabling operation and maintenance personnel to handle more faults in a limited time.

[0077] In one embodiment, step 203, which involves constructing an alarm information graph with each alarm message as a graph node based on semantic similarity, network topology, and physical location, can be performed based on the following: Figure 3 Steps 301-303 shown are implemented, wherein:

[0078] Step 301: Based on the network topology relationship, obtain the topology values ​​between each target node element.

[0079] The topology value can be determined based on the connection relationship between two target node components. For example, the topology value of two directly connected target node components is different from that of two indirectly connected target node components. Target node components with the smallest topology value have a direct connection relationship, while those with indirect connections have a larger topology value. Alarm information from target node components with similar topology values ​​that appear within a similar time period may have a high correlation.

[0080] In this embodiment, the topology values ​​between multiple target node elements can be obtained based on the network topology relationship formed by multiple node elements in the system.

[0081] Step 302: Based on the physical location settings, obtain the physical hardware corresponding to each target node component.

[0082] Taking a physical server cluster as an example, the relevant physical hardware could be, for instance, the server racks, the server room, the motherboards for multiple nodes within the physical servers, or the carriers for those nodes. It's clear that "physical hardware" here doesn't just refer to hardware components; it can also refer to physical infrastructure, such as the aforementioned server room.

[0083] In this embodiment, the physical hardware corresponding to each target node element included in the alarm information can be obtained based on the physical location settings between each node element in the system; including hardware components and hardware facilities.

[0084] Step 303: Based on semantic similarity, the topology value corresponding to the target node element and physical hardware, construct an alarm information graph with each alarm information as a graph node.

[0085] In this embodiment, an alarm information graph is constructed based on the semantic similarity between multiple alarm information, the topological values ​​between each target node element, and the setting relationship of each target node element on multiple physical hardware. Each alarm information serves as a graph node.

[0086] The alarm information map constructed by the method provided in this embodiment can clearly display the semantic relationship between multiple alarm messages, and can highlight the physical location of the target node component that caused the alarm message in each physical hardware in the system, as well as the tightness of the related communication connection. This helps relevant operation and maintenance personnel to quickly and accurately locate multiple alarm messages caused by the same fault, such as multiple alarm messages caused by the same physical hardware fault or multiple alarm messages caused by the same communication connection link fault, thereby reducing the number of faults that need to be handled and improving the accuracy and reliability of fault location.

[0087] Furthermore, for step 203 provided in this application, this application also provides an optional implementation method as follows: based on network topology relationships, obtain the topology values ​​between each target node element; based on physical location settings, obtain the physical hardware corresponding to each target node element; based on semantic similarity, the topology values ​​corresponding to the target node elements, and the physical hardware, merge at least some of the alarm information in the multiple alarm information to obtain multiple target alarm information after merging, and then construct an alarm information graph with each target alarm information as a graph node.

[0088] The merging process can be, for example, merging multiple alarm messages related to a target node component located on the same physical hardware to obtain a single target alarm message. This allows for the merging of alarm messages that are highly correlated and may be caused by the same fault, thereby reducing the number of nodes in the final alarm message graph and further improving the efficiency of relevant maintenance personnel in locating and resolving faults.

[0089] In one embodiment, the alarm information map construction method provided in this application also provides a way to construct the physical location setting relationship between node elements, including: acquiring each node element and each physical hardware in the system, determining the setting relationship between each node element and each physical hardware; and constructing the physical location setting relationship between node elements based on the setting relationship between each node element and each physical hardware.

[0090] In this embodiment, the system first acquires all node components and the physical hardware used to install them, and determines the installation and configuration relationships between each node component and the physical hardware, thereby identifying which node components are specifically installed in each physical hardware. Then, based on the installation and configuration relationships between each node component and the physical hardware, the physical location configuration relationships between all node components in the system are constructed. This provides strong support for the subsequent construction of an alarm information map, enabling the alarm information map to highlight the physical location configuration of the target node component causing the alarm in each physical hardware in the system. This helps relevant maintenance personnel quickly locate multiple alarm messages caused by related faults in the same physical hardware, thereby reducing the number of faults that need to be handled.

[0091] In one embodiment, the alarm information map construction method provided in this application also provides a way to construct the network topology relationship between node elements, including: obtaining each node element in the system and the communication connection relationship between each node element; and constructing the network topology relationship between node elements based on the node elements and the communication connection relationship.

[0092] In this embodiment, the system first acquires all node components and their communication connections, thus revealing the communication connections between any two node components. Then, based on these node components and their communication connections, the network topology of all node components in the system is constructed. This provides strong support for the subsequent construction of an alarm information graph, enabling the graph to highlight the target node component causing the alarm and its specific communication connections within the network topology. This facilitates maintenance personnel in quickly locating multiple alarm messages caused by faults associated with the same target node component, thereby identifying multiple alarm messages caused by the same fault and reducing the number of faults requiring processing.

[0093] In one embodiment, the step 201 of determining the semantic similarity between multiple alarm messages can be specifically performed as follows: determining the semantic similarity between multiple alarm messages based on a preset semantic similarity algorithm; wherein, the preset semantic similarity algorithm is determined based on an alarm word segmentation library constructed from historical alarm information.

[0094] In this embodiment, a preset semantic similarity algorithm is first obtained based on the alarm word segmentation library of the system, wherein the alarm word segmentation library is constructed based on at least part of the alarm information of the system; then, the semantic similarity between multiple alarm information is calculated based on the preset semantic similarity algorithm; this provides strong support for the subsequent construction of the alarm information graph, so that the correlation between each alarm information can be accurately known during the construction of the alarm information graph, so as to determine the specific location of each alarm information in the alarm information graph.

[0095] In one embodiment, the alarm information graph construction method provided in this application also provides a method for determining a preset semantic similarity algorithm for the system, including steps 204-206, wherein:

[0096] Step 204: Obtain multiple historical alarm messages generated during system operation.

[0097] Among them, the historical alarm information refers to the alarm information generated by the system provided in this application during its historical operation.

[0098] In this embodiment, multiple historical alarm messages generated by the relevant system during its historical operation can be obtained first.

[0099] Step 205: Preprocess multiple historical alarm messages and construct the corresponding alarm word segmentation library.

[0100] Preprocessing may include operations such as word segmentation and keyword extraction of the text of each historical alarm message.

[0101] The alarm word segmentation library includes important terms (key terms) and keywords from the text of multiple historical alarm messages.

[0102] In this embodiment, each historical alarm information is preprocessed, and the alarm word segmentation library of the system is constructed based on the preprocessed historical alarm information.

[0103] Step 206: Based on the keywords and key terms in the alarm word segmentation library, determine the preset semantic similarity algorithm associated with the system.

[0104] Keywords include component names related to node components in the system from the text of historical alarm information, and may also include fault type names related to node components in the system from the text of historical alarm information. Key terms are, for example, some technical terms included in the text of historical alarm information, and these technical terms are highly related to component names and / or fault type names.

[0105] In this embodiment, a preset semantic similarity algorithm suitable for the system can be determined based on the keywords and key data included in the alarm word segmentation library.

[0106] In this embodiment, by using the alarm word segmentation library constructed after preprocessing multiple historical alarm information generated during system operation, and obtaining relevant keywords and key data, the method of determining the preset semantic similarity algorithm associated with the system can improve the adaptability of the determined preset semantic similarity algorithm and the system, thereby improving the accuracy of the semantic similarity between multiple alarm information determined based on the preset semantic similarity algorithm.

[0107] The alarm information graph construction method provided in this application is equivalent to analyzing the correlation between multiple alarm information to obtain an alarm information graph associated with multiple alarm information. This facilitates relevant operation and maintenance personnel to classify or merge alarm information with causal relationships, thereby reducing the number of alarm information and improving the quality of alarm information. This helps alleviate the fault analysis pressure on operation and maintenance personnel, improves the accuracy of problem localization, and allows more problems to be handled in a limited time. In addition, in the embodiments provided in this application, several of the multiple alarm information can be merged to obtain multiple target alarm information, and then an alarm information graph can be constructed based on the target alarm information as graph nodes. In the process of obtaining the alarm information graph in this way, alarm information with causal relationships can be classified or merged, reducing the number of alarm information and improving the quality of alarm information; alleviating the analysis pressure on operation and maintenance personnel, improving the accuracy of problem localization, and enabling relevant operation and maintenance personnel to handle more problems in a limited time.

[0108] In summary, the alarm information graph construction method provided in this application specifically includes the following four aspects, among which:

[0109] The first aspect involves establishing a word segmentation library for identical alarms based on historical alarms. This specifically includes analyzing historical alarm information using natural language processing (NLP) techniques. This involves segmenting the alarm text, extracting keywords, and constructing an alarm word segmentation library. This library contains important terms (key terms) and keywords from the alarm text, allowing for a better understanding of the potential similarities and connections between alarm messages with different expressions.

[0110] The second aspect involves defining the network topology relationships between different unit nodes. Specifically, at this stage, we focus on the network topology structure between different unit nodes. By explicitly defining the connection relationships between nodes (node ​​elements), we can calculate the topology value, which reflects the degree of direct connection between nodes. The node with the smallest topology value has a direct connection, while alarms from nodes with similar topology values ​​occurring within a similar timeframe may have a high correlation. This consideration of network topology relationships helps identify abnormal events in the system and establish correlations.

[0111] The third aspect involves defining the physical location relationships between different unit nodes. Specifically, to further improve the accuracy of association relationships, we introduce the definition of physical location relationships. By considering the physical location of nodes, such as being in the same rack or on the same host, we can identify physical location relationships with hardware connections. This relationship takes into account environmental alarms of nodes, helping to focus on nodes with similar hardware conditions, thereby improving the reliability of association relationships.

[0112] The fourth aspect involves analyzing the generated alarms in three dimensions: semantic similarity, network topology, and physical location. Specifically, this includes multi-dimensional analysis of the generated alarm information.

[0113] First, the semantic similarity between alarm messages is calculated using a semantic similarity algorithm analysis library.

[0114] Secondly, by combining network topology and physical location analysis, an alarm correlation diagram (alarm information map) is generated. This diagram visually illustrates the connections between alarm messages, helping operations and maintenance personnel quickly locate the root cause of problems within massive alarm data. This multi-dimensional analysis method provides a more comprehensive perspective on alarm correlation, making the analysis more accurate and reliable.

[0115] Clearly, the alarm information graph construction method provided in this application enables the organization of relationships among numerous system alarms. This allows operations and maintenance personnel to analyze problems more efficiently and find the root causes. Through comprehensive analysis across three dimensions—semantic similarity, network topology, and physical location—not only can the pressure on operations and maintenance personnel to handle a large number of alarms be reduced, but the accuracy of problem localization can also be improved, providing a more effective tool for system operations and maintenance.

[0116] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0117] Based on the same inventive concept, this application also provides an alarm information graph construction apparatus for implementing the alarm information graph construction method described above. The solution provided by this apparatus is similar to the implementation scheme described in the above method. Therefore, the specific limitations of one or more alarm information graph construction apparatus embodiments provided below can be found in the limitations of the alarm information graph construction method described above, and will not be repeated here.

[0118] In one exemplary embodiment, such as Figure 5 As shown, an alarm information graph construction device 400 is provided, including: a semantic similarity determination module 401, a node relationship determination module 402, and a graph construction module 403, wherein:

[0119] The semantic similarity determination module 401 is used to determine the semantic similarity between multiple alarm messages generated during system operation; the alarm messages include fault information of at least one target node component in the system;

[0120] The node relationship determination module 402 is used to obtain the network topology relationship between each node element in the system, as well as the physical location setting relationship of each node element in the system's physical hardware.

[0121] The graph construction module 403 is used to construct an alarm information graph with each alarm information as a graph node based on semantic similarity, network topology relationship and physical location setting relationship.

[0122] In one embodiment, the graph construction module 403 is used to construct an alarm information graph with each alarm information as a graph node based on semantic similarity, network topology relationship, and physical location setting relationship. Specifically, it is used to: obtain the topology value between each target node element based on the network topology relationship; obtain the physical hardware corresponding to each target node element based on the physical location setting relationship; and construct an alarm information graph with each alarm information as a graph node based on semantic similarity, the topology value corresponding to the target node element, and the physical hardware.

[0123] In one embodiment, the node relationship determination module 402 is further configured to: acquire each node element and each physical hardware in the system, determine the setting relationship between each node element and each physical hardware; and construct the physical location setting relationship between node elements based on the setting relationship between each node element and each physical hardware.

[0124] In one embodiment, the node relationship determination module 402 is further configured to: obtain each node element in the system and the communication connection relationship between each node element; and construct the network topology relationship between node elements based on the node elements and the communication connection relationship.

[0125] In one embodiment, the semantic similarity determination module 401 is used to determine the semantic similarity between multiple alarm messages, specifically: determining the semantic similarity between multiple alarm messages based on a preset semantic similarity algorithm; wherein, the preset semantic similarity algorithm is determined based on an alarm word segmentation library constructed from historical alarm information.

[0126] In one embodiment, the semantic similarity determination module 401 is further configured to: acquire multiple historical alarm messages generated during system operation; preprocess the multiple historical alarm messages and construct a corresponding alarm word segmentation library; and determine a preset semantic similarity algorithm associated with the system based on the keywords and key terms in the alarm word segmentation library.

[0127] Each module in the aforementioned alarm information graph construction device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can call and execute the operations corresponding to each module.

[0128] In one exemplary embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 5As shown, this computer device includes a processor, memory, input / output (I / O) interfaces, and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides the environment for the operating system and computer programs stored in the non-volatile storage media. The database stores multiple alarm messages generated during system operation, the network topology relationships between nodes in the system, and the physical location relationships of each node within the system's physical hardware. The I / O interfaces are used for information exchange between the processor and external devices. The communication interface is used for communication with external terminals via a network connection. When the computer program is executed by the processor, it implements a method for constructing an alarm information graph.

[0129] Those skilled in the art will understand that Figure 5 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0130] In one exemplary embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to perform the following steps:

[0131] For multiple alarm messages generated during system operation, determine the semantic similarity between the multiple alarm messages; the alarm messages include fault information of at least one target node component in the system;

[0132] Obtain the network topology relationship between each node element in the system, as well as the physical location settings of each node element in the system's physical hardware.

[0133] Based on semantic similarity, network topology, and physical location, an alarm information graph is constructed with each alarm message as a graph node.

[0134] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0135] Based on the network topology, obtain the topology values ​​between each target node element;

[0136] Based on the physical location settings, obtain the physical hardware corresponding to each target node component;

[0137] Based on semantic similarity, the topology value corresponding to the target node element, and physical hardware, an alarm information graph is constructed with each alarm information as a graph node.

[0138] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0139] Obtain the node components and physical hardware in the system, and determine the configuration relationships between the node components and physical hardware;

[0140] Based on the configuration relationships between each node element and each physical hardware, the physical location configuration relationships between node elements are constructed.

[0141] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0142] Obtain the node components in the system, as well as the communication connections between them;

[0143] Based on node components and communication connections, the network topology between node components is constructed.

[0144] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0145] The semantic similarity between multiple alarm messages is determined based on a preset semantic similarity algorithm; the preset semantic similarity algorithm is determined based on an alarm word segmentation library constructed from historical alarm information.

[0146] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0147] Acquire multiple historical alarm messages generated during system operation;

[0148] Multiple historical alarm messages are preprocessed, and corresponding alarm word segmentation libraries are constructed.

[0149] Based on the keywords and key terms in the alarm word segmentation library, a preset semantic similarity algorithm is determined to be associated with the system.

[0150] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, the computer program performing the following steps when executed by a processor:

[0151] For multiple alarm messages generated during system operation, determine the semantic similarity between the multiple alarm messages; the alarm messages include fault information of at least one target node component in the system;

[0152] Obtain the network topology relationship between each node element in the system, as well as the physical location settings of each node element in the system's physical hardware.

[0153] Based on semantic similarity, network topology, and physical location, an alarm information graph is constructed with each alarm message as a graph node.

[0154] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0155] Based on the network topology, obtain the topology values ​​between each target node element;

[0156] Based on the physical location settings, obtain the physical hardware corresponding to each target node component;

[0157] Based on semantic similarity, the topology value corresponding to the target node element, and physical hardware, an alarm information graph is constructed with each alarm information as a graph node.

[0158] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0159] Obtain the node components and physical hardware in the system, and determine the configuration relationships between the node components and physical hardware;

[0160] Based on the configuration relationships between each node element and each physical hardware, the physical location configuration relationships between node elements are constructed.

[0161] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0162] Obtain the node components in the system, as well as the communication connections between them;

[0163] Based on node components and communication connections, the network topology between node components is constructed.

[0164] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0165] The semantic similarity between multiple alarm messages is determined based on a preset semantic similarity algorithm; the preset semantic similarity algorithm is determined based on an alarm word segmentation library constructed from historical alarm information.

[0166] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0167] Acquire multiple historical alarm messages generated during system operation;

[0168] Multiple historical alarm messages are preprocessed, and corresponding alarm word segmentation libraries are constructed.

[0169] Based on the keywords and key terms in the alarm word segmentation library, a preset semantic similarity algorithm is determined to be associated with the system.

[0170] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, performs the following steps:

[0171] For multiple alarm messages generated during system operation, determine the semantic similarity between the multiple alarm messages; the alarm messages include fault information of at least one target node component in the system;

[0172] Obtain the network topology relationship between each node element in the system, as well as the physical location settings of each node element in the system's physical hardware.

[0173] Based on semantic similarity, network topology, and physical location, an alarm information graph is constructed with each alarm message as a graph node.

[0174] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0175] Based on the network topology, obtain the topology values ​​between each target node element;

[0176] Based on the physical location settings, obtain the physical hardware corresponding to each target node component;

[0177] Based on semantic similarity, the topology value corresponding to the target node element, and physical hardware, an alarm information graph is constructed with each alarm information as a graph node.

[0178] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0179] Obtain the node components and physical hardware in the system, and determine the configuration relationships between the node components and physical hardware;

[0180] Based on the configuration relationships between each node element and each physical hardware, the physical location configuration relationships between node elements are constructed.

[0181] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0182] Obtain the node components in the system, as well as the communication connections between them;

[0183] Based on node components and communication connections, the network topology between node components is constructed.

[0184] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0185] The semantic similarity between multiple alarm messages is determined based on a preset semantic similarity algorithm; the preset semantic similarity algorithm is determined based on an alarm word segmentation library constructed from historical alarm information.

[0186] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0187] Acquire multiple historical alarm messages generated during system operation;

[0188] Multiple historical alarm messages are preprocessed, and corresponding alarm word segmentation libraries are constructed.

[0189] Based on the keywords and key terms in the alarm word segmentation library, a preset semantic similarity algorithm is determined to be associated with the system.

[0190] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0191] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, artificial intelligence (AI) processors, etc., and are not limited to these.

[0192] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0193] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A method for constructing an alarm information graph, characterized in that, The method includes: For multiple alarm messages generated during system operation, the semantic similarity between the multiple alarm messages is determined; the alarm messages include fault information of at least one target node component in the system; Obtain the network topology relationship between each node element in the system, as well as the physical location settings of each node element in the system's physical hardware. Based on the semantic similarity, the network topology, and the physical location settings, an alarm information graph is constructed with each alarm message as a graph node.

2. The method according to claim 1, characterized in that, The construction of an alarm information graph with each alarm message as a graph node, based on the semantic similarity, the network topology, and the physical location settings, includes: Based on the network topology, obtain the topology values ​​between each of the target node components; Based on the physical location settings, obtain the physical hardware corresponding to each target node element; Based on the semantic similarity, the topology value corresponding to the target node element, and the physical hardware, an alarm information graph is constructed with each alarm information as a graph node.

3. The method according to claim 1, characterized in that, The method further includes: Obtain each node element and each physical hardware in the system, and determine the configuration relationship between each node element and each physical hardware; Based on the configuration relationship between each node element and each physical hardware, the physical location configuration relationship between the node elements is constructed.

4. The method according to claim 1, characterized in that, The method further includes: Obtain the node components in the system, as well as the communication connections between them; Based on the node elements and the communication connection relationships, a network topology relationship is constructed between the node elements.

5. The method according to any one of claims 1-4, characterized in that, Determining the semantic similarity between multiple alarm messages includes: The semantic similarity between multiple alarm messages is determined based on a preset semantic similarity algorithm; wherein, the preset semantic similarity algorithm is determined based on an alarm word segmentation library constructed from historical alarm information.

6. The method according to claim 5, characterized in that, The method further includes: Acquire multiple historical alarm messages generated during system operation; The historical alarm information is preprocessed, and a corresponding alarm word segmentation library is constructed. Based on the keywords and key terms in the alarm word segmentation library, a preset semantic similarity algorithm is determined to be associated with the system.

7. An apparatus for constructing an alarm information graph, characterized in that, The device includes: A semantic similarity determination module is used to determine the semantic similarity between multiple alarm messages generated during system operation; the alarm messages include fault information of at least one target node component in the system; The node relationship determination module is used to obtain the network topology relationship between each node element in the system, as well as the physical location setting relationship of each node element in the system's physical hardware. The graph construction module is used to construct an alarm information graph with each alarm information as a graph node based on the semantic similarity, the network topology relationship, and the physical location setting relationship.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

Images