Model identification processing method and system for log alarm data parsing processing

Abstract

The application provides a model identification processing method and system for log alarm data analysis processing, belonging to the technical field of data analysis, specifically comprising: determining the deviation degree of the identification analysis processing result of the fault type under the alarm signal type of different false alarm risk types in different alarm events by using an alarm analysis processing method, combining the false alarm risk type of the alarm signal type, determining the update strategy of the risk signal type in the alarm signal type, and identifying the alarm signal of the risk signal type in all alarm events, excluding the false alarm signal, determining the update processing result of the risk signal type according to the update strategy of the risk signal type, and combining the update processing result of the risk signal type in different alarm events to determine the update identification processing method of the model, thereby ensuring the identification reliability of the fault event.

Description

Technical Field

[0001] This invention belongs to the field of data analysis technology, and in particular relates to a model recognition processing method and system for parsing and processing log alarm data. Background Technology

[0002] In large-scale distributed systems, various servers, middleware, databases, containers, and applications continuously generate massive amounts of log data, including a large number of alerts. These alerts originate from different system components, use different log formats, employ different alert level definitions, and are distributed across different collection nodes. Operations personnel need to quickly identify genuine fault alerts from these massive, heterogeneous logs and determine their severity, scope of impact, and root cause.

[0003] Existing technical solutions employ unsupervised learning (such as isolated forests and autoencoders) or supervised learning (such as random forests and gradient boosting trees) for log anomaly detection and classification. While these solutions can discover abnormal patterns in logs and improve the reliability of log anomaly identification and processing, they suffer from the following technical problems: When parsing and analyzing alarm data, some alarm signal types may have a high risk of false alarms, which may make it difficult for the model to meet the requirements for identifying fault types. Therefore, it is an urgent technical problem to solve how to determine the model identification and processing methods for different fault events based on the risk of false alarms, as well as the identification and processing methods after model update processing, so as to improve the identification accuracy of fault event parsing and processing results.

[0004] Specifically, this application provides a model recognition processing method and system for parsing and processing log alarm data. Summary of the Invention

[0005] A model identification processing method for parsing and processing log alarm data, specifically including: S1 uses the parsing results of log alarm data to determine false alarm data under different alarm signal types, determines the false alarm risk type of the alarm signal type based on the false alarm data, and determines the alarm analysis and processing method of the model in alarm events based on the false alarm risk type of different alarm signal types and alarm event data in different dates. S2 uses the alarm analysis and processing method to determine the degree of deviation of the fault type identification and analysis processing results under different false alarm risk types of alarm signal types in different alarm events, and determines the update strategy of the risk signal type in the alarm signal type in combination with the false alarm risk type of the alarm signal type, and identifies and processes the alarm signal of the risk signal type in all alarm events, thereby performing false alarm signal elimination processing. S3 determines the update processing result of the risk signal type based on the update strategy of the risk signal type, and determines the update identification processing method of the model by combining the update processing results of the risk signal type in different alarm events.

[0006] The beneficial effects of this invention are as follows: By using false alarm risk types for different alarm signal types and alarm event data from different dates, the model's alarm analysis and processing methods in alarm events are determined. This enables the assessment of the impact of false alarms when different alarm signal types occur based on alarm event data and the false alarm risk of different alarm signal types. Based on the impact of false alarms when different alarm signal types occur, the model's alarm analysis and processing methods in alarm events are determined. This reduces the difficulty of parsing and processing, and also lays the foundation for the reliable identification of interference risks for different alarm signal types.

[0007] By using the risk signal type update strategy and the update processing results of risk signal types for different alarm events, the risk of delay in identifying fault causes due to the exclusion of risk signal types is determined during the current alarm event identification and processing. Based on this risk of delay in identifying fault causes due to the exclusion of risk signal types during the current alarm event identification and processing, the model update identification and processing method is determined. This enables dynamic updating of the model's reliability in identifying interference risks in different alarm signal types, thus laying the foundation for using the reliability of interference risk identification to dynamically update risk signal types and improve the efficiency of alarm event identification and processing.

[0008] Furthermore, the parsing results of the log alarm data are determined based on the monitoring data of the log's operation data.

[0009] Furthermore, the false alarm data under the alarm signal type includes the number of false alarm periods under the alarm signal type.

[0010] Furthermore, the false alarm risk type of the alarm signal type is determined based on the preset risk type corresponding to the number of false alarm time periods under the alarm signal type.

[0011] Furthermore, the false alarm risk types include a first-class risk type, a second-class risk type, and a third-class risk type, wherein the first-class risk type is greater than the second-class risk type, the second-class risk type is greater than the third-class risk type, and the more false alarm periods there are, the more severe the false alarm risk type is.

[0012] Furthermore, the method for determining the alarm analysis and processing method in the alarm event using the model is as follows: S21 determines the average daily number of alarm events on different dates based on alarm event data on different dates; S22 determines the alarm risk weight value of the alarm signal type based on the false alarm risk type of different alarm signal types; S23 determines the alarm analysis and processing method of the model in alarm events based on the average daily number of alarm events on different dates and the alarm risk weight value of different alarm signal types.

[0013] Furthermore, the method for determining the update strategy for the risk signal type among the alarm signal types is as follows: S31 Based on the degree of deviation, when there is a deviation in the identification analysis and processing results of the alarm event, the type of alarm signal added is determined and used as the type of influencing signal. The interference risk weight coefficient of the alarm event is determined by the ratio of the type of influencing signal in the alarm event to the preset number. S32 uses the false alarm risk type of the influencing signal type in the alarm event to determine the sum of the alarm risk weight values ​​of the influencing signal type in the alarm event, and uses the sum of the alarm risk weight values ​​of the influencing signal type in the alarm event as the influence weight value; S33 determines the update strategy for risk signal types among the alarm signal types by using the interference risk weight coefficient and influence weight value for different alarm events.

[0014] In a second aspect, the present invention provides a computer system comprising: a memory and a processor connected in communication, and a computer program stored in the memory and capable of running on the processor, wherein the processor executes the aforementioned model recognition processing method for parsing and processing log alarm data when running the computer program.

[0015] Other features and advantages will be set forth in the description which follows, and will be apparent in part from the description, or may be learned by practicing the invention. The objects and other advantages of the invention are realized and obtained through the structures particularly pointed out in the description and the drawings.

[0016] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, preferred embodiments are described below in detail with reference to the accompanying drawings. Attached Figure Description

[0017] The above and other features and advantages of the present invention will become more apparent from a detailed description of exemplary embodiments thereof with reference to the accompanying drawings.

[0018] Figure 1 This is a flowchart of a model identification processing method for parsing and processing log alarm data; Figure 2 This is a flowchart illustrating the method for determining the alarm analysis and processing approach in alarm events using a model. Figure 3 This is a flowchart illustrating the method for determining the update strategy for risk signal types within alarm signal types. Detailed Implementation

[0019] Exemplary embodiments will now be described more fully with reference to the accompanying drawings. However, these exemplary embodiments can be implemented in many forms and should not be construed as limited to the embodiments set forth herein; rather, they are provided so that the invention will be thorough and complete, and the concept of the exemplary embodiments will be fully conveyed to those skilled in the art. The same reference numerals in the drawings denote the same or similar structures, and therefore their detailed description will be omitted.

[0020] The terms “a,” “one,” “the,” and “the” are used to indicate the existence of one or more elements / components / etc.; the terms “including” and “having” are used to indicate an open-ended meaning of inclusion and that other elements / components / etc. may exist in addition to the listed elements / components / etc.

[0021] Example 1 To solve the above problems, according to one aspect of the present invention, such as Figure 1 As shown, a model recognition processing method for parsing and processing log alarm data is provided, specifically including: S1 uses the parsing results of log alarm data to determine false alarm data under different alarm signal types, determines the false alarm risk type of the alarm signal type based on the false alarm data, and determines the alarm analysis and processing method of the model in alarm events based on the false alarm risk type of different alarm signal types and alarm event data in different dates. Furthermore, the parsing results of the log alarm data are determined based on the monitoring data of the log's operation data.

[0022] It is understood that the false alarm data under the alarm signal type includes the number of false alarm periods under the alarm signal type.

[0023] It should be noted that the false alarm risk type of the alarm signal type is determined based on the preset risk type corresponding to the number of false alarm time periods under the alarm signal type.

[0024] Specifically, the false alarm risk types include a first-class risk type, a second-class risk type, and a third-class risk type, where the first-class risk type is greater than the second-class risk type, the second-class risk type is greater than the third-class risk type, and the more false alarm periods there are, the more severe the false alarm risk type is.

[0025] Specifically, such as Figure 2 As shown, the method for determining the alarm analysis and processing method in the alarm event using the model is as follows: In this application, based on the false alarm risk types of different alarm signal types and alarm event data on different dates, the alarm analysis and processing method of the model in alarm events is determined. This realizes the assessment of the impact of false alarms when alarm signal types occur from alarm event data and the false alarm risk of alarm signal types, and determines the alarm analysis and processing method of the model in alarm events based on the impact of false alarms when alarm signal types occur. This reduces the difficulty of parsing and processing, and also lays the foundation for the reliable identification of interference risks of different alarm signal types.

[0026] The alarm analysis and processing method refers to the decision rules for how the model considers and processes the combination of alarm signal types when identifying and analyzing alarm events, including processing methods such as considering only actual alarm signals and adding alarm signals of specific risk types; the false alarm risk type refers to the risk level divided according to the number of false alarm periods under the alarm signal type, and the more false alarm periods there are, the more severe the risk level.

[0027] If a certain type of alarm signal has multiple false alarms during a historical monitoring period, then its false alarm risk is relatively serious. In alarm analysis and processing methods, the interference of this type on the model recognition results needs to be given special consideration.

[0028] The alarm analysis and processing method is determined by alarm event data and false alarm risk types. Based on the frequency of alarm events and the false alarm risk level of alarm signal types, the model's processing method for alarm signal types during alarm analysis is dynamically adjusted, thereby reducing the difficulty of analysis and processing while ensuring identification accuracy.

[0029] S21 determines the average daily number of alarm events on different dates based on alarm event data on different dates; The alarm event refers to a fault alarm record consisting of one or more alarm signals; the daily average number of alarm events refers to the average number of alarm events occurring within a unit of date, reflecting the overall frequency of alarm events. Assuming that the number of alarm events on each day is counted within the historical monitoring period, the average number of alarm events can be obtained by calculating its average value. A larger daily average number indicates that alarms occur frequently.

[0030] By calculating the average daily number of alarm events, the frequency of alarm events can be assessed from an overall perspective, providing a basis for determining the frequency dimension for the differentiation of subsequent alarm analysis and processing methods.

[0031] It is understandable that if the average daily number of alarm events on different dates is not greater than the preset event number threshold, then the number of alarm events is relatively small. Therefore, it is not necessary to add additional false alarm signal types to obtain the degree of influence of false alarm signal types on the accuracy of alarm event identification results. Thus, the alarm analysis and processing method of the model in alarm events is determined to only need to consider the alarm signals that occur in the alarm events.

[0032] The preset event quantity threshold refers to the critical value for judging whether the frequency of alarm events is sufficient; when the daily average number is not greater than this threshold, the number of alarm events is small, and the impact of false alarms can be assessed by directly observing the actual alarm signals.

[0033] If the daily average number of alarm events is low, it indicates that alarm events are not frequent. By directly analyzing the alarm signals that actually occur, the assessment results of the impact of false alarms can be obtained.

[0034] When there are few alarm events, a simplified analysis and processing method is used. The significance of this method is that when the number of alarm events is insufficient, there is no need to add extra alarm signal types to perform effective analysis of the impact of false alarms, thereby avoiding unnecessary complicated processing.

[0035] It should also be noted that if the average daily number of alarm events on different dates exceeds the preset event number threshold, proceed to step S22. If the daily average number of alarm events is high, indicating that alarm events occur frequently, then proceed to S22 to calculate the alarm risk weight value and conduct further analysis.

[0036] S22, determine the alarm risk weight value of the alarm signal type according to the false alarm risk type of different alarm signal types; The alarm risk weight value refers to the preset weight value corresponding to the false alarm risk type of the alarm signal type, which is used to quantify the severity of the false alarm risk of the alarm signal type.

[0037] If a certain type of alarm signal is classified as a risk type with a high false alarm risk, it indicates that the false alarm risk of this type of signal is relatively serious. By determining the alarm risk weight value through the false alarm risk type, the risk level is transformed into a quantifiable and comparable weight value, providing a quantitative basis for the selection of alarm analysis and processing methods based on the weight value.

[0038] It is understandable that if the sum of the alarm risk weights of different alarm signal types does not meet the requirements, i.e., it is greater than a certain threshold, the risk of false alarms is relatively serious. Therefore, in order to determine the degree of interference of different alarm signal types, the alarm analysis and processing method of the model in the alarm event is determined to be that, in addition to considering the alarm signals that alarm in the alarm event, a preset number of alarm signals of type I risk and type II risk are randomly added to determine the interference of alarm signal types in the state of false alarms.

[0039] The sum of the alarm risk weight values ​​refers to the sum of the alarm risk weight values ​​of all alarm signal types, which is used to assess the overall false alarm risk level; the preset quantity refers to the number of additional alarm signal types that need to be added in alarm analysis and processing.

[0040] For example, if the sum of alarm risk weights exceeds the preset weights and thresholds, it indicates that the overall false alarm risk is relatively serious. Then, by randomly adding alarm signal types of type I and type II risk, the degree of interference to the model recognition results is tested. When the overall false alarm risk is relatively serious, an analysis method of adding multiple risk type signals is adopted. By actively introducing false alarm signals, the interference situation in the real scene is simulated, thereby evaluating the recognition reliability of the model under different interference combinations.

[0041] Additionally, it should be noted that if the sum of the alarm risk weight values ​​of different alarm signal types meets the requirements, proceed to step S23. For example, assuming that the sum of the alarm risk weight values ​​does not exceed the preset weight and threshold, it indicates that the overall false alarm risk is acceptable. Then, proceed to S23 to further determine the alarm analysis and processing method based on the daily average number.

[0042] S23 determines the alarm analysis and processing method of the model in alarm events based on the average daily number of alarm events on different dates and the alarm risk weight value of different alarm signal types.

[0043] Assuming that the daily average number of alarm events and the alarm risk weight value are already determined, appropriate alarm analysis and processing methods are determined based on the specific values ​​of the two, including whether to add alarm signals of specific risk types. The alarm analysis and processing methods are determined by comprehensively considering the number of alarm events and the alarm risk weight value. The analysis and processing methods of the model are determined collaboratively from the two dimensions of event frequency and risk level, thereby achieving adaptive selection of analysis and processing strategies.

[0044] It is understandable that the alarm analysis and processing method of the model in alarm events is determined based on the average daily number of alarm events on different dates and the alarm risk weight values ​​for different alarm signal types. Specifically, this includes: S231, using alarm risk weight values ​​for different alarm signal types, alarm signal types with alarm risk weight values ​​greater than a preset weight threshold are taken as interference risk signal types. It is determined whether the proportion of interference risk signal types in the alarm signal types is less than a preset interference risk proportion threshold. If yes, proceed to step S232. If no, it is determined that the alarm analysis and processing method of the model in the alarm event is that, in addition to considering the alarm signals that alarm in the alarm event, a preset number of first-class risk type and second-class risk type alarm signal types need to be randomly added to determine the interference situation when the alarm signal type is in a false alarm state. The interference risk signal type refers to the alarm signal type whose alarm risk weight value is greater than the preset weight threshold, representing an alarm signal type with a high risk of false alarms; the preset interference risk ratio threshold refers to the critical value for judging whether the proportion of interference risk signal types is high.

[0045] If the proportion of interference risk signal types is not less than the preset interference risk proportion threshold, it indicates that the proportion of interference risk signal types is relatively high and the overall risk is relatively large. Therefore, the alarm analysis and processing method of adding Class I and Class II risk signal types is adopted.

[0046] When the proportion of interference risk signal types is high, an analysis method of adding multiple risk signal types is adopted. When the proportion of high-risk alarm signal types is high in the whole, more risk signals are actively introduced to fully assess the degree of interference, thereby ensuring the reliability of model identification and analysis.

[0047] S232 determines whether the average daily number of alarm events on different dates is less than a preset event number threshold. If so, the alarm analysis and processing method of the model in alarm events is determined to be that, in addition to considering the alarm signals that occur in the alarm events, if there is an alarm signal of a certain risk type in the alarm events, then there is no need to consider other alarm signal types. If there is no alarm signal of a certain risk type in the alarm events, then a preset number of alarm signals of a certain risk type need to be randomly added to determine the interference situation of the alarm signal type in the false alarm state. If not, the alarm analysis and processing method of the model in alarm events is determined to be that only the alarm signals that occur in the alarm events need to be considered.

[0048] The above situation refers to scenarios with a small daily average number of alarms. In this case, the frequency of alarm events is low, but the risk of false alarms cannot be ignored. Different handling methods should be adopted depending on whether there is a risk type signal.

[0049] Assuming the daily average number of alarm events is small, if there is an alarm signal of a certain risk type among the alarm events, then only the actual alarm signal needs to be considered. If there is no alarm signal of a certain risk type, then an alarm signal of a certain risk type needs to be randomly added for analysis.

[0050] When the daily average number is small, differentiated processing is applied based on the presence or absence of a risk type signal. When there are few alarm events but there are high-risk signals, the high-risk signals themselves can provide sufficient information for assessing the impact of false alarms, and no additional information is needed. However, when there are no high-risk signals, a risk type signal is added to compensate for the lack of information.

[0051] Specifically, when adding a preset number of alarm signal types of a certain risk type, one is added at a time, and the consistency between the alarm event identification results of the model after the addition and the alarm event identification results of the model before the addition is determined.

[0052] The degree of consistency refers to the degree of agreement between the model's recognition results of alarm events before and after adding an alarm signal type. When the recognition results change after adding a certain alarm signal type, it indicates that the signal type has interfered with the model's recognition.

[0053] Assuming that after each type of risk alarm signal is added, the identification result after the addition is compared with the identification result before the addition is not added, if the two are consistent, it indicates that the added signal has not caused interference, and if they are inconsistent, it indicates that interference has occurred.

[0054] By successively adding and comparing alarm signal types to determine the interference situation, it is possible to accurately identify which alarm signal types will have a substantial impact on the model's recognition results, thereby improving the pertinence of risk signal type identification and elimination.

[0055] This embodiment implements a complete process from daily average alarm event statistics to alarm risk weight value determination and alarm analysis and processing method determination. The alarm frequency is determined by the daily average number of alarm events, and a simplified analysis method is used to reduce processing complexity when there are few alarm events. By using alarm risk weight value and quantifying the overall false alarm risk, risk signal types are proactively added for interference assessment when the risk is severe. By subdividing the proportion of interference risk signal types and the daily average number, the analysis and processing method is differentiated under the combined conditions of alarm frequency and risk level, thereby achieving adaptive selection of alarm analysis and processing strategy.

[0056] A log alarm analysis system has 20 alarm signal types, A1 to A20. Based on the number of false alarms for each type during historical monitoring periods, three risk categories are defined: Category 1 (≥10 false alarms) includes A1, A3, A5, A8, A10, A12, A15, and A18; Category 2 (5 to 9 false alarms) includes A2, A6, A9, A13, A16, and A19; and Category 3 (1 to 4 false alarms) includes A4, A7, A11, A14, A17, and A20. The alarm event statistics for each date within the historical period are as follows: the daily average is 18.

[0057] Step S21: The average number of alarm events per day on different dates is 18. Determine if 18 is greater than the preset event number threshold of 15. If 18 is greater than 15, proceed to S22.

[0058] Step S22: Calculate the alarm risk weight value for each alarm signal type. Set the weight value for risk type 1 to 0.8, for risk type 2 to 0.5, and for risk type 3 to 0.2. The sum of the alarm risk weight values ​​= 8 × 0.8 + 6 × 0.5 + 6 × 0.2 = 6.4 + 3.0 + 1.2 = 10.6. Determine if 10.6 is greater than the preset weight and threshold of 30: 10.6 is not greater than 30, meeting the requirement, proceed to S23.

[0059] Step S23: Step S231: Alarm signal types with an alarm risk weight value greater than the preset weight threshold of 0.60 are considered interference risk signal types. The weight value of a first-class risk type is 0.8, which is greater than 0.60. Therefore, A1, A3, A5, A8, A10, A12, A15, and A18 are a total of 8 interference risk signal types. The proportion of interference risk signal types = 8 / 20 = 0.40. Determine if 0.40 is less than the preset interference risk proportion threshold of 0.30: If 0.40 is not less than 0.30, then the alarm analysis and processing method is determined as follows: In addition to considering the alarm signals that occurred in the alarm event, two preset number of first-class and second-class risk type alarm signal types need to be randomly added.

[0060] The specific implementation of S231 is as follows: During each alarm event analysis, the system first identifies the alarm signals that actually occurred in the event, and then randomly selects a total of two alarm signal types from the first and second risk types to add to the analysis. One is added each time, and the consistency between the model identification results after the addition and before the addition is determined.

[0061] S2 uses the alarm analysis and processing method to determine the degree of deviation of the fault type identification and analysis processing results under different false alarm risk types of alarm signal types in different alarm events, and determines the update strategy of the risk signal type in the alarm signal type in combination with the false alarm risk type of the alarm signal type, and identifies and processes the alarm signal of the risk signal type in all alarm events, thereby performing false alarm signal elimination processing. It should be noted that, as Figure 3 As shown, the method for determining the update strategy for the risk signal type among the alarm signal types is as follows: In this embodiment, based on the degree of deviation of the fault type identification and analysis processing results under different alarm signal types with different false alarm risk types in different alarm events, and the false alarm risk type of the alarm signal type, the update strategy of risk signal type in alarm signal type is determined. This realizes the updating processing of risk signal type from the perspective of the influence of alarm signal type on the identification and analysis processing results of different fault types. This not only realizes the elimination processing of risk signal type, but also avoids the technical problem of excessive difficulty in elimination processing due to a large number of risk signal types.

[0062] The risk signal type refers to the type of alarm signal that will be excluded as a false alarm signal in the alarm event; the influencing signal type refers to the type of alarm signal that causes the model recognition result to change after being added; the interference risk weight coefficient reflects the ratio between the number of influencing signal types added in the alarm event and the preset number of added types.

[0063] Suppose that in a certain alarm event, if one of the two added alarm signal types causes a change in the model's recognition result, then that signal type is identified as an influencing signal type, and the interference risk weight coefficient reflects the proportion of the influencing signal type among the added signals.

[0064] The update strategy for determining risk signal types is based on the degree of deviation and the type of false alarm risk. Starting from the identification results of the signal types that affect the signal types, the interference risk weight coefficient and the influence weight value are combined to determine which alarm signal types need to be marked as risk signal types and excluded.

[0065] S31, based on the degree of deviation, determine the type of alarm signal added when there is a deviation in the identification analysis and processing results of the alarm event, and use it as the type of influencing signal. Determine the interference risk weight coefficient of the alarm event by the ratio of the type of influencing signal in the alarm event to the preset number. The influencing signal type refers to the alarm signal type that causes the model recognition result to change after being added to the alarm event; the interference risk weight coefficient refers to the ratio of the number of influencing signal types in the alarm event to the preset number of added signals, reflecting the proportion of interference signals in the alarm event.

[0066] Suppose that two alarm signal types are added to a certain alarm event, and one of them causes a change in the identification result, then the interference risk weight coefficient is 1 / 2 = 0.5.

[0067] The interference risk weight coefficient is determined by the ratio of the influence signal type to the preset quantity, which quantifies the proportion of interference signals in each alarm event and provides a quantitative basis for determining the event dimension for subsequent risk signal type update strategies.

[0068] Specifically, if the average value of the interference risk weight coefficient of different alarm events is greater than the preset risk weight coefficient threshold, then the update strategy for determining the risk signal type in the alarm signal type is that as long as it belongs to the influence signal type among alarm events of a preset number or more, it is regarded as the risk signal type.

[0069] The preset risk weight coefficient threshold refers to the critical value for judging whether the interference risk weight coefficient is high; when the mean is greater than the threshold, it indicates that the overall interference level is high, and a more stringent update strategy is adopted.

[0070] If the average value of the interference risk weight coefficient of each alarm event is large and exceeds the preset risk weight coefficient threshold, then the alarm signal type that is identified as the influencing signal type in multiple alarm events will be directly marked as the risk signal type.

[0071] When the overall level of interference is high, a strict update strategy is adopted. When interference signals are prevalent in alarm events, the threshold for determining risk signal types is lowered to ensure that more interference signals are included in the exclusion scope.

[0072] It should also be noted that if the average value of the interference risk weight coefficient of different alarm events is not greater than the preset risk weight coefficient threshold, proceed to step S32. S32, using the false alarm risk type of the influencing signal type in the alarm event, determine the sum of the alarm risk weight values ​​of the influencing signal type in the alarm event, and use the sum of the alarm risk weight values ​​of the influencing signal type in the alarm event as the influence weight value; The influence weight value refers to the sum of the alarm risk weight values ​​of all influencing signal types in the alarm event, which is used to quantify the overall risk level of interference signals in the alarm event.

[0073] Suppose that there are multiple influencing signal types in a certain alarm event, calculate the alarm risk weight value corresponding to each type, and sum them to obtain the influence weight value.

[0074] By determining the risk weight value that affects the signal type, the risk level of the interfering signal is quantified, providing a risk dimension basis for the subsequent calculation of the comprehensive risk weight value.

[0075] It is understood that in the above steps, the comprehensive risk weight value of the alarm event is determined by multiplying the impact weight value of different alarm events with the interference risk weight coefficient. It is then determined whether there are alarm events with a comprehensive risk weight value above a preset threshold. If so, the process proceeds to step S33. If not, the update strategy for the risk signal type in the alarm signal type is determined to be that as long as an alarm event belongs to the impact signal type among a preset number of alarm events, and the average value of the interference risk weight coefficient of the alarm events belonging to the impact signal type is greater than the preset risk coefficient value (less than the preset risk weight coefficient threshold), then it is regarded as a risk signal type.

[0076] The comprehensive risk weight value refers to the product of the influence weight value and the interference risk weight coefficient, which comprehensively reflects the frequency and risk level of interference signals in the alarm event; the preset threshold refers to the critical value for judging whether the comprehensive risk of the alarm event is significant.

[0077] If the overall risk weight value of an alarm event is large and exceeds the preset threshold, it indicates that the event is subject to interference and has a high risk, and the process will proceed to S33 for further analysis.

[0078] S33, determine the update strategy for the risk signal type among the alarm signal types by using the interference risk weight coefficient and influence weight value of different alarm events.

[0079] Assuming that the interference risk weight coefficient and impact weight value of each alarm event have been determined, an appropriate risk signal type update strategy is determined based on the mean and distribution of the comprehensive risk weight value.

[0080] The risk signal type update strategy is determined by combining the interference risk weight coefficient and the influence weight value. The judgment criteria for risk signal type are determined collaboratively from two dimensions: interference frequency and risk level, thereby achieving adaptive selection of the update strategy.

[0081] It is understandable that the update strategy for determining the risk signal type among the alarm signal types, based on the interference risk weight coefficient and influence weight value of different alarm events, specifically includes: S331, determine whether the average of the comprehensive risk weight values ​​of different alarm events is above the preset threshold. If so, determine that the update strategy for the risk signal type in the alarm signal type is that as long as it belongs to the influence signal type in the alarm events above the preset number, it is regarded as the risk signal type. If not, proceed to step S332. The mean of the comprehensive risk weight value reflects the overall risk level of all alarm events; when the mean is above the preset threshold, the overall risk is high, and a strict update strategy is adopted.

[0082] If the average of the comprehensive risk weight values ​​of all alarm events is greater than a preset threshold, indicating a high overall risk level, then the occurrence of an influence signal type in multiple alarm events will be identified as a risk signal type.

[0083] When the average value of the comprehensive risk weight is high, a strict update strategy is adopted. When the overall risk level is high, the threshold for determining the risk signal type is lowered to ensure that interference signals are fully covered.

[0084] S332, the comprehensive impact risk value is determined by the average of the proportion of alarm events with a comprehensive risk weight value above a preset threshold and the proportion of alarm events with an interference risk weight coefficient greater than a preset risk weight coefficient threshold. It is then determined whether the comprehensive impact risk value is greater than the preset impact risk threshold. If so, the update strategy for the risk signal type in the alarm signal type is determined to be that if an alarm event belongs to the impact signal type among a preset number or more of the alarm events, it is considered a risk signal type. If not, the update strategy for the risk signal type in the alarm signal type is determined to be that if an alarm event belongs to the impact signal type among a preset number or more of the alarm events, and if there is an alarm event among the impact signal type with an interference risk weight coefficient greater than a preset risk coefficient value, it is considered a risk signal type.

[0085] The comprehensive impact risk value refers to the average of the proportion of alarm events with the comprehensive risk weight value exceeding the threshold and the proportion of alarm events with the interference risk weight coefficient exceeding the threshold, which is used to comprehensively assess the risk distribution of alarm events.

[0086] If the overall impact risk value is greater than the preset impact risk threshold, it indicates that high-interference and high-risk alarm events account for a high proportion in the whole, and a strict update strategy is adopted; otherwise, an update strategy with additional conditions is adopted.

[0087] By further refining and updating the strategy by comprehensively considering the risk value, a strict strategy is adopted when the proportion of high-interference and high-risk alarm events is high, and a strategy with additional conditions is adopted when the proportion is low, thereby achieving a balance between risk coverage and exclusion accuracy.

[0088] This embodiment realizes a complete process from determining the interference risk weight coefficient of alarm events to calculating the impact weight value and comprehensive risk weight value, and then determining the risk signal type update strategy. The interference risk weight coefficient quantifies the proportion of interference signals of each alarm event, providing an event dimension basis for determining the risk signal type update strategy; the comprehensive risk weight value is determined by multiplying the impact weight value and the interference risk weight coefficient, realizing a comprehensive assessment of interference frequency and risk level; and the judgment criteria for risk signal type are dynamically adjusted when the overall risk level is different through hierarchical judgment of the mean of comprehensive risk weight value and comprehensive impact risk value, thereby realizing the adaptive selection of risk signal type update strategy.

[0089] Continuing with the calculation results of S2, the alarm analysis and processing method has been determined to be "adding a preset number of two alarm signal types for both Class I and Class II risk types". Four alarm events, E1 to E4, were selected for test analysis. The identification results after adding alarm signal types to each event are as follows: E1: Add A5 and A2. A5 causes a change in the identification result (affecting the signal type), while A2 does not cause a change. The affected signal type is A5. Interference risk weight coefficient = 1 / 2 = 0.5. The affected signal type alarm risk weight value = 0.8 (A5 is a type of risk), and the impact weight value = 0.8.

[0090] Step 31: Assume the mean of the interference risk weight coefficient is 0.5. Determine if the mean of 0.5 is greater than the preset risk weight coefficient threshold of 0.6: If 0.5 is not greater than 0.6, proceed to S32.

[0091] Step S32: Calculate the overall risk weight value for each alarm event: E1: 0.8 × 0.5 = 0.4; E2: 1.3 × 1.0 = 1.3; E3: 0.8 × 0.5 = 0.4; Determine if there is an alarm event with a comprehensive risk weight value greater than the preset threshold of 0.5: E2's comprehensive risk weight value of 1.3 is greater than 0.5, so it exists and proceeds to S33.

[0092] Step S33: Step S331: The mean of the comprehensive risk weight value = 0.525. Determine if the mean of 0.525 is above the preset threshold of 0.5: If 0.525 is greater than 0.5, then yes. The update strategy for determining the risk signal type is: if it belongs to the influencing signal type among alarm events with a preset number of more than 20, then it is regarded as the risk signal type.

[0093] Among the preset number of alarm events exceeding 20, the one that falls under the category of influencing signal type is A5. Therefore, the risk signal type is A5, and in subsequent alarm events, alarm signals of type A5 will be identified and processed, and false alarm signals will be eliminated.

[0094] S3 determines the update processing result of the risk signal type based on the update strategy of the risk signal type, and determines the update identification processing method of the model by combining the update processing results of the risk signal type in different alarm events.

[0095] Specifically, the method for determining the model update and recognition processing method is as follows: In this embodiment, based on the risk signal type update strategy and the update processing results of risk signal types for different alarm events, the risk of delay in identifying fault causes due to the exclusion of risk signal types is determined during the current alarm event identification and processing. Based on the risk of delay in identifying fault causes due to the exclusion of risk signal types during the current alarm event identification and processing, the model update identification and processing method is determined. This enables dynamic updating of the model's reliability in identifying interference risks in different alarm signal types, thus laying the foundation for dynamically updating risk signal types using the reliability of interference risk identification and improving the efficiency of alarm event identification and processing.

[0096] The model update identification and processing method refers to the decision rules for how to use the updated model to identify and process alarm events and evaluate the update effect after determining the risk signal type.

[0097] If the number of updates for risk signal types is small, the risk of identification delay is low, and targeted identification can be performed in alarm events that have affected signal types. Conversely, if the number of updates is large, the risk of identification delay is high, and comprehensive identification needs to be performed in all alarm events that have affected signal types.

[0098] The update and identification processing method of the model is determined by updating the results of risk signal type updates. The identification and processing range after the model update is dynamically adjusted according to the number of updates and the distribution of interference signals in alarm events.

[0099] S41, Based on the update strategy of the risk signal type, determine the update processing result of the risk signal type; The update processing result of the risk signal type refers to the final set of risk signal types determined according to the update strategy.

[0100] Assuming that A5 has been identified as a risk signal type according to the update strategy of S3, the alarm signal of A5 will be identified and excluded in subsequent alarm events.

[0101] The updated processing results, which determine the types of risk signals by updating strategies, provide basic data for subsequent identification of delayed risk assessment and determination of model update identification processing methods.

[0102] It is understandable that, based on the update processing result of the risk signal type, the number of updated risk signal types is determined, and it is judged whether the number of updated risk signal types is less than the preset risk signal type number threshold. If so, proceed to step S42; if not, the number of updated risk signal types is too large, and the delay in identifying and processing false alarms of risk signal types in alarm events is too high. Therefore, the update identification processing method of the model is determined to be to identify and process all alarm events with influencing signal types after the model is updated, and to determine whether there are still influencing signal types after the update, thereby laying the foundation for the elimination processing of risk signal types and improving the efficiency of identification processing.

[0103] The preset threshold for the number of risk signal types refers to the critical value for judging whether the number of risk signal types is controllable. When the number of updates is less than this threshold, there are fewer risk signal types, the risk of identification delay is lower, and further analysis is initiated.

[0104] If the number of updates for risk signal types is small, it indicates that there are not many types of risk signals that need to be excluded and the risk of identification delay is low. Then proceed to S42 for further analysis.

[0105] When the number of risk signal types is small, proceed to further analysis; when the number of risk signal types that need to be excluded is small, determine the updated identification and processing method through a more refined risk assessment of the identification delay.

[0106] S42, using the update processing results of risk signal types of different alarm events, determine the risk signal type that issues alarm signals in different alarm events, and take the risk signal type that issues alarm signals in the alarm events as the suspected interference signal type; The suspected interference signal type refers to the risk signal type that sends an alarm signal in an alarm event, that is, the alarm signal type that may still cause interference after the update.

[0107] Suppose that a risk signal type A5 issues an alarm signal in a certain alarm event, then A5 is marked as a suspected interference signal type in that alarm event.

[0108] By identifying the types of risk signals in actual alarm events, we can determine the types of suspected interference signals and identify risk signal types that may still cause interference after troubleshooting, thus providing a data basis for subsequent delay risk assessment.

[0109] It is understood that the above steps include the following: Alarm events with suspected interference signal types are treated as secondary identification alarm events. It is determined whether the proportion of the secondary identification alarm events in all alarm events is greater than a preset identification alarm event proportion threshold. If so, the identification delay is relatively serious. The model update identification processing method is determined to be to perform identification processing on all alarm events with influencing signal types after the model is updated, and to determine whether influencing signal types still exist after the update. This lays the foundation for eliminating risk signal types and improving the efficiency of identification processing. If not, proceed to step S43. The preset threshold for the proportion of alarm events is a critical value for determining whether the proportion of alarm events requiring secondary identification is high. When the proportion is greater than this threshold, it indicates that the identification delay is serious and full identification is required.

[0110] If the proportion of secondary identification alarm events is relatively large, it indicates that there are suspected interference signal types in multiple alarm events, and the risk of identification delay is high. Therefore, a comprehensive identification and processing method is adopted.

[0111] When the proportion of secondary identification alarm events is high, a comprehensive identification and processing method is adopted. When the suspected interference signal type is prevalent in alarm events, comprehensive identification is used to ensure that all alarm events with influencing signal types are covered.

[0112] S43. Based on the update processing results of the risk signal type and the suspected interference signal types in different alarm events, determine the update identification processing method of the model.

[0113] Assuming that the updated processing results of risk signal types and the suspected interference signal types in alarm events have been determined, an appropriate model update identification processing method is determined based on the judgment results of delayed interference weight values ​​and corrected interference weight values.

[0114] The update and identification processing method is determined by combining the update processing results of risk signal types and suspected interference signal types. The identification and processing method after model update is determined collaboratively from two dimensions: the number of updates and the distribution of interference signals.

[0115] It is understood that, based on the update processing results of the risk signal types and the suspected interference signal types in different alarm events, the update identification processing method of the model is determined, specifically including: S431, based on the number of suspected interference signal types in different alarm events, determine the delay interference weight value of the alarm event, and determine whether there is an alarm event with a delay interference weight value greater than a preset interference weight value. If yes, proceed to step S432; otherwise, determine that the model update identification processing method is as follows: as long as the proportion of alarm events with influencing signal types in all alarm events is less than the alarm event proportion threshold after the model update, and the number of alarm events reaches or exceeds the first quantity threshold, it is determined that the probability of improvement after the model update processing is high. Therefore, identification processing is performed in all alarm events with influencing signal types to determine whether there are still influencing signal types after the update, thereby laying the foundation for risk signal type elimination processing and improving the efficiency of identification processing. The delay interference weight value is determined based on the number of suspected interference signal types in the alarm event; the more types there are, the greater the delay interference weight value will be. The preset interference weight value refers to the critical value for judging whether the interference level of the alarm event is serious.

[0116] If a certain alarm event contains a large number of suspected interference signal types and its delay interference weight value is large, it indicates that the interference level of the event is serious. Then, proceed to S432 for further analysis. The interference level of the alarm event is judged by the delay interference weight value. When there is an alarm event with serious interference, proceed to further analysis. When there is no serious interference event, a conditional identification and processing method is adopted.

[0117] S432, based on the average value of the delay interference weight values ​​of different alarm events and the average proportion of risk signal types among all alarm signal types, a corrected interference weight value is determined. It is then determined whether the corrected interference weight value meets the requirements. If not, the corrected interference weight value is too large, indicating a high interference risk. Therefore, the model update identification processing method is determined to be: after updating the model, identification processing is performed on all alarm events with influencing signal types to determine if influencing signal types still exist after the update. This lays the foundation for eliminating risk signal types and improving the efficiency of identification processing. If yes, the model update identification processing method is determined to be: after updating the model, if the proportion of alarm events with influencing signal types among all alarm events is less than the alarm event proportion threshold, and the number of alarm events reaches a second threshold (less than the first threshold), then the probability of improvement after model update processing is high. Therefore, identification processing is performed on all alarm events with influencing signal types to determine if influencing signal types still exist after the update. This lays the foundation for eliminating risk signal types and improving the efficiency of identification processing.

[0118] The corrected interference weight value is determined based on the average value of the delay interference weight value and the average proportion of risk signal types in the alarm signal types. The larger the average value of the delay interference weight value and the smaller the proportion of risk signal types, the larger the corrected interference weight value.

[0119] If the adjusted interference weight value meets the requirement (i.e., is relatively small), indicating that the overall interference risk is low, then a conditional identification and processing method is adopted; otherwise, a comprehensive identification and processing method is adopted. The identification and processing method is further subdivided and updated by adjusting the interference weight value. When the overall interference risk is low, conditional identification and processing is adopted to reduce unnecessary calculations, and when the interference risk is high, comprehensive identification and processing is adopted to ensure risk coverage.

[0120] This embodiment realizes a complete process from determining the risk signal type update processing result to identifying the suspected interference signal type and then determining the model update identification processing method. The level of identification delay risk is judged by the number of risk signal type updates, and when the number of updates is small, it enters refined analysis; the prevalence of suspected interference signals is judged by the proportion of secondary identification alarm events, and when the proportion is high, a comprehensive identification processing method is adopted to ensure reliability; through the hierarchical judgment of delay interference weight value and correction interference weight value, the identification processing range after model update is dynamically adjusted when the overall interference risk is different, thereby achieving an adaptive balance between identification efficiency and risk coverage.

[0121] Example 2 In a second aspect, the present invention provides a computer system comprising: a memory and a processor connected in communication, and a computer program stored in the memory and capable of running on the processor, wherein the processor executes the aforementioned model recognition processing method for parsing and processing log alarm data when running the computer program.

[0122] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the embodiments of apparatus, devices, and non-volatile computer storage media are basically similar to the method embodiments, so the descriptions are relatively simple; relevant parts can be referred to the descriptions of the method embodiments.

[0123] The foregoing has described specific embodiments of this specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims may be performed in a different order than that shown in the embodiments and may still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require the specific or sequential order shown to achieve the desired result. In some embodiments, multitasking and parallel processing are possible or may be advantageous.

[0124] The above description is merely one or more embodiments of this specification and is not intended to limit this specification. Various modifications and variations can be made to the one or more embodiments of this specification by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principle of one or more embodiments of this specification should be included within the scope of the claims of this specification.

Claims

1. A model recognition processing method for parsing and processing log alarm data, characterized in that, Specifically, it includes: Based on the parsing results of log alarm data, the false alarm data under different alarm signal types is determined. Based on the false alarm data, the false alarm risk type of the alarm signal type is determined. Based on the false alarm risk type of different alarm signal types and alarm event data in different dates, the alarm analysis and processing method of the model in alarm events is determined. The alarm analysis and processing method is used to determine the degree of deviation of the fault type identification and analysis results under different alarm signal types with different false alarm risk types in different alarm events. Combined with the false alarm risk type of the alarm signal type, the update strategy of the risk signal type in the alarm signal type is determined. The alarm signal of the risk signal type is identified and processed in all alarm events, thereby eliminating false alarm signals. Based on the update strategy of the risk signal type, the update processing result of the risk signal type is determined, and combined with the update processing results of the risk signal type in different alarm events, the update identification processing method of the model is determined.

2. The model recognition processing method for parsing and processing log alarm data as described in claim 1, characterized in that, The parsing results of the log alarm data are determined based on the monitoring data of the log's operation data.

3. The model recognition processing method for parsing and processing log alarm data as described in claim 1, characterized in that, The false alarm data under the alarm signal type includes the number of false alarm periods under the alarm signal type.

4. The model recognition processing method for parsing and processing log alarm data as described in claim 1, characterized in that, The false alarm risk type of the alarm signal type is determined based on the preset risk type corresponding to the number of false alarm periods under the alarm signal type.

5. The model recognition processing method for parsing and processing log alarm data as described in claim 4, characterized in that, The false alarm risk types include a first-class risk type, a second-class risk type, and a third-class risk type.

6. The model recognition processing method for parsing and processing log alarm data as described in claim 1, characterized in that, The method for determining the alarm analysis and processing method of the model in alarm events is as follows: Based on alarm event data for different dates, determine the average daily number of alarm events for different dates; Based on the false alarm risk type of different alarm signal types, determine the alarm risk weight value of the alarm signal type; The alarm analysis and processing method of the model in alarm events is determined by the average daily number of alarm events on different dates and the alarm risk weight value of different alarm signal types.

7. The model recognition processing method for parsing and processing log alarm data as described in claim 6, characterized in that, When the average daily number of alarm events on different dates exceeds a preset event number threshold, the alarm analysis and processing method of the model in alarm events is determined to only consider the alarm signals that occur in the alarm events.

8. The model recognition processing method for parsing and processing log alarm data as described in claim 6, characterized in that, The alarm analysis and processing method of the model in alarm events is determined based on the average daily number of alarm events on different dates and the alarm risk weight values ​​for different alarm signal types. Specifically, this includes: Using alarm risk weight values ​​for different alarm signal types, alarm signal types with alarm risk weight values ​​greater than a preset weight threshold are identified as interference risk signal types. It is then determined whether the proportion of interference risk signal types in the alarm signal types is less than a preset interference risk proportion threshold. If so, proceed to the next step; otherwise, it is determined that the alarm analysis and processing method of the model in the alarm event is as follows: in addition to considering the alarm signals that alarm in the alarm event, a preset number of alarm signal types of type 1 and type 2 risk are randomly added to it. If the average daily number of alarm events on different dates is less than a preset event number threshold, then the alarm analysis and processing method of the model in alarm events is determined to be that, in addition to considering the alarm signals that have occurred in the alarm event, if there is an alarm signal of a certain risk type in the alarm event, then there is no need to consider other alarm signal types. If there is no alarm signal of a certain risk type in the alarm event, then a preset number of alarm signals of a certain risk type need to be randomly added to it. If not, then the alarm analysis and processing method of the model in alarm events is determined to be that only the alarm signals that have occurred in the alarm event need to be considered.

9. The model recognition processing method for parsing and processing log alarm data as described in claim 1, characterized in that, The method for determining the model update and recognition processing method is as follows: Based on the update strategy for the aforementioned risk signal type, determine the update processing result for the aforementioned risk signal type; By utilizing the update processing results of risk signal types for different alarm events, the risk signal types that issue alarm signals in different alarm events are determined, and the risk signal types that issue alarm signals in the alarm events are taken as suspected interference signal types. Based on the update processing results of the risk signal types and the suspected interference signal types in different alarm events, the update identification processing method of the model is determined.

10. A computer system, comprising: A memory and a processor connected in communication, and a computer program stored in the memory and capable of running on the processor, characterized in that, when the processor runs the computer program, it executes a model recognition processing method for parsing and processing log alarm data as described in any one of claims 1-9.

Images