An alarm pushing method and device, electronic equipment and storage medium

Abstract

Embodiments of the present application provide an alarm pushing method and device, electronic equipment and storage medium, and relate to the technical field of operation and maintenance. The method comprises: performing feature extraction on a description text of a target alarm to determine at least one target alarm feature; determining a matching degree between each role in a plurality of roles and the target alarm based on the at least one target alarm feature and alarm association information of each role in the plurality of roles; determining a target role from the plurality of roles based on the matching degree between each role in the plurality of roles and the target alarm, and determining a target user for pushing the target alarm from users included in the target role based on a processing effect of each user included in the target role on an alarm related to the target alarm; and pushing the target alarm to the target user. The embodiments of the present application can efficiently and accurately push the alarm.

Description

Technical Field

[0001] This application relates to the field of operation and maintenance technology, and in particular to an alarm push method, device, electronic device and storage medium. Background Technology

[0002] In today's rapidly evolving digital landscape, enterprise network environments and business systems are becoming increasingly complex, leading to an explosive growth in the number of alarms generated by various devices, systems, and applications. Large enterprises can generate thousands or even tens of thousands of alarms daily, requiring these alarms to be pushed to relevant personnel for processing.

[0003] Currently, alarm categories and alarm content can be associated with department or job information, so that when an alarm is generated, the alarm can be pushed to the relevant department or job personnel.

[0004] However, the above solutions are prone to pushing alarms to irrelevant users, thereby reducing the efficiency of alarm processing. Therefore, there is an urgent need for a technical solution that can efficiently and accurately associate alarms with appropriate roles and push alarms to the appropriate roles so that alarms can be effectively processed. Summary of the Invention

[0005] The purpose of this application is to provide an alarm push method, apparatus, electronic device, and storage medium to achieve efficient and accurate alarm push. The specific technical solution is as follows:

[0006] This application first provides an alarm push method, the method including:

[0007] Feature extraction is performed on the descriptive text of the target alarm to determine at least one target alarm feature;

[0008] Based on the at least one target alarm feature and the alarm association information of each role among the multiple roles, the matching degree between each role and the target alarm is determined. The alarm association information of any role among the multiple roles includes multiple alarm features associated with the role and the association weight between the role and each of its associated alarm features.

[0009] Based on the matching degree between each of the multiple roles and the target alarm, a target role is determined from the multiple roles, and based on the processing effect of each user included in the target role on the alarms related to the target alarm, a target user is determined from the users included in the target role to push the target alarm, wherein the related alarms and the target alarm belong to the same category;

[0010] The target alarm is pushed to the target user.

[0011] Optionally, determining the matching degree between each of the multiple roles and the target alarm based on the at least one target alarm feature and the alarm association information of each role among the multiple roles includes:

[0012] Each target alarm feature in the at least one target alarm feature is matched with the alarm feature associated with each role in the multiple roles to obtain the alarm feature matched by each target alarm feature;

[0013] For each of the multiple roles, the matching degree between the role and the target alarm is determined based on the association weight between the role and the alarm features that match each target alarm feature.

[0014] Optionally, the alarm association information of the target role includes the association weight between the target role and the reference alarm feature, wherein the reference alarm feature is an alarm feature among the alarm features associated with each of the plurality of roles that matches any of the at least one target alarm feature, and the method further includes:

[0015] Obtain the processing result of the target user on the target alarm;

[0016] If the obtained processing result indicates that the target user processes or forwards the target alarm, then the association weight between the target role and the reference alarm feature is increased;

[0017] or,

[0018] If the processing result indicates that the target user has not processed the target alarm, then the association weight between the target role and the reference alarm feature is reduced.

[0019] Optionally, the plurality of roles includes reference roles that are different from the target role, and the alarm association information of the reference roles includes the association weight between the reference roles and the reference alarm features;

[0020] The method further includes:

[0021] If the obtained processing result indicates that the target user processes or forwards the target alarm, then the association weight between the reference role and the reference alarm feature is reduced;

[0022] or,

[0023] If the processing result indicates that the target user has not processed the target alarm, then the association weight between the reference role and the reference alarm feature is increased.

[0024] Optionally, determining the target user for pushing the target alarm from the users included in the target role based on the processing effect of each user in the target role on the target alarm-related alarms includes:

[0025] Based on the processing effect of each user in the target role on the alarms related to the target alarm and the alarm level of the target alarm, the target user to be pushed the target alarm is determined from the users in the target role.

[0026] Optionally, the method further includes:

[0027] Based on the target user's handling effect on the target alarm and / or the alarm level of the target alarm, determine the target push priority for pushing the target alarm;

[0028] The step of pushing the target alarm to the target user includes:

[0029] The target alarm is pushed to the target user according to the push strategy corresponding to the target push priority.

[0030] This application embodiment also provides an alarm push device, the device comprising:

[0031] The feature extraction unit is used to extract features from the descriptive text of the target alarm and determine at least one target alarm feature.

[0032] A matching unit is used to determine the matching degree between each of the multiple roles and the target alarm based on the at least one target alarm feature and the alarm association information of each role among the multiple roles. The alarm association information of any one of the multiple roles includes multiple alarm features associated with the role and the association weight between the role and each of the alarm features associated with it.

[0033] The target user determination unit is used to determine a target role from the multiple roles based on the matching degree between each role and the target alarm, and to determine the target user who pushes the target alarm from the users included in the target role based on the processing effect of each user included in the target role on the alarms related to the target alarm, wherein the related alarms and the target alarm belong to the same category;

[0034] The push unit is used to push the target alarm to the target user.

[0035] Optionally, the matching unit includes:

[0036] A matching subunit is used to match each target alarm feature in the at least one target alarm feature with the alarm features associated with each role in the multiple roles, so as to obtain the alarm feature matched by each target alarm feature.

[0037] The matching degree determination subunit is used to determine the matching degree between each of the plurality of roles and the target alarm based on the association weight between the role and the alarm features that match each target alarm feature.

[0038] This application also provides an electronic device, including a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus;

[0039] Memory, used to store computer programs;

[0040] When the processor executes the program stored in the memory, it implements any of the alarm push methods described above.

[0041] This application also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements any of the alarm push methods described above.

[0042] This application also provides a computer program product containing instructions that, when run on a computer, cause the computer to execute any of the alarm push methods described above.

[0043] Beneficial effects of the embodiments in this application:

[0044] The alarm push method provided in this application first extracts features from the description text of the target alarm to determine at least one target alarm feature. Based on the at least one target alarm feature and the alarm association information of each role among multiple roles, the matching degree between each role and the target alarm is determined. Then, based on the matching degree between each role and the target alarm, a target role is determined from the multiple roles. Finally, based on the handling effect of each user included in the target role on the alarms related to the target alarm, the target user for pushing the target alarm is determined from the users included in the target role. The target alarm is then pushed to the target user. It can be seen that this application embodiment can first determine the target role related to the target alarm, and then further determine the target user based on the handling effect of the users included in the target role on the related alarms. This ensures that the determined target user is related to the target alarm and that the target user has a good handling effect on the target alarm. Therefore, this embodiment can efficiently and accurately determine the user for alarm push.

[0045] Of course, implementing any product or method of this application does not necessarily require achieving all of the advantages described above at the same time. Attached Figure Description

[0046] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other embodiments can be obtained based on these drawings.

[0047] Figure 1 This is a schematic flowchart of an alarm push method provided in an embodiment of this application;

[0048] Figure 2 This is another flowchart illustrating the alarm push method provided in the embodiments of this application;

[0049] Figure 3 This is another flowchart illustrating the alarm push method provided in the embodiments of this application;

[0050] Figure 4 A schematic diagram of each module for implementing the alarm push method provided in the embodiments of this application;

[0051] Figure 5 This is a schematic diagram of the alarm push device provided in the embodiments of this application;

[0052] Figure 6 This is a schematic diagram of the structure of the electronic device provided in the embodiments of this application. Detailed Implementation

[0053] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art based on this application are within the scope of protection of this application.

[0054] This application provides an alarm push method, which can be used in electronic devices such as computers and servers. Figure 1 As shown, the method includes the following steps:

[0055] S101, extract features from the description text of the target alarm to determine at least one target alarm feature.

[0056] S102, based on at least one target alarm feature and the alarm association information of each of the multiple roles, determine the matching degree between each of the multiple roles and the target alarm. The alarm association information of any one of the multiple roles includes the multiple alarm features associated with that role and the association weights between that role and each of its associated alarm features.

[0057] S103. Based on the matching degree between each role and the target alarm among multiple roles, determine the target role from the multiple roles, and based on the processing effect of each user included in the target role on the alarms related to the target alarm, determine the target user to push the target alarm from the users included in the target role.

[0058] S104, push target alerts to the target user.

[0059] In this embodiment, feature extraction is first performed on the descriptive text of the target alarm to determine at least one target alarm feature. Based on the at least one target alarm feature and the alarm association information of each role among multiple roles, the matching degree between each role and the target alarm is determined. Then, based on the matching degree between each role and the target alarm, the target role is determined from the multiple roles. And based on the handling effect of each user included in the target role on the alarms related to the target alarm, the target user to be pushed the target alarm is determined from the users included in the target role. The target alarm is then pushed to the target user. As can be seen, this embodiment can first determine the target role related to the target alarm, and then further determine the target user based on the handling effect of the users included in the target role on the related alarms. This ensures that the determined target user is related to the target alarm and has a good handling effect on the target alarm. Therefore, this embodiment can efficiently and accurately determine the user to be pushed the target alarm.

[0060] Regarding step S101 above, the target alarm can be generated by any device in the enterprise's business system. For example, the characteristics of the target alarm may include: the device name of the device that generated the alarm, the name of the abnormal indicator of the device, the value of the abnormal indicator, the status of the device, etc.

[0061] In one implementation, the BERT-CRF (Bidirectional Encoder Representations from Transformers-Conditional Random Field, a pre-trained language model) sequence labeling model from natural language processing can be used to extract features from the descriptive text of the target alarm to determine at least one target alarm feature.

[0062] For example, BERT-base-chinese (a Chinese-based BERT model) pre-trained model (12 layers of Transformer, 110M parameters) can be used as the embedding layer to convert the description text into a 768-dimensional vector representation, and then output the globally optimal label sequence through the CRF layer. The BERT-CRF model is trained in an end-to-end fine-tuning manner, the loss function is the negative log-likelihood loss of the CRF layer, the optimizer is AdamW (a model training optimizer), the initial learning rate is 2e-5, the number of training epochs is 10, and the batch size is 32. An early stopping strategy is adopted during the training process (stopping when the loss on the validation set does not decrease for 3 consecutive epochs), and the model with the highest F1 value on the validation set is selected as the final model. The label system adopts the BIO (Begin, Inside, Outside) labeling method (for example, the labels include: B-Device Name, I-Device Name, B-Metric Name, I-Metric Name, B-Status Name, I-Status Name, B-Value, I-Value, O-not belonging to any entity), and the training dataset of the model can be labeled enterprise alarm logs.

[0063] Target alarm features can be extracted from the description text of the target alarm through this model. In one implementation, the target alarm feature may be a quintuple structure of <device, metric, status, value, time>. For example, for an alarm message "Server A of the financial system has a problem of excessive CPU usage", the extracted quintuple may be in the following form: {Device: "Server A of the financial system", Metric: "CPU usage", Status: "excessive", Value: NULL, Time: the generation time of the alarm}. It should be noted that the above quintuple is only an example and does not constitute a specific limitation. In some implementations, at least one target alarm feature may be obtained by extracting key information from the quintuple, for example, taking the device, metric, and status in the quintuple as the target alarm features respectively, without considering the actual value and time.

[0064] To ensure the accuracy and completeness of the data, special characters (such as "#", "@") can be uniformly escaped before analysis, common abbreviations (such as "CPU", "RAM (Random Access Memory)") can be mapped to standard full names, and meaningless stop words (such as "de", "le") can be filtered out.

[0065] Regarding step S102 above, roles can be set based on the departments or positions within the enterprise that need to handle alarms. For example, a role can be set for each position. The alarm association information of a role can be recorded in a knowledge graph. This knowledge graph can use roles and alarm features as nodes, and the edges between role nodes and alarm feature nodes represent the association between roles and alarm features. The edge weight is the association weight between roles and alarm features.

[0066] The associated features for different roles can be different or the same. For example, role 1 is associated with feature 1 and feature 2, and role 2 is associated with feature 2 and feature 3. The alarm association information for role 1 includes the association weight between role 1 and feature 1, and the association weight between role 1 and feature 2; the alarm association information for role 2 includes the association weight between role 2 and feature 2, and the association weight between role 2 and feature 3.

[0067] When a new role is added, a role that matches the new role's position can be identified, such as a mature role in the same department and position (whose alarm handling quantity and success rate both exceed the threshold). Then, the alarm association information of the new role can be determined based on the alarm association information of the matching role. For example, the alarm association information of the matching role can be directly used as the alarm association information of the new role.

[0068] Alternatively, user profiling technology can be used to build tags for each role based on their historical behavior data and job position. Then, a collaborative filtering algorithm can be used to recommend similar roles to the new role based on the tags of each role. Finally, the alarm association information of the new role can be determined based on the alarm association information of the similar roles.

[0069] When a deleted role is detected, the alarm association information for the deleted role can also be deleted. If there is an alarm feature that is only associated with the deleted role, the role that matches the job position of the deleted role is identified as the associated role; and / or, the category of alarms that match the alarm feature is identified, and the role that handles the most alarms of that category within a specified time period is identified as the associated role; and then the association between the target alarm feature and the associated role is established.

[0070] This allows for quick and accurate adjustments to alarm configurations when personnel changes occur within the company, ensuring the stable operation of the alarm system and reducing the impact of personnel changes on alarm management. Whether it's a single role or a batch of user changes, the system can complete configuration adjustments in a short time, ensuring the continuity of alarm management and reducing the risk of alarm management chaos caused by personnel changes.

[0071] The association weight between roles and alarm features can be dynamically adjusted. The initial value of the association weight between a role and an alarm feature can be determined based on the handling effect of each user included in that role on the pushed alarms, or it can be set to a default value; subsequently, it can be dynamically adjusted according to the user's handling results of the pushed alarms to discover strongly correlated alarm features under a certain role. The specific process of adjusting the association weight will be described below.

[0072] In one implementation, a pre-defined matching model can be used to determine the target alarm features and the alarm association information for each of the multiple roles. This matching model can be a two-layer GraphSAGE (a type of graph neural network) model. The first layer aggregates the neighbor features from the knowledge graph and outputs a 256-dimensional vector. The second layer combines the aggregated neighbor features and the target alarm features to output a 128-dimensional vector. The activation function used is ReLU (Rectified Linear Function). The final layer connects to a fully connected layer with a sigmoid function to output the matching degree between the target alarm and each role.

[0073] When training the matching model, alarm records can be obtained from enterprise alarm logs as sample alarms. Feature extraction is performed on the sample description text of the sample alarms to obtain sample alarm features in the sample alarm text. The sample alarm features are then input into the matching model to be trained to obtain the predicted matching degree between the sample alarms and each role determined by the matching model based on the alarm association information of each role. Then, the model loss is calculated based on the actual role pushed by the sample alarm and the predicted matching degree to tune the matching model until the model converges, and the trained matching model is obtained.

[0074] If the confidence level of the matching model output is lower than the preset threshold (i.e. the model is uncertain about the extraction result), automatic matching can be skipped, and the alarm can be marked as "to be classified" and sent to the preset alarm review queue. The system administrator or expert user can then manually annotate the alarm, and the annotation results can be added to the model for fine-tuning as new training samples periodically.

[0075] To improve matching efficiency, a distributed computing framework can be used to divide the alarms generated in real time by the business system into multiple parallel nodes for processing based on the hash value of the alarm ID (identity).

[0076] Regarding step S103 above, a specified number of roles with the highest matching degree can be used as target roles, or roles with a matching degree reaching a preset threshold can be used as target roles. A role contains at least one user. For example, roles can be set based on departments or positions within a company, and the users included in a role can be technical personnel in that department or position.

[0077] Alarms related to the target alarm can be alarms belonging to the same or similar category as the target alarm. Alarm categories can be pre-defined as needed, for example, setting 7 main categories and 32 subcategories, such as network-link outage, database-deadlock, and application-response timeout. The alarm category can be carried when the business system sends the target alarm, or it can be obtained through analysis of the target alarm, such as semantic analysis of the descriptive text. Based on this, alarms related to the target alarm's category can be identified from the business system's historical alarms.

[0078] Alarms related to the target alarm can also be alarms whose descriptive text is similar to that of the target alarm. For example, it could be an alarm where the text similarity between the descriptive text of a historical alarm and the descriptive text of the target alarm reaches a threshold.

[0079] This embodiment determines the target user by analyzing the processing effect of alarms related to each user in the target role, thereby enabling the accurate selection of the appropriate user for alarm push.

[0080] In this embodiment, user actions related to alarms can be comprehensively recorded, including processing time, processing method (e.g., values ​​such as: resolve, ignore, forward, escalate, or add a note), and processing result (for resolve operations, further recording whether the alarm was completely resolved; for forwarding operations, recording the target role ID). Each alarm processing operation can be recorded in the database, forming a user behavior log. For example, the user behavior log can be in JSON format with the following fields: {user_id (user ID), alarm_id (alarm ID), action_type (processing method), timestamp_ms (timestamp), result_detail (processing result), extra (extra information)}. This allows recording the user's actions on a specific alarm at a given time, as well as whether the alarm reappeared or was ultimately resolved.

[0081] To determine the effectiveness of the processing, analytical dimensions such as processing time, success rate, or processing method for relevant alarms can be obtained from user behavior logs for each user within the target role. In some examples, at least some of these analytical dimensions can be used to represent the alarm effectiveness; in other examples, the effectiveness can be categorized as good, average, or poor based on processing time, with shorter processing times indicating better effectiveness. If a user processes multiple relevant alarms, the processing time can be the average or median. Similarly, the effectiveness can also be categorized based on the success rate.

[0082] Furthermore, based on the correspondence between processing methods and processing effects, the processing effect of each user within the target role on the relevant alarms can be determined. For example, if the processing method indicates that the user successfully handled the alarm directly, the corresponding processing effect is determined to be good; if the processing method indicates that the user forwarded the alarm, the corresponding processing effect is determined to be medium; if the processing method indicates that the user did not handle the alarm, the corresponding processing effect is determined to be poor. If a user handles multiple related alarms, the mode of the processing methods can be taken.

[0083] Based on this, users whose processing results reach a preset threshold can be selected as target users. For example, users whose processing results are good can be selected as target users.

[0084] In another implementation, user behavior logs can be used to obtain and statistically analyze the handling information of relevant alarms by each user within the target role. This includes analyzing dimensions such as the number of alarms occurring recently, average user processing time, percentage of ignored alarms, percentage of forwarded alarms, standard deviation of processing time, alarm time-period distribution entropy (e.g., information entropy calculated by hourly segments), the rate at which relevant alarms are ignored by other users, and the proportion of alarms ultimately resolved. In some examples, at least some of these analytical dimensions can be used to represent the alarm effectiveness. In other examples, pre-defined data analysis algorithms, such as clustering algorithms and association rule mining algorithms, can be used to categorize users into three types: high-frequency ignored, fast-processed, and repeatedly processed, to represent the processing effectiveness of each user. Fast-processed users indicate that users can effectively handle relevant alarms, while other types indicate alarms that users cannot effectively handle. Users with fast-processed alarms can then be identified as target users.

[0085] Regarding step S104 above, target alarms can be pushed to the target user's network account, email, etc., or they can be pushed to the target user's mobile phone via SMS.

[0086] In one implementation, target alerts can be pushed based on the push strategy corresponding to the target user. The push strategy can be customized, and for example, it may include: push delay, push frequency, display method, alert whitelist / blacklist, etc. In the case of user-defined push strategies, the rationality of these strategies can be verified. A rule engine (the rule base contains hard and soft constraints) checks whether the push strategy conforms to logic and the actual needs of the enterprise. For example, a hard constraint rule example: critical alerts (such as database crashes or core network outages) cannot be prohibited from being pushed; a soft constraint rule example: if a user sets the push time for all alerts to late at night, the system will prompt that this setting may lead to alerts not being processed in a timely manner and provide a reasonable suggestion to "change to only reduce the push frequency at night." For unreasonable settings, users can be required to correct them or provide detailed confirmation information (such as a secondary confirmation pop-up).

[0087] To help users better understand and confirm the effectiveness of their customized push strategies, they can preview the alarm push effects using the simulation function before confirming the strategy. Specifically, based on current alarm data (such as a list of alarms generated recently) and user settings, a time-series prediction model can be used to simulate alarm push behavior over a future period. Data visualization techniques, such as charts, can then be used to display the data to the user, indicating the push time, method, and priority of each alarm, with zooming and hovering options for detailed viewing. This helps avoid negative impacts caused by user errors, allowing users to customize their strategies with greater confidence.

[0088] In one possible embodiment, the determination of the matching degree between each of the multiple roles and the target alarm based on at least one target alarm feature and alarm association information of each of the multiple roles includes:

[0089] Step A1: Match each target alarm feature in at least one target alarm feature with the alarm features associated with each role in multiple roles to obtain the alarm feature matched by each target alarm feature.

[0090] Step A2: For each of the multiple roles, determine the matching degree between the role and the target alarm based on the association weight between the role and the alarm features that match each target alarm feature.

[0091] In this embodiment, each target alarm feature is matched with the alarm features associated with each role to obtain the alarm features matched by each target alarm feature. Then, based on the association weight between the role and the alarm features matched by each target alarm feature, the matching degree between the role and the target alarm can be accurately determined.

[0092] Regarding step A1 above, in one implementation, for each target alarm feature, the feature similarity between the target alarm feature and each alarm feature can be calculated, and then the alarm features with similarity reaching a threshold, or the specified number of alarm features with the highest similarity, can be used as alarm features that match the target alarm feature.

[0093] Regarding step A2 above, in one implementation, for each role, the association weights between the role and the alarm features that match each target alarm feature can be added together to obtain the matching degree between the role and the target alarm.

[0094] In one possible embodiment, the alarm association information of the target role includes the association weight between the target role and reference alarm features. The reference alarm features are alarm features among the alarm features associated with each of the multiple roles that match any one of the at least one target alarm feature. Figure 2 As shown, the alarm push method also includes:

[0095] S201, Obtain the target user's processing result for the target alarm.

[0096] S202, if the obtained processing result indicates that the target user is processing or forwarding the target alarm, then increase the correlation weight between the target role and the reference alarm feature.

[0097] S203, if the obtained processing result indicates that the target user has not processed the target alarm, then reduce the association weight between the target role and the reference alarm feature.

[0098] In this embodiment, the association weight between the role and the alarm feature is adjusted based on the processing result, which can make the matching degree between the subsequently determined alarm and the role more accurate.

[0099] Regarding step S201 above, the processing result can be obtained from the enterprise alarm log. The processing result can include: processed, forwarded, or unprocessed. Specifically, "processed" means that after the alarm is pushed to the user, the user processes the alarm within a specified time; "unprocessed" means that after the alarm is pushed to the user, the user does not process the alarm within a specified time; "forwarded" means that the target user forwards the target alarm to other users.

[0100] For steps S202-S203 above, in one implementation, the Q-Learning algorithm (a reinforcement learning algorithm based on value iteration) can be used to automatically learn and adjust the associated weights. The state space S is defined as the alarm features of the current alarm, the action space A includes the associated target roles, and the reward function R is designed as follows: if the user handles or forwards the alarm, a positive reward is given; if the user does not handle the alarm, a negative reward is given.

[0101] For example, Q-Learning uses a learning rate α of 0.1, a discount factor γ of 0.9, and an ε-greedy exploration strategy (a reinforcement learning exploration and exploitation strategy). The initial exploration rate ε = 0.3, which decreases linearly with the number of training rounds, decreasing by 0.05 every 100 rounds, down to a minimum of 0.05. When the exploration rate falls below 0.1, the action with the highest current Q value can be selected with a probability of 0.9, while new associations are randomly explored with a probability of only 0.1. Thus, if a new system is launched and an alarm related to that system occurs, the system can automatically explore and establish association weights between the alarm and the relevant personnel responsible for the system by analyzing the alarm description text and processing results, and continuously optimize these associations in subsequent processes.

[0102] In one possible embodiment, the multiple roles include reference roles that are different from the target role, and the alarm association information of the reference roles includes the association weight between the reference roles and reference alarm features. The alarm push method further includes:

[0103] If the obtained processing result indicates that the target user has processed or forwarded the target alarm, the association weight between the reference role and the reference alarm feature is reduced; or, if the obtained processing result indicates that the target user has not processed the target alarm, the association weight between the reference role and the reference alarm feature is increased.

[0104] In this embodiment, for reference roles other than the target role, if the target user processes or forwards the target alarm, the association weight between the reference role and its associated reference alarm features is reduced; conversely, if the target user does not process the target alarm, the association weight between the reference role and the reference alarm features is increased. This weakens the relationship between the target alarm and the reference role when the target user effectively processes the target alarm; conversely, it strengthens the relationship when the target user cannot effectively process the target alarm, enabling the subsequent discovery of new roles from among the reference roles to handle the alarm. Therefore, this embodiment makes the matching degree between subsequently determined alarms and roles more accurate.

[0105] In one possible embodiment, determining the target user for pushing the target alarm from the users included in the target role based on the processing effect of each user in the target role on the target alarm-related alarms includes:

[0106] Based on the handling effect of each user in the target role on the target alarm and the alarm level of the target alarm, the target users to be pushed the target alarm are determined from the users in the target role.

[0107] In this embodiment, the target user for pushing the target alarm is determined based on the user's processing effect on the target alarm and the alarm level of the target alarm. Different push methods can be adopted adaptively according to the alarm level of the alarm.

[0108] For example, in one implementation, different alarm levels can be pre-set based on the urgency of different alarms, and corresponding handling effects can be set for each alarm level. This allows for the determination of the target handling effect corresponding to the alarm level of the target alarm, followed by identifying users from among the users included in the target role who achieve the target handling effect for the relevant alarms, and designating them as target users. Furthermore, the number of alarms handled by a user can be further considered. For instance, users who achieve the target handling effect for relevant alarms and have a relatively small number of alarms handled can be designated as target users. A small number of alarms could mean that the number of alarms handled is less than a preset threshold or less than the number of alarms handled by other users in the target role, thus preventing any single user from handling too many alarms and ensuring effective alarm handling.

[0109] For example, the number of target users corresponding to the alarm level of a target alarm can be determined based on the correspondence between alarm levels and the number of users, where the number of users can be directly proportional to the alarm level; furthermore, the target number of users with the best processing effect can be selected from among the users included in the target role as the target users. In one possible embodiment, such as Figure 3 As shown, the alarm push method also includes:

[0110] S301, determine the target push priority for pushing target alarms based on the target user's handling effect on target alarms and / or the alarm level of the target alarm.

[0111] The above-mentioned push of target alerts to target users includes:

[0112] S302, push target alarms to target users according to the push strategy corresponding to the target push priority.

[0113] In this embodiment, a push priority is set in advance for alarms, so different push strategies can be adopted to push alarms adaptively for different alarms, which makes the push strategy more reasonable and thus more conducive to the effective handling of alarms.

[0114] For steps S301-S302 above, the push strategy can include: push delay, push frequency, and display method. Each level of push priority can correspond to a push strategy. For example, the higher the push priority, the lower the push delay, the higher the push frequency, and the more attention-grabbing the display method (such as displaying a red message pop-up on the user's terminal). The lower the push priority, the higher the push delay, the lower the push frequency, and the less attention-grabbing the display method.

[0115] In one implementation, the user's handling effect on each type of alarm can be periodically detected. If the handling effect indicates that the user can effectively handle the alarm of that type after it is pushed to the user (e.g., good handling effect), the push priority of the corresponding alarm category for that user is increased. Conversely, if the handling effect indicates that the user cannot effectively handle the alarm of that type (e.g., poor handling effect), the push priority of the corresponding alarm category for that user is decreased. Based on this, the push priority of the target alarm category for the target user can be obtained, thus obtaining the target push priority.

[0116] In one implementation, different alarm levels can be pre-set based on the urgency of different alarms, and corresponding push priorities can be set for different alarm levels. Based on this, the push priority corresponding to the alarm level of the target alarm can be obtained, thus obtaining the target push priority.

[0117] In one implementation, the target push priority can be determined by combining the processing effect and the alarm level. For example, the push priority can be determined first based on the processing effect and the alarm level, and then the average of the two determined push priorities can be used as the target push priority.

[0118] For example, different alarm levels can be configured with corresponding alarm effects and push priorities. Based on this, the target alarm effect corresponding to the target alarm level can be obtained. If the target user's handling of the relevant alarm is the same as the target alarm effect, then the push priority corresponding to the target alarm level is directly used as the target push priority. If the target user's handling of the relevant alarm is lower than the target alarm effect, then the push priority corresponding to the target alarm level is increased to obtain the target push priority. This allows for more frequent and attention-grabbing pushes to the target alarm when the target user's handling of the relevant alarm is poor, increasing the probability of the target alarm being successfully handled. Conversely, if the target user's handling of the relevant alarm is higher than the target alarm effect, then the push priority corresponding to the target alarm level can be decreased to obtain the target push priority.

[0119] In one implementation, such as Figure 4As shown, the alarm push method provided in this application embodiment can be implemented by the collaborative work of the following modules: alarm-role intelligent association module 401, behavior-driven strategy adjustment module 402, user change automatic processing module 403, and manual strategy adjustment support module 404. Wherein:

[0120] The alarm-role intelligent association module 401 is used to extract features from the descriptive text of the target alarm generated by the target system to determine at least one target alarm feature; based on the at least one target alarm feature and the alarm association information of each role in multiple roles, determine the matching degree between each role in multiple roles and the target alarm; based on the matching degree between each role in multiple roles and the target alarm, determine the target role from the multiple roles, and based on the handling effect of each user included in the target role on the alarms related to the target alarm, determine the target user to push the target alarm from the users included in the target role; and adjust the association weight based on the user's handling effect on the target alarm.

[0121] The behavior-driven strategy adjustment module 402 is used to determine the target push priority of the target alarm based on the target user's handling effect on the target alarm and / or the alarm level of the target alarm; and to push the target alarm to the target user according to the push strategy corresponding to the target push priority.

[0122] The user change automatic processing module 403 is used to, when a new role is detected, determine a role matching the job position of the new role as a reference role; determine the alarm association information of the new role based on the alarm association information of the reference role; and determine the corresponding push strategy for the role alarm category pair containing the category of the new role and the alarm based on the push strategy corresponding to the category of the reference role and the alarm. When a deleted role is detected, the alarm association information of the deleted role and the push strategy corresponding to the category of the role alarm pair containing the category of the deleted role and the alarm are deleted; if there is a target alarm feature associated only with the deleted role, then a role matching the job position of the deleted role is determined as an associated role; and / or, the category of alarms matching the target alarm feature is determined, and the role that processes the most alarms of that category within a specified time period is determined as the associated role; and the association relationship between the target alarm feature and the associated role is established.

[0123] The manual policy adjustment support module 404 provides an intuitive visual interface for users to manually adjust custom push policies. It integrates manually adjusted custom push policies with automatically generated default push policies and verifies the rationality of custom push policies. Furthermore, based on the historical times when alarms of this category were generated, it can predict the time when alarms of this category will be generated within a specified future time period; and simulate push notifications for this category of alarms based on the predicted time and the custom push policy.

[0124] In summary, this embodiment achieves accurate, intelligent, and automatic alarm delivery, effectively reducing the burden on enterprise operations and maintenance personnel, improving overall enterprise operations and maintenance efficiency, and mitigating business risks caused by poor alarm management. Enterprise operations and maintenance personnel can then focus more on resolving critical business issues, significantly improving the stability and reliability of enterprise operations and providing strong support for enterprise development.

[0125] Based on the same inventive concept, embodiments of this application also provide an alarm push device, such as... Figure 5 As shown, the device includes:

[0126] The feature extraction unit 501 is used to extract features from the descriptive text of the target alarm and determine at least one target alarm feature.

[0127] The matching unit 502 is used to determine the matching degree between each of the multiple roles and the target alarm based on the at least one target alarm feature and the alarm association information of each role in the multiple roles. The alarm association information of any role in the multiple roles includes multiple alarm features associated with the role and the association weight between the role and each of the alarm features associated with it.

[0128] The target user determination unit 503 is used to determine a target role from the multiple roles based on the matching degree between each role and the target alarm, and to determine the target user who pushes the target alarm from the users included in the target role based on the processing effect of each user included in the target role on the alarm related to the target alarm.

[0129] The push unit 504 is used to push the target alarm to the target user.

[0130] In one possible embodiment, the matching unit 502 includes:

[0131] A matching subunit is used to match each target alarm feature in the at least one target alarm feature with the alarm features associated with each role in the multiple roles, so as to obtain the alarm feature matched by each target alarm feature.

[0132] The matching degree determination subunit is used to determine the matching degree between each of the plurality of roles and the target alarm based on the association weight between the role and the alarm features that match each target alarm feature.

[0133] In one possible embodiment, the alarm association information of the target role includes the association weight between the target role and a reference alarm feature, wherein the reference alarm feature is an alarm feature among the alarm features associated with each of the plurality of roles that matches any of the at least one target alarm feature, and the apparatus further includes:

[0134] The processing result acquisition unit is used to acquire the processing result of the target user on the target alarm;

[0135] The weight adjustment unit is used to increase the association weight between the target role and the reference alarm feature if the obtained processing result indicates that the target user has processed or forwarded the target alarm; or to decrease the association weight between the target role and the reference alarm feature if the obtained processing result indicates that the target user has not processed the target alarm.

[0136] In one possible embodiment, the plurality of roles includes reference roles that are different from the target role, and the alarm association information of the reference roles includes the association weight between the reference roles and the reference alarm features;

[0137] The weight adjustment unit is also used for:

[0138] If the obtained processing result indicates that the target user has processed or forwarded the target alarm, then the association weight between the reference role and the reference alarm feature is reduced; or, if the obtained processing result indicates that the target user has not processed the target alarm, then the association weight between the reference role and the reference alarm feature is increased.

[0139] In one possible embodiment, the target user determination unit 503 is specifically used for:

[0140] Based on the processing effect of each user in the target role on the alarms related to the target alarm and the alarm level of the target alarm, the target user to be pushed the target alarm is determined from the users in the target role.

[0141] In one possible embodiment, the device further includes:

[0142] The priority determination unit is used to determine the target push priority for pushing the target alarm based on the target user's handling effect on the target alarm and / or the alarm level of the target alarm.

[0143] The push unit 504 is specifically used for:

[0144] The target alarm is pushed to the target user according to the push strategy corresponding to the target push priority.

[0145] This application also provides an electronic device, such as... Figure 6 As shown, it includes a processor 601, a communication interface 602, a memory 603, and a communication bus 604, wherein the processor 601, the communication interface 602, and the memory 603 communicate with each other through the communication bus 604.

[0146] Memory 603 is used to store computer programs;

[0147] The processor 601, when executing the program stored in the memory 603, implements the steps of any of the above alarm push methods.

[0148] The communication bus mentioned in the above electronic devices can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. This communication bus can be divided into address bus, data bus, control bus, etc. For ease of illustration, only one thick line is used to represent it in the diagram, but this does not indicate that there is only one bus or one type of bus.

[0149] The communication interface is used for communication between the aforementioned electronic devices and other devices.

[0150] The memory may include random access memory (RAM) or non-volatile memory (NVM), such as at least one disk storage device. Optionally, the memory may also be at least one storage device located remotely from the aforementioned processor.

[0151] The processors mentioned above can be general-purpose processors, including central processing units (CPUs), network processors (NPs), etc.; they can also be digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.

[0152] In another embodiment provided in this application, a computer-readable storage medium is also provided, which stores a computer program that, when executed by a processor, implements the steps of any of the above-described alarm push methods.

[0153] In another embodiment provided in this application, a computer program product containing instructions is also provided, which, when run on a computer, causes the computer to execute any of the alarm push methods described in the above embodiments.

[0154] In the above embodiments, implementation can be achieved entirely or partially through software, hardware, firmware, or any combination thereof. When implemented using software, it can be implemented entirely or partially as a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that integrates one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid state disk (SSD)).

[0155] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0156] The various embodiments in this specification are described in a related manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the embodiments of apparatus, electronic devices, and storage media are basically similar to the method embodiments, so the descriptions are relatively simple; relevant parts can be referred to the descriptions of the method embodiments.

[0157] The above description is merely a preferred embodiment of this application and is not intended to limit the scope of protection of this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application are included within the scope of protection of this application.

Claims

1. An alarm push method, characterized in that, The method includes: Feature extraction is performed on the descriptive text of the target alarm to determine at least one target alarm feature; Based on the at least one target alarm feature and the alarm association information of each role among the multiple roles, the matching degree between each role and the target alarm is determined. The alarm association information of any role among the multiple roles includes multiple alarm features associated with the role and the association weight between the role and each of its associated alarm features. Based on the matching degree between each of the multiple roles and the target alarm, a target role is determined from the multiple roles, and based on the processing effect of each user included in the target role on the alarms related to the target alarm, a target user for pushing the target alarm is determined from the users included in the target role. The target alarm is pushed to the target user.

2. The method according to claim 1, characterized in that, The step of determining the matching degree between each of the multiple roles and the target alarm based on the at least one target alarm feature and the alarm association information of each role among the multiple roles includes: Each target alarm feature in the at least one target alarm feature is matched with the alarm feature associated with each role in the multiple roles to obtain the alarm feature matched by each target alarm feature; For each of the multiple roles, the matching degree between the role and the target alarm is determined based on the association weight between the role and the alarm features that match each target alarm feature.

3. The method according to claim 1 or 2, characterized in that, The alarm association information of the target role includes the association weight between the target role and the reference alarm feature, wherein the reference alarm feature is an alarm feature that matches any one of the at least one target alarm feature among the alarm features associated with each of the plurality of roles. The method further includes: Obtain the processing result of the target user on the target alarm; If the obtained processing result indicates that the target user processes or forwards the target alarm, then the association weight between the target role and the reference alarm feature is increased; or, If the processing result indicates that the target user has not processed the target alarm, then the association weight between the target role and the reference alarm feature is reduced.

4. The method according to claim 3, characterized in that, The plurality of roles includes reference roles that are different from the target role, and the alarm association information of the reference roles includes the association weight between the reference roles and the reference alarm features; The method further includes: If the obtained processing result indicates that the target user processes or forwards the target alarm, then the association weight between the reference role and the reference alarm feature is reduced; or, If the processing result indicates that the target user has not processed the target alarm, then the association weight between the reference role and the reference alarm feature is increased.

5. The method according to claim 1, characterized in that, The step of determining the target user to push the target alarm from the users included in the target role, based on the processing effect of each user in the target role on the target alarm-related alarms, includes: Based on the processing effect of each user in the target role on the alarms related to the target alarm and the alarm level of the target alarm, the target user to be pushed the target alarm is determined from the users in the target role.

6. The method according to claim 1, characterized in that, The method further includes: Based on the target user's handling effect on the target alarm and / or the alarm level of the target alarm, determine the target push priority for pushing the target alarm; The step of pushing the target alarm to the target user includes: The target alarm is pushed to the target user according to the push strategy corresponding to the target push priority.

7. An alarm push device, characterized in that, The device includes: The feature extraction unit is used to extract features from the descriptive text of the target alarm and determine at least one target alarm feature. A matching unit is used to determine the matching degree between each of the multiple roles and the target alarm based on the at least one target alarm feature and the alarm association information of each role among the multiple roles. The alarm association information of any one of the multiple roles includes multiple alarm features associated with the role and the association weight between the role and each of the alarm features associated with it. The target user determination unit is used to determine a target role from the multiple roles based on the matching degree between each role and the target alarm, and to determine the target user who pushes the target alarm from the users included in the target role based on the processing effect of each user included in the target role on the alarms related to the target alarm. The push unit is used to push the target alarm to the target user.

8. The apparatus according to claim 7, characterized in that, The matching unit includes: A matching subunit is used to match each target alarm feature in the at least one target alarm feature with the alarm features associated with each role in the multiple roles, so as to obtain the alarm feature matched by each target alarm feature. The matching degree determination subunit is used to determine the matching degree between each of the plurality of roles and the target alarm based on the association weight between the role and the alarm features that match each target alarm feature.

9. An electronic device, characterized in that, It includes a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus; Memory, used to store computer programs; A processor, when executing a program stored in memory, implements the method of any one of claims 1-6.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the method described in any one of claims 1-6.

Images