73 results about "Alarm analysis" patented technology

The invention discloses a direct current B code wave recording alarm analysis device and method based on an FPGA, and relates to the technical field of power system automation and signal analysis, and the device comprises an FPGA collection module which is used for collecting a TTL level signal of a direct current B code in real time at a preset sampling frequency, recording a high-precision timestamp of each sampling point, and carrying out the subsequent pulse parameter calculation; the pulse width measurement module is connected with the FPGA acquisition module, is used for calculating the pulse width of the current pulse based on the rising edge timestamp and the falling edge timestamp of the signal, triggering a wave recording module, and is used for starting wave recording operation when the pulse width is detected to exceed a preset threshold range or abnormity occurs for a plurality of times continuously; collecting complete waveform data before and after the fault; the DC B code wave recording alarm analysis device and method based on the FPGA improve the intelligent level, response speed and fault visualization capability of a B code monitoring system, and are especially suitable for high-reliability monitoring and management scenes of key synchronization signals in a DC system.

The invention relates to an intelligent alarm analysis method and device, and a medium. The method comprises the following steps: receiving aggregated alarm data; matching alarm rules in the aggregated alarm data with strong rules in an intelligent rule base; if the strong rule is hit, performing attack judgment based on the strong rule; if the strong rule is not hit, preliminarily analyzing the aggregated alarm data; based on a preliminary analysis result, issuing a traffic acquisition task to acquire associated traffic data; analyzing the associated flow data by using an AI alarm analysis model, and outputting an attack judgment result; generating a security event report based on the attack judgment result; combining the security event report with the corresponding aggregated alarm data and the attack judgment result into a security event; and outputting the security event to a security event early warning notification module. By constructing an automatic and multi-level analysis decision system, various problems confronted by traditional manual analysis are effectively solved.

The invention discloses a root cause alarm analysis method and system based on time sequence association and multi-modal fusion, and the method comprises the steps: taking digital twin dynamic threshold cleaning as a core, fusing multi-source data time sequence alignment verification, and forming a multi-source data set of time sequence alignment and preliminary restoration through exception handling and cross-system time consistency verification; a cleaning threshold is optimized in combination with a working condition to filter noise, a label confidence weighting method is fused, confidence is given to a label through twin simulation, and a multi-modal data set with a multi-dimensional label is constructed. A learning model is constructed and trained, exclusive feature extraction branches are designed for multi-source data, a twin working condition adaptation enhancement module is introduced to strengthen core modal extraction, and the proportion of abnormal modals in fusion is reduced by means of a dynamic attention filtering mechanism. Based on the model and a twinning system, root cause penetration type positioning is completed through dynamic sequencing of root cause confidence in combination with a twinning reduction time sequence. And the root cause analysis efficiency and accuracy are improved.

The invention belongs to the field of information network security. The invention specifically discloses an agent-based logic vulnerability detection method, system and device, and a medium. The method comprises the following steps: capturing service system request response data through network traffic, identifying an HTTP protocol through a port and protocol features, filtering non-HTTP request data, extracting and analyzing the request data, standardizing extracted parameters, continuously collecting and analyzing through an API analysis agent, improving the semantic analysis capability of a large model, perfecting a logic relation graph, and improving the semantic analysis efficiency of the large model. A complete vulnerability life cycle data link is constructed through a vulnerability analysis agent, the system logic vulnerability mining efficiency and coverage are improved, and automatic logic vulnerability alarm and disposal can be realized and the risk disposal real-time performance is improved by accessing the agent to a network security protection product, an alarm analysis platform and other systems.

The invention relates to the technical field of data analysis, and particularly provides a keyword-based alarm analysis method and device, a medium and equipment, and the method can comprise the steps: obtaining the occurrence frequency of a keyword in a to-be-processed data stream in a preset time period; obtaining an abnormal parameter of the keyword based on the average frequency of the keyword in the corresponding historical preset time period and a pre-constructed target model; wherein the target model is a distribution class model based on probability statistics; and determining whether alarm information is generated or not according to the abnormal parameters and the occurrence frequency. According to some embodiments of the invention, accurate and automatic monitoring of keyword abnormity can be realized, false alarm and missing alarm of alarm are effectively reduced, and alarm precision is improved.

The invention discloses an alarm confirmation method and device and a storage medium, and the method comprises the steps: obtaining a to-be-confirmed alarm which has been notified to an operation and maintenance system which comprises at least one of a business system, a technical system and an infrastructure system; and matching the to-be-confirmed alarm with confirmation rules to determine whether the to-be-confirmed alarm needs to establish an order, the confirmation rules including an order establishment confirmation rule and an order non-establishment confirmation rule. According to the technical scheme, the problems that in the prior art, alarm information is not accurate, frequent manual confirmation is needed, the alarm analysis workload is increased, and the application range is narrow are at least solved.

The application discloses a video alarm method, device and equipment and a computer readable storage medium. The method comprises the following steps: detecting a first video image by using a first alarm target detection model to obtain a detection result; obtaining a first feature group, wherein the first feature group at least comprises a time feature value, a position feature value and a model feature value corresponding to a first target; matching the same type of feature values in the first feature group and a second feature group to obtain a matching result, wherein the second feature group at least comprises one or more feature values selected from the time feature value, the position feature value and the model feature value corresponding to a second target by a person; determining an alarm analysis result of the first target according to the matching result between the first feature group and a feature group corresponding to at least one false alarm target; and outputting alarm information corresponding to the first target when it is determined according to the alarm analysis result that the first target needs to be alarmed. The application reduces the false alarm rate of video alarm.

The invention discloses an alarm integration method applied to a signal centralized monitoring system, and the method comprises the steps: carrying out the classification of an alarm integration model based on a business mechanism for a large number of common invalid alarms on site; pre-defined alarm integration rules are written for the alarm integration model, and the signal centralized monitoring system carries out alarm integration according to the pre-defined alarm integration rules in a default mode; the alarm analysis module performs alarm analysis according to the collected data, and enters a short-time cache queue after an alarm occurs; when the alarm in the cache accords with a predefined alarm integration rule, sending the alarm after alarm integration for prompting; and displaying the alarm after alarm integration on a real-time alarm interface and a historical alarm interface. The real fault source of the equipment can be quickly and accurately identified, the safety risk of railway operation is reduced, and the operation and maintenance efficiency is improved.

The invention relates to an alarm information processing method and device, computer equipment, a computer readable storage medium and a computer program product. The method comprises the following steps: receiving a plurality of original alarm events of a target system; aggregating the plurality of original alarm events based on the alarm time to obtain an aggregated alarm event; performing alarm text semantic analysis on each aggregated alarm event to obtain an alarm object related to the aggregated alarm event and at least one alarm index item corresponding to the alarm object; obtaining historical value data of each alarm index item, and performing association relationship mining on a change condition of the historical value data to obtain an index value association relationship between the alarm index items; determining an alarm causal relationship between the aggregated alarm events according to the index value association relationship; and merging the aggregated alarm events according to the alarm causal relationship to obtain a target alarm event corresponding to the target system. By adopting the method, the alarm analysis efficiency and accuracy can be improved.

The invention relates to the technical field of network security, in particular to a network security protection system and method. The system comprises an original flow data acquisition module, a metadata generation module, a data storage management module, a data feature extraction module, a feature vector anomaly detection module, a threat alarm analysis module and a threat alarm response execution module which are connected in sequence. According to the method, through full-flow capture and deep metadata analysis, a complete and uniform network behavior view is constructed, and the threat discovery and perception capability is remarkably improved. Unsupervised anomaly detection is carried out by using a deep learning model such as an auto-encoder, a normal network behavior mode can be adaptively learned, unknown threats and variant attacks are effectively identified, and the false alarm rate is reduced. The risk assessment is performed by fusing the multi-source data, and the response instruction is automatically generated and executed based on the assessment result, so that the closed-loop automatic disposal of the security event is realized, the response time is greatly shortened, and the dependence on manual intervention is reduced.

The invention relates to an alarm analysis method and device and computer equipment. The method comprises the following steps: acquiring attack alarm information, wherein the attack alarm information represents that an attack is suspected to be detected; the attack alarm information is analyzed, the confidence coefficient of the attack alarm information is obtained, a first alarm judgment result of the attack alarm information is obtained, the first alarm judgment result is one of multiple alarm judgment results, and each alarm judgment result corresponds to a rechecking strategy; determining a target review strategy from review strategies corresponding to the multiple alarm judgment results based on the confidence; analyzing the attack alarm information by using the target recheck strategy to obtain a second alarm judgment result of the attack alarm information; and determining an alarm analysis result of the attack alarm information based on the first alarm judgment result and the second alarm judgment result. By adopting the method, the accuracy of alarm analysis can be improved.

The application provides a data processing method, a big data processing platform, an electronic device and a storage medium, pre-processes obtained index data; determines a target open source event processing model matched with the index data from each open source event processing model pre-set according to data characteristics of the pre-processed index data and model characteristics of each open source event processing model pre-set; and performs alarm analysis processing on the index data by using a target CEP alarm analysis rule pre-set on the target open source event processing model to obtain corresponding alarm information. The application can solve the problems that there is no mature and efficient rule to process the monitored data when data is abnormal or a system fails, and corresponding alarm information is generated in time for an operation and maintenance personnel to perform corresponding emergency processing according to the alarm information, and that data formats are quite different and affect the operation performance of a production system.

The invention discloses an alarm correlation analysis method, device and equipment and a storage medium, and relates to the technical field of data processing, and the method comprises the steps: carrying out the feature extraction of target alarm data, and obtaining the multi-mode alarm feature information in the target alarm data; performing alarm data association analysis based on the target alarm data and the multi-modal alarm feature information through a preset alarm association model to generate alarm data association representation; performing clustering analysis on the alarm data association representation, and generating an alarm association group and an alarm attack chain identification result according to a clustering analysis result; and generating an alarm association analysis result based on the alarm association group and the alarm attack chain identification result. According to the technical scheme, the technical problem that in the prior art, a rule-based alarm correlation analysis method depends on manual definition and maintenance of rules, and consequently the efficiency and flexibility of alarm analysis are not high is solved.

The invention belongs to the technical field of power system network security and smart power grid data analysis, and discloses a smart power grid alarm analysis attack detection method, system and device and a medium, and the method comprises the steps: carrying out the preprocessing of multi-dimensional time series data; performing parameter initialization on the graph neural network model; inputting the processed multi-dimensional time sequence data into the initialized graph neural network model for training to obtain a prediction result of the current alarm; performing calculation and analysis by using a dual mahalanobis distance mechanism to obtain dual-dimension mahalanobis distance representation; distinguishing normal data from attack data according to a preset threshold value; performing integration processing based on the attack data, the prediction result and the actual alarm data; analyzing and positioning by using an attention mechanism to obtain an attack source of the smart grid; and optimizing parameters for the initialized graph neural network model and the attack source, and adjusting a Mahalanobis distance threshold to obtain a final detection threshold. The model can adapt to a complex power grid environment and high-dimensional alarm data.

The invention discloses an alarm analysis method, device and product applied to a distributed system. Comprising the following steps: acquiring at least one alarm data stored in a distributed system, and classifying the alarm data according to a node identifier of each execution node in the system to obtain an alarm data group corresponding to each execution node; for each alarm data group, dividing the alarm data into at least one alarm data subgroup according to reason codes contained in any two alarm data in the alarm data group; according to index data corresponding to at least one index in the operation and maintenance knowledge set and the alarm data subgroup, inputting the index data and the alarm data subgroup into a first target model to determine a first identifier of each reason code; and determining a target alarm group according to the first identifier in each alarm data of the same node identifier, and inputting the index data of the reason code of the first identifier in the target alarm group, the operation and maintenance knowledge, the repair suggestion and the alarm content template cue word into a second target model to obtain an alarm analysis report. And the interpretability of alarm analysis is improved.

The application relates to an alarm analysis method and device based on wind farm operation data and machine learning, and relates to the technical field of power system data processing. The application comprises the following steps: obtaining original collection data of wind farm equipment; based on a pre-constructed alarm code information library, the original collection data is analyzed into alarm trigger records and reset records, and based on a preset dynamic anti-shake window and the alarm trigger records, first alarm analysis data is determined; based on a pre-constructed expert library, the first alarm analysis data is subjected to level matching and hierarchical processing, and second alarm analysis data is obtained; the second alarm analysis data is encapsulated, a push strategy is determined based on the alarm code level of the second alarm analysis data, and based on the push strategy, the encapsulated second alarm analysis data is sent to a corresponding downstream application system. The application has the technical effects of accurately analyzing wind farm equipment alarm information, filtering shaking, hierarchical processing, and reasonably pushing alarm information according to the level.

The invention provides an alarm statistical method, device and equipment of a rail transit system, a medium and a product, and relates to the technical field of rail transit, and the method comprises the steps: obtaining the operation state data of the rail transit system through a multi-source heterogeneous data obtaining interface; generating structured alarm information under the condition that the running state data triggers a state threshold value; and carrying out alarm counting statistics on the structured alarm information, and determining an alarm statistics result of the rail transit system. According to the technical scheme, the operation state data of the rail transit system in the operation process are obtained based on the multi-source heterogeneous data obtaining interface, alarm analysis is carried out according to the multi-source operation state data to determine the structured alarm information, alarm counting statistics is carried out based on the structured alarm information, and the alarm statistics result of the rail transit system is determined. The manpower consumption is reduced, the accuracy of the alarm statistical result is improved, and the alarm statistical result obtained by the obtained multi-source operation state data can meet the subsequent efficient maintenance requirement.

The invention relates to the technical field of network security, in particular to a network security alarm log field large model training method, which comprises the following steps of: performing continuous pre-training on a first large language model by adopting a network security corpus to obtain a pre-training model; acquiring a network security alarm log, formulating a grade standard, and performing preliminary danger grade labeling through a second large language model to obtain a labeled alarm log data set; performing coarse-to-fine reasoning enhancement supervision fine adjustment on the annotated alarm log data set to obtain a strategy model; and constructing a preference data set based on analysis error data, and performing preference optimization on the model through the preference data set to obtain a final model. According to the method, the analysis requirement in the field of network security alarm logs is more accurately met, effective noise reduction is performed on the security alarm logs, the performance of the model in a network security alarm analysis task is remarkably improved, the accuracy of danger level judgment is improved, and the manual processing cost is reduced.

The invention belongs to the technical field of nuclear power production, and provides an alarm analysis system for a nuclear power plant, which comprises an analysis module, and a response module and a display module connected with the analysis module, wherein the response module is configured to adopt a regulation-based alarm response, automatically call a matched response operation according to an alarm signal, and provide decision analysis for the analysis module in combination with the called response operation and the display module; the analysis module is configured to analyze the alarm signal, generate single alarm point performance evaluation data and alarm triggering indexes, analyze time characteristics in the generated alarm triggering indexes, identify whether response delay or abnormity exists or not, and optimize and identify alarm points; and the display module is configured to adopt a configurable alarm window additionally provided with font paragraphs, set different alarm window font formats for different alarm areas, and meet the display requirements of different areas and different types of alarm information.

The present application relates to the field of artificial intelligence and intelligent operation and maintenance, in order to solve the problem of the coupling of current alarm spatiotemporal semantics and deep pruning of large model inference and the lack of exclusive pruning strategy under TI system alarm scene, a large language model dynamic pruning method and system based on alarm semantic spatiotemporal association graph are proposed, including: real-time collection and preprocessing of multi-source alarm data of the analysis object, construction of alarm tuples, construction of semantic spatiotemporal association graph with each alarm as a node, analysis of the semantic spatiotemporal association graph using a lightweight graph attention network, identification of key alarm subgraphs, generation of dynamic pruning masks, input of alarm tuples and dynamic pruning masks into a large language model, selective computation skipping of Token corresponding to non-key alarms during inference, dynamic pruning, and generation of diagnosis results. The method can guide the large language model to selectively skip non-key computation paths during inference, achieving efficient and accurate alarm analysis.

The invention discloses an operation and maintenance monitoring alarm rule optimization method and device, electronic equipment and a storage medium, which are used for solving the technical problem that the current operation and maintenance monitoring alarm system and alarm analysis technology cannot fundamentally solve the problems of alarm storm and false alarm. The method comprises the following steps: acquiring an alarm record processing result table corresponding to an alarm historical record; based on the alarm record processing result table and a preset cue word, generating an alarm rule optimization scheme in combination with the alarm rule knowledge base and the integrated large model; and when an implementation determining instruction is detected, performing alarm rule updating according to the alarm rule optimization scheme, and obtaining an updated alarm rule of the historical alarm rule corresponding to the alarm record processing result table.

The application provides an alarm automatic processing system and method based on a locally deployed large model. The system includes an alarm access unit configured to generate standardized alarm data; an intelligent analysis engine configured to generate a search query element corresponding to an alarm event; a knowledge enhancement component configured to build an alarm handling knowledge base, retrieve candidate handling case information according to the search query element, and when a preset recall condition is not met, update the search query element and retrieve again to output handling evidence; a handling suggestion generation unit configured to generate a handling suggestion corresponding to the alarm event; and a closed-loop feedback unit configured to write the handling result feedback into the alarm handling knowledge base in association with the standardized alarm data, the alarm type and the handling suggestion, and trigger incremental training or parameter update of a large language model based on the written associated data. The application can improve alarm analysis and handling efficiency, improve low-frequency alarm processing accuracy, and reduce the cost of manual analysis and collaborative handling.

The invention relates to a device for configuring a communication network based on simulating the behavior of the network by means of a digital twin (6) of the network (5). The digital twin is provided with network configuration information (12) applied to the network, information (11) about the intended use of the network, and status data (13) collected in the network. From the network metrics (15) and the fault and / or performance problem scenarios (14) simulated by the digital twin, monitoring rules (16) are derived to detect network faults and / or network performance problems. A network alarm is generated by the network monitoring component (4) according to the monitoring rule. An analysis component (8) specifies and requests a simulation of additional failure and / or performance problem scenarios (14 ') within the digital twin.

The invention is suitable for the technical field of intelligent transportation, and provides an alarm analysis method and system based on multi-modal machine learning. In the embodiment of the invention, for electromechanical equipment needing to be monitored on a highway, feature extraction is firstly performed on real-time operation data of the equipment, and then corresponding high-frequency energy features and information entropies are determined according to extracted basic statistical features; determining a target feature combination with high importance in the basic statistical features through the high-frequency energy features and the information entropy, and respectively inputting a dynamic feature combination and a static feature combination of the target feature combination into corresponding models so as to determine a real-time state analysis result of the equipment. And finally, the operation state of the equipment is determined according to the real-time state analysis result, so that early warning can be carried out when the state is abnormal. According to the method, the problems of lagging fault discovery, high maintenance cost and low fault response speed of the existing high-speed electromechanical equipment are solved, and accurate fault early warning is realized, so that the safety and efficiency of highway operation are improved.

The application relates to a multi-dimensional alarm analysis method and system based on an alarm platform, and relates to the field of water meter detection, which comprises the following steps: collecting water meter measurement values and historical measurement data in response to a water meter detection signal; calling historical measurement values based on the historical measurement data; generating a reference measurement interval based on the historical measurement values and a reference deviation value; collecting current temperature and pressure parameters when the water meter measurement values do not fall into the reference measurement interval; generating a measurement deviation value based on the current temperature and pressure parameters; obtaining a water meter deviation value according to the water meter measurement values and the measurement deviation value; controlling a water meter self-checking device to perform measurement self-checking by a self-checking method and outputting self-checking information when the water meter deviation value does not fall into the reference measurement interval; reporting a water meter abnormality prompt when the self-checking information is consistent with abnormal information, and discarding the water meter measurement values collected this time. The application has the effect of reducing the false alarm rate of a water meter.

A method for alarm verification comprises obtaining an alarm indication associated with a potential alarm triggered at a monitored site, obtaining media data captured by at least one media device, executing a machine learning model to conduct a content analysis of the media data and generate content metadata based thereon, obtaining sensor data acquired by at least one sensor, correlating the content metadata with the sensor data to determine whether an event corresponding to an alarm condition has occurred at the monitored site, in response to detecting occurrence of the event, determining that the alarm indication relates to a security issue and causing a first action to be performed to mitigate the security issue, and, in response to detecting that the event failed to occur, determining that the alarm indication relates to an operational issue and causing a second action to be performed to mitigate the operational issue.

The application relates to a multi-path video stream target recognition method based on an edge computing device, multi-thread access to multi-path video streams, multi-process parallel acceleration target recognition for multiple target detection models, flexible self-defined comprehensive judgment of the obtained recognition results according to user requirements, real-time analysis of the video streams, and corresponding alarm analysis data and real-time recognition video streams are provided.

Process control system (1), comprising an alarm analysis system for providing statistics on alarms collected by the process control system (1), comprising an alarm server (4) that receives and stores alarms from one or more processes monitored by the process control system (1), wherein the alarm server (4) comprises an alarm handling service (8) and an alarm analysis service (18), both of which run on the alarm server (4), wherein the alarm handling service (8) is adapted to sort the alarms into a plurality of alarm lists intended for different operators, wherein the alarm analysis service (18) of the alarm analysis system is adapted for at least some of the alarm lists to calculate one or more key figures based on the alarms stored in the alarm server (4), and to recalculate the key figures when a new alarm is received from the alarm server (4), and wherein the alarm analysis service (18) is adapted to automatically generate real-time statistics based on alarms stored in the alarm server (4); wherein the process control system (1) includes at least one human-machine interface (5a-b) for displaying the alarm lists and the alarm analysis system is adapted to display the statistics as a graphical representation (20a-b) on the human-machine interface (5a-b) on the same display screen as a graphical representation (10a-b) of the alarm lists; and wherein the human-machine interface (5a-b) is adapted to display a process representation that illustrates the status of the controlled process, and the alarm analysis system is adapted to display the statistics on the process representation.

The application discloses a root cause node determination method and device and a nonvolatile storage medium. The method comprises the following steps: in the case that alarm information of a plurality of service nodes in a service link for executing a target service is received at the same time, starting a root cause determination process, wherein the alarm information is used for indicating that an abnormality occurs in the process of executing the target service by a target system, and each service node is used for indicating a service contained in the target service; in the case that the root cause determination process is started, extracting target data in a database, wherein the database is used for storing log data generated in the process of executing the target service by the target system; and determining a root cause node in the plurality of service nodes according to the target data, wherein the service corresponding to the root cause node is a fault service causing the alarm information to be generated. The application solves the technical problems of slow positioning of a fault root cause and low operation and maintenance efficiency caused by long time consumption of single-service-node alarm analysis.

The present application relates to the technical field of chemical process control, in particular to an abnormal alarm analysis method and system of a resin production control system, the method comprising: obtaining historical golden batch data of a resin production process, aligning the time axis and constructing a standard reference curve through a dynamic time warping algorithm; collecting real-time production data, calculating local transient response energy to represent the smoothness of the current process state; calculating the original deviation between the real-time production data and the standard reference curve, weighting and amplifying the original deviation using the local transient response energy to obtain a weighted dynamic deviation index; constructing a coupling verification model, calculating a coupling deviation verification coefficient, and obtaining a comprehensive abnormal score combined with the weighted dynamic deviation index, and triggering an alarm when the score exceeds a threshold curve. The present application solves the false alarm and missed alarm problems in the non-steady state stage through energy weighting and multivariate coupling analysis, and improves the safety of the resin production process.