9 results about "Alarm correlation" patented technology

This invention discloses an online maintenance and overload control method for multi-source IDS alarm correlation tracing graphs in vehicles. Rule-based intrusion detection systems (IDS) are deployed in the vehicle host domain, vehicle Ethernet domain, and Controller Area Network (CAN) to generate alarms. At the vehicle gateway electronic control unit (ECU) side, multi-source alarms undergo event standardization, sliding time window buffering and waterline out-of-order tolerance, deduplication aggregation, and indexed candidate retrieval. Under the condition of satisfying alarm correlation judgment rules, a directed alarm tracing graph is incrementally constructed. By suppressing forks and overloads through in / out-degree limits, node / edge budgets, and priority pruning, combined with two-stage expiration recycling and tracking record solidification, stable alarm correlation and tracing are achieved under resource-constrained conditions. This method can be used for real-time tracing and offline forensic analysis on the vehicle side.

The application discloses a kind of correlation analysis methods, systems, devices and media of alarm data, wherein the method obtains several multi-source alarm data;All the multi-source alarm data is extracted to multidimensional feature, and several multidimensional feature vectors are obtained;All the multidimensional feature vectors are dynamically clustered and compressed, and several alarm compression clusters are obtained;The alarm compression cluster includes several alarm cluster points, and the alarm compression cluster records the space-time distribution characteristics of all the alarm cluster points;All the alarm compression clusters are analyzed by graph structure correlation, and the alarm correlation analysis result of the multi-source alarm data is obtained.The method can effectively improve the correlation analysis efficiency and effect of alarm data.The application relates to the technical field of communication network operation and maintenance.

The application provides a repeated alarm analysis method based on a large language model and a knowledge graph, relates to the technical field of repeated alarm analysis, and comprises the following steps: alarm data preprocessing and entity structuring extraction, knowledge graph construction and semantic vector generation, vector matching retrieval and candidate alarm screening, double-model independent adjudication and conflict decision, and result storage and correlation network visualization. The application can first obtain target alarm original parameters and standardize them, extract entities by using a large language model, and associate the standardized entities with historical alarms; then, a knowledge graph is constructed and incrementally updated, and alarm semantic vectors are generated and stored in a vector library; candidate alarms are obtained through vector matching, and are preliminarily determined by a first semantic determination model; then, the candidate alarms are independently reviewed according to core correlation and strict investigation rules by a second model, and when conflicts occur, the second result is used as the criterion and logs are recorded; finally, the determination results are written into a special data table, and a visual alarm correlation network graph is generated based on the knowledge graph.

This invention relates to a DCI alarm processing method, comprising: real-time acquisition of raw alarm data from a data center interconnection network; semantic parsing and feature encoding of the raw alarm data to obtain alarm feature vectors; constructing an alarm correlation graph based on the alarm feature vectors, performing correlation reasoning on the alarm correlation graph using a graph learning model to determine the correlation between alarms and locate the root cause alarms; generating alarm processing strategies matching the root cause alarms using an intelligent decision-making algorithm based on network topology status, service priority configuration, and real-time traffic status; and distributing the alarm processing strategies to the corresponding network devices to complete automated alarm handling. By extracting features from raw alarm data, constructing an alarm correlation graph, and performing correlation reasoning, the inherent correlation between alarms can be automatically identified, the root cause alarms can be accurately located, the false alarm rate can be effectively reduced, redundant derived alarms can be eliminated, and the accuracy of alarm identification and fault location can be significantly improved.

The present application relates to the technical field of trace analysis based on position information, and particularly relates to a marine ship sensitive event trace data processing and analysis method and system, comprising: establishing a normal behavior baseline based on historical AIS data, comparing real-time AIS data with the baseline, and generating an abnormal alarm in combination with a preset rule; then, a geometric space clustering algorithm is used to analyze historical trajectories to generate a space-time position; subsequently, a plurality of alarms meeting the space-time proximity condition in the same position are associated and aggregated into an alarm event set; through behavior pattern analysis on the alarm event set, based on single-ship behavior sequence or multi-ship cooperative relationship, the event set with logical continuity is merged to construct a sensitive event chain; finally, the position, trajectory and alarm point related to the event chain are fused and displayed on a three-dimensional geographic information platform, and an analysis report is automatically generated. The present application realizes the automatic analysis from discrete behavior traces to complete event scenarios.

This invention provides a statistical method and system for network alarm association rule mining and fault location. The method preprocesses network alarm data to remove frequently occurring jitter alarms and reduce data redundancy. It then scans the processed alarm data, calculates the number of alarm types, and establishes a timing matrix and a counting matrix. The method further scans the alarm data and processes it in segments using a sliding time window method, including processing alarms within the time window based on their alarm codes, occurrence times, and corresponding records in the timing matrix. Finally, it calculates the support and confidence of the corresponding alarm association rules based on the alarm co-occurrence frequency information in the counting matrix, thus obtaining and outputting association rules through alarm data processing. This invention effectively processes network alarm data while considering both operational efficiency and accuracy, thereby achieving more efficient and accurate network fault location.

The application belongs to the technical field of power system data governance, and discloses a construction method of a marketing alarm correlation analysis engine and related devices, wherein key features of abnormal alarms are extracted, a basic rule correlation engine is built, an improved Apriori algorithm is integrated, distributed parallel computing and dynamic threshold pruning are combined for rule mining, and a multi-level index model is further constructed to evaluate and iteratively update a marketing alarm rule library in multiple dimensions. In the method, feature extraction enhances the capture ability of data space correlation features, the improved algorithm and the distributed architecture break through the serial computing bottleneck, the dynamic threshold pruning improves the processing efficiency of candidate item sets, and the evaluation mechanism based on triple indicators and historical data forms a closed-loop management of rule generation verification iteration. The method effectively overcomes the defects of insufficient feature extraction accuracy, low detection efficiency, poor rule adaptability and missing closed-loop verification, significantly improves alarm accuracy and real-time performance, and enhances the risk prevention and control capability of power marketing business.