CN116843395A

CN116843395A - Alarm classification method, device, equipment and storage medium of service system

Info

Publication number: CN116843395A
Application number: CN202310784839.8A
Authority: CN
Inventors: 田祥博
Original assignee: Ping An Property and Casualty Insurance Company of China Ltd
Current assignee: Ping An Property and Casualty Insurance Company of China Ltd
Priority date: 2023-06-29
Filing date: 2023-06-29
Publication date: 2023-10-03

Abstract

The application discloses an alarm grading method, device, equipment and storage medium of a service system, belonging to the technical field of artificial intelligence and the field of insurance production finance. The application obtains the current flow data of the service system, performs characteristic extraction on the current flow data to obtain the current flow data characteristic, imports the current flow data characteristic into a pre-trained alarm classification model to obtain an initial alarm classification result, determines the system time corresponding to the current flow data, performs weighting processing on each alarm classification in the initial alarm classification result according to the system time and a preset time weight configuration table to obtain a flow alarm classification result, and outputs the flow alarm classification result. The application also relates to the technical field of blockchains, and current flow data can be stored in the blockchain. The application realizes the self-adaptive alarm classification, can accurately evaluate the severity of the alarm in the dynamically-changed flow data, and provides accurate and efficient priority processing sequence for operation and maintenance personnel.

Description

Alarm classification method, device, equipment and storage medium of service system

Technical Field

The application belongs to the technical field of artificial intelligence and the field of risk production finance, and particularly relates to an alarm classification method, an alarm classification device, alarm classification equipment and a storage medium of a business system.

Background

In order to ensure high quality and high stability of the business system to which the risk sales system is applied, a monitoring system is usually configured for the business system, which is used to monitor various indexes and to issue an alarm to notify the operation and maintenance personnel in case of abnormality. However, in practical applications, frequent alarms may be overwhelming for the operation and maintenance personnel, and cannot be effectively handled, in order to help the operation and maintenance personnel quickly solve the most urgent problem, the monitoring system typically supports preset alarm templates and levels. For example, CPU monitoring may set a threshold according to utilization, e.g., marked as P1 level when CPU utilization exceeds 95%; when the utilization exceeds 90%, it is marked as P2 level; when the utilization exceeds 80%, it is marked as P3 level. Similarly, disk monitoring may be thresholded based on disk usage, e.g., over 98% usage is defined as P1 level, over 90% usage is defined as P2 level, and over 80% usage is defined as P3 level.

However, due to the complexity and dynamic changes of the business system, the types of alarms are numerous and evolving continuously, and furthermore different operation and maintenance engineers may develop inconsistent grading standards according to personal preferences and experience, resulting in problems of accuracy of alarms, accumulation of which may result in serious alarms being ignored, or some simple alarms being falsely marked as higher priority alarms, resulting in time and effort of the operation and maintenance engineers being spent on solving these simple alarms in some special time periods.

Disclosure of Invention

The embodiment of the application aims to provide an alarm grading method, an alarm grading device, computer equipment and a storage medium of a service system, which are used for solving the technical problems of complex alarm mode and inaccurate alarm existing in the service flow alarm mode of the existing application risk sales system.

In order to solve the above technical problems, the embodiment of the present application provides an alarm classification method for a service system, which adopts the following technical scheme:

an alarm classification method of a service system, comprising:

receiving an alarm grading instruction, and acquiring current flow data of a service system according to the alarm grading instruction;

extracting features of the current flow data to obtain the features of the current flow data;

Leading the current flow data characteristics into a pre-trained alarm classification model, and obtaining an initial alarm classification result output by the alarm classification model;

acquiring a time stamp corresponding to the current flow data, and determining the system time corresponding to the current flow data based on the time stamp;

weighting each alarm classification in the initial alarm classification result according to the system time and a preset time weight configuration table to obtain a plurality of weighted alarm classifications;

and combining a plurality of weighted alarm grades to obtain a flow alarm grading result, and outputting the flow alarm grading result.

Further, before the current flow data characteristics are imported into the pre-trained alarm classification model to obtain the initial alarm classification result output by the alarm classification model, the method further comprises the following steps:

receiving a training instruction of an alarm grading model, and acquiring historical flow data of a service system based on the training instruction;

marking historical flow data based on a preset warning grading label, and constructing a training data set and a verification data set based on the marked historical flow data;

model training is carried out on a preset initial classification model based on a training data set to obtain an alarm classification model;

And carrying out model verification on the alarm grading model based on the verification data set, and outputting the alarm grading model passing the model verification.

Further, model training is carried out on a preset initial classification model based on a training data set to obtain an alarm classification model, and the method specifically comprises the following steps:

extracting features of the training data set to obtain training sample features;

inputting the training sample characteristics into the initial classification model to obtain an alarm classification result output by the initial classification model;

comparing the alarm classification result with the alarm classification label to obtain a classification error;

and carrying out iterative updating on the initial classification model based on the classification error until the model is fitted to obtain an alarm classification model.

Further, before each alarm classification in the initial alarm classification result is weighted according to the system time and a preset time weight configuration table to obtain a plurality of weighted alarm classifications, the method further comprises:

dividing the running time of the set service system based on a preset time interval to obtain a plurality of system running sub-times;

counting the business processing amount and the system error reporting amount in each system operation sub-time;

calculating a traffic processing error reporting amount ratio based on the traffic processing amount and the system error reporting amount in each system operation sub-time;

Sequencing all the calculated traffic processing error reporting quantity ratios to obtain a traffic processing error reporting quantity ratio sequencing result;

and configuring a time weight configuration table according to the sequencing result of the traffic processing error reporting quantity ratio.

Further, each alarm classification in the initial alarm classification result is weighted according to the system time and a preset time weight configuration table to obtain a plurality of weighted alarm classifications, which specifically comprises:

determining a weighted weight according to the system time and a preset time weight configuration table;

and carrying out weighting processing on each alarm classification in the initial alarm classification result based on the weighting weight value to obtain a plurality of weighted alarm classifications.

Further, combining a plurality of weighted alarm grades to obtain a flow alarm grading result, and outputting the flow alarm grading result, which specifically comprises:

acquiring a data display template which is matched with a plurality of weighted alarms in a grading manner, and obtaining a target data display template;

importing a plurality of weighted alarms into a target data display template in a grading manner to obtain a flow alarm grading result;

and visually outputting the flow alarm classification result.

Further, after combining a plurality of weighted alarm classifications to obtain a flow alarm classification result and outputting the flow alarm classification result, the method further comprises the steps of:

Receiving a feedback instruction aiming at a flow alarm grading result, and analyzing the feedback instruction to acquire an alarm grading adjustment mode;

judging the type of an alarm hierarchical adjustment mode, wherein the alarm hierarchical adjustment mode comprises a first adjustment type and a second adjustment type, the first adjustment type is a re-iterative alarm hierarchical model, and the second adjustment type carries out alarm hierarchical adjustment based on adjustment parameters;

if the alarm grading adjustment mode is the first adjustment type, re-iterating the alarm grading model, processing the current flow data based on the new alarm grading model to obtain a new initial alarm grading result, and re-weighting the new initial alarm grading result to obtain a first adjustment result of flow alarm grading;

and if the alarm grading adjustment mode is the second adjustment type, acquiring adjustment parameters input by a user, and adjusting the flow alarm grading result based on the adjustment parameters to obtain a second adjustment result of the flow alarm grading.

In order to solve the above technical problems, the embodiment of the present application further provides an alarm classification device of a service system, which adopts the following technical scheme:

an alarm classification apparatus of a service system, comprising:

The data acquisition module is used for receiving the alarm grading instruction and acquiring the current flow data of the service system according to the alarm grading instruction;

the feature extraction module is used for extracting features of the current flow data to obtain the features of the current flow data;

the alarm grading module is used for importing the current flow data characteristics into a pre-trained alarm grading model and acquiring an initial alarm grading result output by the alarm grading model;

the time identification module is used for acquiring a time stamp corresponding to the current flow data and determining the system time corresponding to the current flow data based on the time stamp;

the weighting processing module is used for carrying out weighting processing on each alarm grade in the initial alarm grade result according to the system time and a preset time weight configuration table to obtain a plurality of weighted alarm grades;

and the grading output module is used for combining a plurality of weighted alarm grades to obtain a flow alarm grading result and outputting the flow alarm grading result.

In order to solve the above technical problems, the embodiment of the present application further provides a computer device, which adopts the following technical schemes:

a computer device comprising a memory having stored therein computer readable instructions which when executed by a processor implement the steps of the alert classification method of a business system as claimed in any one of the preceding claims.

In order to solve the above technical problems, an embodiment of the present application further provides a computer readable storage medium, which adopts the following technical schemes:

a computer readable storage medium having stored thereon computer readable instructions which when executed by a processor implement the steps of the alert classification method of a business system as claimed in any one of the preceding claims.

Compared with the prior art, the embodiment of the application has the following main beneficial effects:

the application discloses an alarm grading method, device, equipment and storage medium of a service system, belonging to the technical field of artificial intelligence and the field of insurance production finance. The application obtains the current flow data of the service system according to the alarm grading instruction, performs feature extraction on the current flow data to obtain the current flow data feature, imports the current flow data feature into an alarm grading model trained in advance, obtains an initial alarm grading result output by the alarm grading model, obtains a time stamp corresponding to the current flow data, determines the system time corresponding to the current flow data based on the time stamp, performs weighting treatment on each alarm grading in the initial alarm grading result according to the system time and a preset time weight configuration table to obtain a plurality of weighted alarm grading, combines the plurality of weighted alarm grading to obtain a flow alarm grading result, and outputs the flow alarm grading result. The application completes the initial alarm classification through the alarm classification model, and weights the initial alarm classification according to the characteristics and the historical data of the service flow in each time period, thereby realizing the dynamic adjustment of the alarm classification, realizing the self-adaptive alarm classification, accurately evaluating the severity of the alarm in the dynamically changed flow data and providing accurate and efficient priority processing sequence for operation and maintenance personnel.

Drawings

In order to more clearly illustrate the solution of the present application, a brief description will be given below of the drawings required for the description of the embodiments of the present application, it being apparent that the drawings in the following description are some embodiments of the present application, and that other drawings may be obtained from these drawings without the exercise of inventive effort for a person of ordinary skill in the art.

FIG. 1 illustrates an exemplary system architecture diagram in which the present application may be applied;

FIG. 2 illustrates a flow chart of one embodiment of an alert classification method for a business system according to the present application;

FIG. 3 is a schematic diagram illustrating one embodiment of an alert rating apparatus for a business system in accordance with the present application;

fig. 4 shows a schematic structural diagram of an embodiment of a computer device according to the application.

Detailed Description

Unless defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs; the terminology used in the description of the applications herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the application; the terms "comprising" and "having" and any variations thereof in the description of the application and the claims and the description of the drawings above are intended to cover a non-exclusive inclusion. The terms first, second and the like in the description and in the claims or in the above-described figures, are used for distinguishing between different objects and not necessarily for describing a sequential or chronological order.

Reference herein to "an embodiment" means that a particular feature, structure, or characteristic described in connection with the embodiment may be included in at least one embodiment of the application. The appearances of such phrases in various places in the specification are not necessarily all referring to the same embodiment, nor are separate or alternative embodiments mutually exclusive of other embodiments. Those of skill in the art will explicitly and implicitly appreciate that the embodiments described herein may be combined with other embodiments.

In order to make the person skilled in the art better understand the solution of the present application, the technical solution of the embodiment of the present application will be clearly and completely described below with reference to the accompanying drawings.

As shown in fig. 1, a system architecture 100 may include terminal devices 101, 102, 103, a network 104, and a server 105. The network 104 is used as a medium to provide communication links between the terminal devices 101, 102, 103 and the server 105. The network 104 may include various connection types, such as wired, wireless communication links, or fiber optic cables, among others.

The user may interact with the server 105 via the network 104 using the terminal devices 101, 102, 103 to receive or send messages or the like. Various communication client applications, such as a web browser application, a shopping class application, a search class application, an instant messaging tool, a mailbox client, social platform software, etc., may be installed on the terminal devices 101, 102, 103.

The terminal devices 101, 102, 103 may be various electronic devices having a display screen and supporting web browsing, including but not limited to smartphones, tablet computers, electronic book readers, MP3 players (Moving Picture Experts Group Audio Layer III, dynamic video expert compression standard audio plane 3), MP4 (Moving Picture Experts Group Audio Layer IV, dynamic video expert compression standard audio plane 4) players, laptop and desktop computers, and the like.

The server 105 may be a server that provides various services, such as a background server that provides support for pages displayed on the terminal devices 101, 102, 103, and may be a stand-alone server, or may be a cloud server that provides cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (Content Delivery Network, CDN), and basic cloud computing services such as big data and artificial intelligence platforms.

It should be noted that, the alarm classification method of the service system provided by the embodiment of the present application is generally executed by a server, and accordingly, the alarm classification device of the service system is generally disposed in the server.

It should be understood that the number of terminal devices, networks and servers in fig. 1 is merely illustrative. There may be any number of terminal devices, networks, and servers, as desired for implementation.

With continued reference to FIG. 2, a flow chart of one embodiment of a method of alert classification for a business system according to the present application is shown. The embodiment of the application can acquire and process the related data based on the artificial intelligence technology. Among these, artificial intelligence (Artificial Intelligence, AI) is the theory, method, technique and application system that uses a digital computer or a digital computer-controlled machine to simulate, extend and extend human intelligence, sense the environment, acquire knowledge and use knowledge to obtain optimal results.

Artificial intelligence infrastructure technologies generally include technologies such as sensors, dedicated artificial intelligence chips, cloud computing, distributed storage, big data processing technologies, operation/interaction systems, mechatronics, and the like. The artificial intelligence software technology mainly comprises a computer vision technology, a robot technology, a biological recognition technology, a voice processing technology, a natural language processing technology, machine learning/deep learning and other directions.

In the current traffic anomaly monitoring scenario of the application risk sales system, due to complexity and dynamic changes of the service system, alarm types are numerous and evolve continuously, and furthermore different operation and maintenance engineers may develop inconsistent grading standards according to personal preferences and experiences, resulting in alarm accuracy problems, accumulation of these problems may result in serious alarms being ignored, or some simple alarms being falsely marked as higher priority alarms, resulting in time and effort of the operation and maintenance engineers being spent for some special time periods to solve these simple alarms.

In order to solve the technical problems, the application discloses an alarm grading method, an alarm grading device, alarm grading equipment and a storage medium of a service system, which belong to the technical field of artificial intelligence and the field of risk production finance.

The alarm classification method of the service system comprises the following steps:

s201, receiving an alarm grading instruction, and acquiring current flow data of the service system according to the alarm grading instruction.

In this embodiment, the server first receives an alarm classification instruction, where the instruction is used to obtain current flow data of a service system, and the service system is an application risk sales system. The server may implement the current flow data acquisition through integration with the monitoring module of the service system, or acquire the flow data through an API or other means.

In this embodiment, the electronic device (for example, the server shown in fig. 1) on which the alarm classification method of the service system operates may receive the alarm classification instruction through a wired connection manner or a wireless connection manner. It should be noted that the wireless connection may include, but is not limited to, 3G/4G connections, wiFi connections, bluetooth connections, wiMAX connections, zigbee connections, UWB (ultrawideband) connections, and other now known or later developed wireless connection means.

S202, extracting features of the current flow data to obtain the features of the current flow data.

In this embodiment, for the current traffic data, the server performs feature extraction on the current traffic data, where the purpose of feature extraction is to extract meaningful information from the traffic data to describe the state and features of the current system, and the feature extraction may include indexes such as average request response time, number of concurrent connections, error rate, and the like. And obtaining the current flow data characteristics through characteristic extraction so as to predict the alarm classification corresponding to the current flow data through the current flow data characteristics and the trained alarm classification model.

S203, the current flow data characteristics are imported into a pre-trained alarm classification model, and an initial alarm classification result output by the alarm classification model is obtained.

In this embodiment, the extracted flow data features are processed by using a pre-trained alarm classification model, which may use a machine learning algorithm, such as a decision tree, logistic regression, or neural network, for learning the relationship between the flow features and the alarm levels, where the training of the alarm classification model requires the use of a labeled dataset, including the flow data and the corresponding alarm levels, and the trained alarm classification model may be directly used for prediction of the alarm classification.

In this embodiment, when the server trains the alarm classification model, by receiving a training instruction of the alarm classification model, acquiring historical flow data of the service system based on the training instruction, labeling the historical flow data based on a preset alarm classification label, associating the historical flow data with a corresponding alarm class to create a training dataset and a verification dataset, dividing the dataset into the training dataset and the verification dataset according to the labeled historical flow data, and performing model training on a preset initial classification model based on the training dataset. In the training process, the model learns the relation between the historical flow data characteristics and the alarm classification, and a machine learning technology such as a decision tree, a support vector machine or a deep neural network can be used for a training algorithm. And verifying the trained alarm grading model by using a verification data set, wherein the verification purpose of the model is to evaluate the performance and generalization capability of the model, and whether the model has better prediction capability and accuracy can be determined through a verification process.

In this embodiment, feature extraction is performed on the training data set to obtain training sample features, where the training sample features mainly include indexes such as data request amount, request time, error reporting amount and the like extracted from the training data set, and specific service indexes such as request amount per minute, policy generation speed and the like may be considered for the service flow monitoring warning scene of the insurance sales system. The training sample features are input into the initial classification model to obtain an alarm classification result output by the initial classification model, and the training algorithm can use machine learning technology such as decision trees, support vector machines or deep neural networks. And comparing the alarm classification result with an alarm classification label, calculating an error by using a loss function of the initial classification model to obtain a classification error, and carrying out iterative updating on the initial classification model based on the classification error until the model is fitted to obtain the alarm classification model.

S204, acquiring a time stamp corresponding to the current flow data, and determining the system time corresponding to the current flow data based on the time stamp.

In this embodiment, in the flow data monitoring system, a time stamp of each flow data point is generally recorded, and the time stamp represents the collection time of the data point, and may be a specific date and time, or may be a time interval corresponding to a certain reference time, and the time stamp of each data point may be obtained by reading the time stamp information of the flow data. And then converting the obtained time stamp into system time according to the obtained time stamp so as to facilitate subsequent processing, and comparing or calculating the time stamp and the system time to determine the system time corresponding to the current flow data.

In the above implementation, the purpose of determining the system time corresponding to the current flow data is to consider the influence of time factors in the alarm classification process. The running state of the system and the traffic flow may change with time, so the alarm classification associated with a specific time period may be different, and by associating the time stamp of the flow data with the system time, the time weight may be considered in the subsequent weighting process to better reflect the importance and urgency of the current flow data.

For example, in a warranty sales system, 10 am may be a peak business period, and thus anomalies occurring during this period may be considered more important. By corresponding the current flow data with the system time, the corresponding alarm hierarchical adjustment can be carried out according to the importance of the time period, so that the system abnormality is ensured to be captured and processed in time at the key moment.

S205, weighting each alarm grade in the initial alarm grade result according to the system time and a preset time weight configuration table to obtain a plurality of weighted alarm grades.

In this embodiment, the initial alarm classification result is weighted based on the system time and a preset time weight configuration table, and the importance degree of the alarm classification corresponding to different time periods can be specified through the time weight configuration table, so that the weight of the alarm classification can be adjusted according to the characteristics and requirements of the service system in different time periods.

In this embodiment, first, according to a preset time interval, the running time of the set service system is divided, so as to obtain a plurality of system running sub-time periods. This process may determine the time interval according to the characteristics and requirements of the business system, for example, every five minutes or every ten minutes. In each system operation sub-time period, the number of service processing amount and system error reporting amount are counted, wherein the service processing amount can be the number of service requests or the size of service traffic, and the system error reporting amount can be the number of system errors or anomalies occurring in the time period. By dividing the system error reporting amount in each system operation sub-period by the traffic handling amount, the traffic handling error reporting amount ratio in each period, which represents the proportion of errors or anomalies occurring in traffic handling in a particular period, can be calculated. All the calculated error quantity ratios of the service processing are sequenced, and are arranged in descending order according to the ratio, and the time period with higher ratio can be placed in front, and the time period with lower ratio can be placed in back. According to the sorting result, a time weight configuration table can be configured according to the requirements and actual conditions, and the time weight configuration table is used for giving corresponding weight to each system operation sub-time period, and generally giving higher weight to a time period with a higher ratio so as to more accurately reflect the emergency degree and importance of system abnormality in the subsequent weighting processing.

In the above embodiment, the time weight may be dynamically configured according to the traffic processing error reporting amount ratio in different time periods, so that the system abnormality is more accurately captured in the alarm classification process, and the corresponding alarm classification adjustment may be performed according to the characteristics and the importance of the time periods.

In this embodiment, the current system time is first obtained, and the weighting weight of each system operation sub-period is determined according to the system time and a preset time weight configuration table. The weighting processing is carried out on each alarm classification in the initial alarm classification result, and the weight of each alarm classification can be multiplied by the corresponding weighting weight by adopting simple multiplication operation, so that the alarm classification with higher weight can obtain a higher weighting result, and the alarm classification with lower weight can obtain a lower weighting result.

In the above embodiment, the initial alarm classification may be weighted according to the system time and the preset time weight, so as to reflect the importance and the emergency degree of the alarm classification in different time periods. Therefore, the alarm classification result can be adjusted according to the operation characteristics of the service system and the importance of the time period, and the abnormal condition of the system can be more accurately captured.

For example, assuming that in an insurance sales system, the peak period of business per day is analyzed according to the historical data to be 10 am and 3 pm, the time periods of 10 am and 3 pm can be set to have higher weights on the time weight configuration table, and the other time periods have lower weights. In this case, when the system is abnormal at 10 am and 3 pm, the corresponding alarm classification will get a higher weighted result to inform the operation and maintenance personnel more quickly and accurately, while in other time periods, even if the abnormality occurs, the corresponding alarm classification will get a lower weighted result to avoid too many irrelevant alarms interfering with the operation of the operation and maintenance personnel.

S206, combining a plurality of weighted alarm grades to obtain a flow alarm grading result, and outputting the flow alarm grading result.

In this embodiment, the final flow alarm classification result is obtained by combining the alarm classification results after the weighting processing, and the combining method may be simple weighted average, highest weighting, and the like. And finally, outputting the flow alarm grading result, and generally providing the flow alarm grading result for operation and maintenance personnel or related systems for processing and responding, so that the operation and maintenance personnel can be helped to better know the state of the service system, and corresponding operation and decision can be carried out according to the importance of the alarm grade.

In the above embodiment, by using the traffic data and the alarm classification model of the service system and combining time weighting processing, the self-adaptive alarm classification based on the traffic characteristics is realized, and by flexibly adjusting the time weighting configuration table, the alarm classification can be individually adjusted according to the requirements of different time periods, so that the severity of the alarm can be accurately estimated in the dynamically changed traffic data, and an accurate and efficient priority processing sequence is provided for operation and maintenance personnel.

and visually outputting the flow alarm classification result.

In the above embodiment, after combining a plurality of weighted alarm classifications by means of weighted average or taking the highest weight, a data display template matched with the plurality of weighted alarm classifications is obtained to obtain a target data display template, the plurality of weighted alarm classifications are imported into the target data display template to obtain a flow alarm classification result, the flow alarm classification result is rendered into a visual page, and visual output is performed on a display of a user terminal.

In this embodiment, the server receives feedback instructions from the operation and maintenance personnel, where the instructions may include requirements and modes of alarm hierarchical adjustment, and by analyzing the feedback instructions, relevant information of the alarm hierarchical adjustment modes may be extracted. According to the information in the feedback instruction, the type of the alarm hierarchical adjustment mode is judged, and in a specific embodiment of the application, the alarm hierarchical adjustment mode is divided into a first adjustment type and a second adjustment type. If the alarm classification adjustment mode is judged to be the first adjustment type, namely, the alarm classification model is iterated again, the server carries out iterating training on the alarm classification model again, processes the current flow data based on the new alarm classification model to obtain a new initial alarm classification result, and then carries out re-weighting processing on the new initial alarm classification result to obtain a first adjustment result of flow alarm classification. If the alarm grading adjustment mode is judged to be the second adjustment type, namely, alarm grading adjustment is carried out based on the adjustment parameters, the system can acquire the adjustment parameters input by the operation and maintenance personnel, and based on the adjustment parameters, the flow alarm grading result is adjusted to obtain a second adjustment result of the flow alarm grading.

The server can adjust the alarm classification according to the requirements and the instructions of the operation and maintenance personnel by receiving and analyzing the feedback instructions, so as to meet the requirements of actual conditions, and further optimize the alarm classification result by adjusting based on adjustment parameters through re-iterating the alarm classification model to make the alarm classification result more in line with the requirements of the actual conditions and the operation and maintenance personnel.

In this embodiment, the electronic device (for example, the server shown in fig. 1) on which the alarm classification method of the service system operates may receive a feedback instruction for the flow alarm classification result through a wired connection manner or a wireless connection manner. It should be noted that the wireless connection may include, but is not limited to, 3G/4G connections, wiFi connections, bluetooth connections, wiMAX connections, zigbee connections, UWB (ultrawideband) connections, and other now known or later developed wireless connection means.

In the above embodiment, the application discloses an alarm classification method of a service system, which belongs to the technical field of artificial intelligence and the field of risk-producing finance. The application obtains the current flow data of the service system according to the alarm grading instruction, performs feature extraction on the current flow data to obtain the current flow data feature, imports the current flow data feature into an alarm grading model trained in advance, obtains an initial alarm grading result output by the alarm grading model, obtains a time stamp corresponding to the current flow data, determines the system time corresponding to the current flow data based on the time stamp, performs weighting treatment on each alarm grading in the initial alarm grading result according to the system time and a preset time weight configuration table to obtain a plurality of weighted alarm grading, combines the plurality of weighted alarm grading to obtain a flow alarm grading result, and outputs the flow alarm grading result. The application completes the initial alarm classification through the alarm classification model, and weights the initial alarm classification according to the characteristics and the historical data of the service flow in each time period, thereby realizing the dynamic adjustment of the alarm classification, realizing the self-adaptive alarm classification, accurately evaluating the severity of the alarm in the dynamically changed flow data and providing accurate and efficient priority processing sequence for operation and maintenance personnel.

It is emphasized that to further guarantee the privacy and security of the current traffic data, the current traffic data may be stored in a node of a blockchain.

The blockchain is a novel application mode of computer technologies such as distributed data storage, point-to-point transmission, consensus mechanism, encryption algorithm and the like. The Blockchain (Blockchain), which is essentially a decentralised database, is a string of data blocks that are generated by cryptographic means in association, each data block containing a batch of information of network transactions for verifying the validity of the information (anti-counterfeiting) and generating the next block. The blockchain may include a blockchain underlying platform, a platform product services layer, an application services layer, and the like.

Those skilled in the art will appreciate that implementing all or part of the processes of the methods of the embodiments described above may be accomplished by way of computer readable instructions, stored on a computer readable storage medium, which when executed may comprise processes of embodiments of the methods described above. The storage medium may be a nonvolatile storage medium such as a magnetic disk, an optical disk, a Read-only Memory (ROM), or a random access Memory (Random Access Memory, RAM).

It should be understood that, although the steps in the flowcharts of the figures are shown in order as indicated by the arrows, these steps are not necessarily performed in order as indicated by the arrows. The steps are not strictly limited in order and may be performed in other orders, unless explicitly stated herein. Moreover, at least some of the steps in the flowcharts of the figures may include a plurality of sub-steps or stages that are not necessarily performed at the same time, but may be performed at different times, the order of their execution not necessarily being sequential, but may be performed in turn or alternately with other steps or at least a portion of the other steps or stages.

With further reference to fig. 3, as an implementation of the method shown in fig. 2, the present application provides an embodiment of an alarm classification apparatus of a service system, where the embodiment of the apparatus corresponds to the embodiment of the method shown in fig. 2, and the apparatus may be specifically applied to various electronic devices.

As shown in fig. 3, the alarm classification device 300 of the service system according to the present embodiment includes:

the data acquisition module 301 is configured to receive an alarm classification instruction, and acquire current flow data of the service system according to the alarm classification instruction;

The feature extraction module 302 is configured to perform feature extraction on the current flow data to obtain a current flow data feature;

the alarm classification module 303 is configured to import the current flow data feature into a pre-trained alarm classification model, and obtain an initial alarm classification result output by the alarm classification model;

the time identifying module 304 is configured to obtain a time stamp corresponding to the current flow data, and determine a system time corresponding to the current flow data based on the time stamp;

the weighting processing module 305 is configured to perform weighting processing on each alarm classification in the initial alarm classification result according to the system time and a preset time weight configuration table, so as to obtain a plurality of weighted alarm classifications;

the classification output module 306 is configured to combine the plurality of weighted alarm classifications to obtain a flow alarm classification result, and output the flow alarm classification result.

Further, the alarm classification device 300 of the service system further includes:

the historical data acquisition module is used for receiving a training instruction of the alarm grading model and acquiring historical flow data of the service system based on the training instruction;

the data set construction module is used for marking the historical flow data based on a preset alarm grading label and constructing a training data set and a verification data set based on the marked historical flow data;

The model training module is used for carrying out model training on a preset initial classification model based on the training data set to obtain an alarm classification model;

and the model verification module is used for carrying out model verification on the alarm grading model based on the verification data set and outputting the alarm grading model passing the model verification.

Further, the model training module specifically includes:

the training feature extraction unit is used for extracting features of the training data set to obtain training sample features;

the initial classification unit is used for inputting the training sample characteristics into the initial classification model to obtain an alarm classification result output by the initial classification model;

the error calculation unit is used for comparing the alarm classification result with the alarm classification label to obtain a classification error;

and the iterative updating unit is used for carrying out iterative updating on the initial classification model based on the classification error until the model is fitted to obtain the alarm classification model.

the time dividing module is used for dividing the running time of the set service system based on a preset time interval to obtain a plurality of system running sub-times;

the data statistics module is used for counting the business processing capacity and the system error reporting capacity in each system operation sub-time;

The ratio calculation module is used for calculating the ratio of the business processing error reporting amount based on the business processing amount and the system error reporting amount in each system operation sub-time;

the ratio sequencing module is used for sequencing all the calculated service processing error reporting quantity ratios to obtain a service processing error reporting quantity ratio sequencing result;

and the time weight configuration module is used for configuring a time weight configuration table according to the sequencing result of the business processing error reporting quantity ratio.

Further, the weighting processing module 305 specifically includes:

the weight determining unit is used for determining a weight according to the system time and a preset time weight configuration table;

and the weighting processing unit is used for carrying out weighting processing on each alarm grade in the initial alarm grade result based on the weighting weight value to obtain a plurality of weighted alarm grades.

Further, the hierarchical output module 306 specifically includes:

the display template acquisition unit is used for acquiring a data display template which is matched with the weighted alarms in a grading manner to obtain a target data display template;

the data importing unit is used for importing a plurality of weighted alarms into the target data display template in a grading manner to obtain a flow alarm grading result;

and the visual output unit is used for visually outputting the flow alarm grading result.

the feedback adjustment module is used for receiving feedback instructions aiming at the flow alarm classification result, and resolving the feedback instructions to acquire an alarm classification adjustment mode;

the adjusting type judging module is used for judging the type of an alarm grading adjusting mode, wherein the alarm grading adjusting mode comprises a first adjusting type and a second adjusting type, the first adjusting type is a re-iteration alarm grading model, and the second adjusting type is used for carrying out alarm grading adjustment based on adjusting parameters;

the first adjusting module is used for carrying out re-iteration on the alarm grading model when the alarm grading adjustment mode is of a first adjustment type, processing the current flow data based on the new alarm grading model to obtain a new initial alarm grading result, and carrying out re-weighting on the new initial alarm grading result to obtain a first adjustment result of flow alarm grading;

and the second adjusting module is used for acquiring the adjusting parameters input by the user when the alarm grading adjusting mode is of a second adjusting type, and adjusting the flow alarm grading result based on the adjusting parameters to acquire a second adjusting result of the flow alarm grading.

In the above embodiment, the application discloses an alarm grading device of a business system, which belongs to the technical field of artificial intelligence and the field of insurance production finance. The application obtains the current flow data of the service system according to the alarm grading instruction, performs feature extraction on the current flow data to obtain the current flow data feature, imports the current flow data feature into an alarm grading model trained in advance, obtains an initial alarm grading result output by the alarm grading model, obtains a time stamp corresponding to the current flow data, determines the system time corresponding to the current flow data based on the time stamp, performs weighting treatment on each alarm grading in the initial alarm grading result according to the system time and a preset time weight configuration table to obtain a plurality of weighted alarm grading, combines the plurality of weighted alarm grading to obtain a flow alarm grading result, and outputs the flow alarm grading result. The application completes the initial alarm classification through the alarm classification model, and weights the initial alarm classification according to the characteristics and the historical data of the service flow in each time period, thereby realizing the dynamic adjustment of the alarm classification, realizing the self-adaptive alarm classification, accurately evaluating the severity of the alarm in the dynamically changed flow data and providing accurate and efficient priority processing sequence for operation and maintenance personnel.

In order to solve the technical problems, the embodiment of the application also provides computer equipment. Referring specifically to fig. 4, fig. 4 is a basic structural block diagram of a computer device according to the present embodiment.

The computer device 4 comprises a memory 41, a processor 42, a network interface 43 communicatively connected to each other via a system bus. It should be noted that only computer device 4 having components 41-43 is shown in the figures, but it should be understood that not all of the illustrated components are required to be implemented and that more or fewer components may be implemented instead. It will be appreciated by those skilled in the art that the computer device herein is a device capable of automatically performing numerical calculations and/or information processing in accordance with predetermined or stored instructions, the hardware of which includes, but is not limited to, microprocessors, application specific integrated circuits (Application Specific Integrated Circuit, ASICs), programmable gate arrays (fields-Programmable Gate Array, FPGAs), digital processors (Digital Signal Processor, DSPs), embedded devices, etc.

The computer equipment can be a desktop computer, a notebook computer, a palm computer, a cloud server and other computing equipment. The computer equipment can perform man-machine interaction with a user through a keyboard, a mouse, a remote controller, a touch pad or voice control equipment and the like.

The memory 41 includes at least one type of readable storage medium including flash memory, hard disk, multimedia card, card memory (e.g., SD or DX memory, etc.), random Access Memory (RAM), static Random Access Memory (SRAM), read Only Memory (ROM), electrically Erasable Programmable Read Only Memory (EEPROM), programmable Read Only Memory (PROM), magnetic memory, magnetic disk, optical disk, etc. In some embodiments, the storage 41 may be an internal storage unit of the computer device 4, such as a hard disk or a memory of the computer device 4. In other embodiments, the memory 41 may also be an external storage device of the computer device 4, such as a plug-in hard disk, a Smart Media Card (SMC), a Secure Digital (SD) Card, a Flash Card (Flash Card) or the like, which are provided on the computer device 4. Of course, the memory 41 may also comprise both an internal memory unit of the computer device 4 and an external memory device. In this embodiment, the memory 41 is typically used to store an operating system installed on the computer device 4 and various application software, such as computer readable instructions of an alarm classification method of a service system. Further, the memory 41 may be used to temporarily store various types of data that have been output or are to be output.

The processor 42 may be a central processing unit (Central Processing Unit, CPU), controller, microcontroller, microprocessor, or other data processing chip in some embodiments. The processor 42 is typically used to control the overall operation of the computer device 4. In this embodiment, the processor 42 is configured to execute computer readable instructions stored in the memory 41 or process data, such as computer readable instructions for executing an alarm classification method of the service system.

The network interface 43 may comprise a wireless network interface or a wired network interface, which network interface 43 is typically used for establishing a communication connection between the computer device 4 and other electronic devices.

In the embodiment, the application discloses computer equipment, and belongs to the technical field of artificial intelligence and the field of risk-producing finance. The application obtains the current flow data of the service system according to the alarm grading instruction, performs feature extraction on the current flow data to obtain the current flow data feature, imports the current flow data feature into an alarm grading model trained in advance, obtains an initial alarm grading result output by the alarm grading model, obtains a time stamp corresponding to the current flow data, determines the system time corresponding to the current flow data based on the time stamp, performs weighting treatment on each alarm grading in the initial alarm grading result according to the system time and a preset time weight configuration table to obtain a plurality of weighted alarm grading, combines the plurality of weighted alarm grading to obtain a flow alarm grading result, and outputs the flow alarm grading result. The application completes the initial alarm classification through the alarm classification model, and weights the initial alarm classification according to the characteristics and the historical data of the service flow in each time period, thereby realizing the dynamic adjustment of the alarm classification, realizing the self-adaptive alarm classification, accurately evaluating the severity of the alarm in the dynamically changed flow data and providing accurate and efficient priority processing sequence for operation and maintenance personnel.

The present application also provides another embodiment, namely, a computer readable storage medium storing computer readable instructions executable by at least one processor to cause the at least one processor to perform the steps of the alert classification method of a business system as described above.

In the above embodiments, the present application discloses a computer readable storage medium, which belongs to the technical field of artificial intelligence and the field of risk-producing finance. The application obtains the current flow data of the service system according to the alarm grading instruction, performs feature extraction on the current flow data to obtain the current flow data feature, imports the current flow data feature into an alarm grading model trained in advance, obtains an initial alarm grading result output by the alarm grading model, obtains a time stamp corresponding to the current flow data, determines the system time corresponding to the current flow data based on the time stamp, performs weighting treatment on each alarm grading in the initial alarm grading result according to the system time and a preset time weight configuration table to obtain a plurality of weighted alarm grading, combines the plurality of weighted alarm grading to obtain a flow alarm grading result, and outputs the flow alarm grading result. The application completes the initial alarm classification through the alarm classification model, and weights the initial alarm classification according to the characteristics and the historical data of the service flow in each time period, thereby realizing the dynamic adjustment of the alarm classification, realizing the self-adaptive alarm classification, accurately evaluating the severity of the alarm in the dynamically changed flow data and providing accurate and efficient priority processing sequence for operation and maintenance personnel.

From the above description of the embodiments, it will be clear to those skilled in the art that the above-described embodiment method may be implemented by means of software plus a necessary general hardware platform, but of course may also be implemented by means of hardware, but in many cases the former is a preferred embodiment. Based on such understanding, the technical solution of the present application may be embodied essentially or in a part contributing to the prior art in the form of a software product stored in a storage medium (e.g. ROM/RAM, magnetic disk, optical disk) comprising instructions for causing a terminal device (which may be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.) to perform the method according to the embodiments of the present application.

The application is operational with numerous general purpose or special purpose computer system environments or configurations. For example: personal computers, server computers, hand-held or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, distributed computing environments that include any of the above systems or devices, and the like. The application may be described in the general context of computer-executable instructions, such as program modules, being executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform particular tasks or implement particular abstract data types. The application may also be practiced in distributed computing environments where tasks are performed by remote processing devices that are linked through a communications network. In a distributed computing environment, program modules may be located in both local and remote computer storage media including memory storage devices.

It is apparent that the above-described embodiments are only some embodiments of the present application, but not all embodiments, and the preferred embodiments of the present application are shown in the drawings, which do not limit the scope of the patent claims. This application may be embodied in many different forms, but rather, embodiments are provided in order to provide a thorough and complete understanding of the present disclosure. Although the application has been described in detail with reference to the foregoing embodiments, it will be apparent to those skilled in the art that modifications may be made to the embodiments described in the foregoing description, or equivalents may be substituted for elements thereof. All equivalent structures made by the content of the specification and the drawings of the application are directly or indirectly applied to other related technical fields, and are also within the scope of the application.

Claims

1. An alarm classification method for a service system, comprising:

extracting the characteristics of the current flow data to obtain the characteristics of the current flow data;

importing the current flow data characteristics into a pre-trained alarm classification model, and obtaining an initial alarm classification result output by the alarm classification model;

Acquiring a time stamp corresponding to the current flow data, and determining a system time corresponding to the current flow data based on the time stamp;

2. The method for alert classification in a service system according to claim 1, further comprising, before said importing the current flow data characteristic into a pre-trained alert classification model to obtain an initial alert classification result output by the alert classification model:

receiving a training instruction of the alarm classification model, and acquiring historical flow data of a service system based on the training instruction;

marking the historical flow data based on a preset warning grading label, and constructing a training data set and a verification data set based on the marked historical flow data;

model training is carried out on a preset initial classification model based on the training data set, and the alarm classification model is obtained;

And carrying out model verification on the alarm grading model based on the verification data set, and outputting the alarm grading model verified by the model.

3. The method for classifying alarms of the service system according to claim 2, wherein the training of the model for the preset initial classification model based on the training data set to obtain the alarm classification model specifically comprises:

and carrying out iterative updating on the initial classification model based on the classification error until the model is fitted to obtain the alarm classification model.

4. The method for alert classification in a service system according to claim 1, further comprising, before weighting each alert classification in the initial alert classification result according to the system time and a preset time weight configuration table to obtain a plurality of weighted alert classifications:

calculating a business processing error reporting amount ratio based on the business processing amount and the system error reporting amount in each system operation sub-time;

and configuring the time weight configuration table according to the sequencing result of the business processing error reporting quantity ratio.

5. The method for classifying alarms in a service system according to claim 1, wherein each alarm classification in the initial alarm classification result is weighted according to the system time and a preset time weight configuration table to obtain a plurality of weighted alarm classifications, and the method specifically comprises:

determining a weighting weight according to the system time and a preset time weight configuration table;

6. The method for classifying alarms in a service system according to claim 1, wherein said combining a plurality of said weighted alarms to obtain a flow alarm classification result and outputting said flow alarm classification result comprises:

Acquiring a data display template which is matched with a plurality of weighted alarm grades, and obtaining a target data display template;

importing a plurality of weighted alarms into the target data display template in a grading manner to obtain the flow alarm grading result;

and visually outputting the flow alarm grading result.

7. The method for alert classification in a service system according to claim 1, further comprising, after said combining a plurality of said weighted alert classifications to obtain a flow alert classification result and outputting said flow alert classification result:

receiving a feedback instruction aiming at the flow alarm grading result, and analyzing the feedback instruction to acquire an alarm grading adjustment mode;

judging the type of the alarm hierarchical adjustment mode, wherein the alarm hierarchical adjustment mode comprises a first adjustment type and a second adjustment type, the first adjustment type is the re-iteration alarm hierarchical model, and the second adjustment type carries out alarm hierarchical adjustment based on adjustment parameters;

if the alarm grading adjustment mode is a first adjustment type, re-iterating the alarm grading model, processing the current flow data based on a new alarm grading model to obtain a new initial alarm grading result, and re-weighting the new initial alarm grading result to obtain a first adjustment result of flow alarm grading;

And if the alarm classification adjustment mode is the second adjustment type, acquiring the adjustment parameters input by the user, and adjusting the flow alarm classification result based on the adjustment parameters to obtain a second adjustment result of the flow alarm classification.

8. An alarm classification apparatus for a service system, comprising:

the feature extraction module is used for extracting features of the current flow data to obtain current flow data features;

the alarm grading module is used for importing the current flow data into a pre-trained alarm grading model and acquiring an initial alarm grading result output by the alarm grading model;

9. A computer device comprising a memory and a processor, the memory having stored therein computer readable instructions which when executed by the processor implement the steps of the alert classification method of a business system of any of claims 1 to 7.

10. A computer readable storage medium having stored thereon computer readable instructions which when executed by a processor implement the steps of the alert classification method of a business system according to any of claims 1 to 7.