CN108964951B

CN108964951B - Method for acquiring alarm information and server

Info

Publication number: CN108964951B
Application number: CN201710357997.XA
Authority: CN
Inventors: 陈爱明; 蔺绍祝
Original assignee: Tencent Technology Shenzhen Co Ltd
Current assignee: Yunnan Tengyun Information Industry Co.,Ltd.
Priority date: 2017-05-19
Filing date: 2017-05-19
Publication date: 2020-12-29
Anticipated expiration: 2037-05-19
Also published as: CN108964951A

Abstract

The embodiment of the invention discloses a method for acquiring alarm information, which comprises the following steps: acquiring service data, wherein the service data is data monitored by a server at present; determining service data to be alarmed from the service data according to a preset monitoring rule, wherein the preset monitoring rule is obtained according to an optimal sample and a custom experience sample, the optimal sample is a sample determined according to a preset sample amount, and the custom experience sample is a pre-designated sample; and generating alarm information according to the service data to be alarmed, and sending the alarm information to the client. The embodiment of the invention also provides a server. The invention trains the optimal sample and the custom experience sample to obtain the preset monitoring rule, on one hand, the optimal sample can be adjusted in real time according to the current monitoring data so as to improve the flexibility of the algorithm, and on the other hand, the custom experience sample is introduced so as to increase more representative experience samples, thereby further improving the monitoring accuracy of the business monitoring system.

Description

Method for acquiring alarm information and server

Technical Field

The invention relates to the field of internet monitoring, in particular to a method and a server for acquiring alarm information.

Background

With the rapid development of internet services, automated monitoring is also receiving more and more attention. In order to improve the monitoring accuracy, the timeliness of the selected samples should be considered in the process of selecting the samples by the business monitoring system, and meanwhile, as the traffic volume is larger and larger, the memory of the business monitoring system is consumed by the collection and training of the samples.

Currently, in order to balance time consumption, memory consumption and sample accuracy of the algorithm, a minimum fluctuation rate and Optimization of the Correlation Coefficient (MVOCC) algorithm has been designed. The MVOCC algorithm utilizes the symmetry of the incidence matrix to reduce the complexity of time and space, and can eliminate delay factors when calculating the accumulated fluctuation rate, thereby improving the accuracy of the algorithm. In addition, the MOVCC algorithm does not need manual intervention in the execution process, and the sample combination which can represent the overall level of the current monitoring point is identified through self-help learning of historical samples, so that reliable optimal samples are provided for monitoring.

However, in cloud service monitoring, since the cloud service has a higher requirement on real-time performance and the iteration speed is faster, a more real-time dynamic sample needs to be selected for learning. And the MVOCC algorithm can only select the optimal sample in the static samples, so that the algorithm flexibility is poor, and the monitoring accuracy of a service monitoring system is difficult to meet.

Disclosure of Invention

The embodiment of the invention provides a method for acquiring alarm information and a server, which can adjust an optimal sample according to current monitored data in real time so as to improve the flexibility of an algorithm, and can increase more representative experience samples by introducing a custom experience sample so as to further improve the monitoring accuracy of a service monitoring system.

In view of this, the first aspect of the present invention provides a method for acquiring alarm information, including:

acquiring service data, wherein the service data is data monitored by a server at present;

determining service data to be alarmed from the service data according to a preset monitoring rule, wherein the preset monitoring rule is obtained according to learning of an optimal sample and a custom experience sample, the optimal sample is a sample determined according to a preset sample amount, and the custom experience sample is a pre-designated sample;

and generating alarm information according to the service data to be alarmed, and sending the alarm information to a client.

A second aspect of the present invention provides a server, comprising:

the system comprises a first acquisition module, a second acquisition module and a third acquisition module, wherein the first acquisition module is used for acquiring service data, and the service data is data monitored by a server at present;

the first confirming module is used for determining the service data to be alarmed from the service data acquired by the first acquiring module according to a preset monitoring rule, wherein the preset monitoring rule is obtained by learning according to an optimal sample and a custom experience sample, the optimal sample is a sample determined according to a preset sample amount, and the custom experience sample is a pre-designated sample;

and the sending module is used for generating alarm information according to the service data to be alarmed determined by the first confirming module and sending the alarm information to a client.

A third aspect of the present invention provides a server, comprising: a memory, a transceiver, a processor, and a bus system;

wherein the memory is used for storing programs;

the processor is used for executing the program in the memory, and specifically comprises the following steps:

generating alarm information according to the service data to be alarmed, and sending the alarm information to a client;

the bus system is used for connecting the memory, the transceiver and the processor so as to enable the memory, the transceiver and the processor to communicate.

A fourth aspect of the present invention provides a computer-readable storage medium having stored therein instructions, which, when run on a computer, cause the computer to perform the method of the above-described aspects.

According to the technical scheme, the embodiment of the invention has the following advantages:

the embodiment of the invention provides a method for acquiring alarm information, which comprises the steps that firstly, a server acquires service data, the service data is data monitored by the server at present, then service data to be alarmed is determined from the service data according to a preset monitoring rule, the preset monitoring rule is obtained by learning according to an optimal sample and a user-defined experience sample, the optimal sample is a sample determined according to a preset sample size, the user-defined experience sample is a pre-designated sample, and finally the server generates alarm information according to the service data to be alarmed and sends the alarm information to a client. By the method, the preset monitoring rule is obtained by training the optimal sample and the custom experience sample, on one hand, the optimal sample can be adjusted in real time according to the current monitored data, so that the flexibility of the algorithm is improved, on the other hand, the custom experience sample is introduced, more representative experience samples can be added, and the monitoring accuracy of the business monitoring system is further improved.

Drawings

Fig. 1 is a topology diagram of cloud service monitoring in an embodiment of the present invention;

FIG. 2 is a diagram of an embodiment of a method for acquiring alarm information according to the embodiment of the present invention;

FIG. 3 is a diagram of one embodiment of a server in an embodiment of the invention;

FIG. 4 is a diagram of another embodiment of a server in an embodiment of the present invention;

FIG. 5 is a diagram of another embodiment of a server in an embodiment of the present invention;

FIG. 6 is a diagram of another embodiment of a server in an embodiment of the present invention;

FIG. 7 is a diagram of another embodiment of a server in an embodiment of the present invention;

FIG. 8 is a diagram of another embodiment of a server in an embodiment of the present invention;

FIG. 9 is a diagram of another embodiment of a server in an embodiment of the present invention;

FIG. 10 is a diagram of another embodiment of a server in an embodiment of the present invention;

FIG. 11 is a diagram of another embodiment of a server in an embodiment of the present invention;

FIG. 12 is a diagram of another embodiment of a server in an embodiment of the present invention;

fig. 13 is a schematic structural diagram of a server in an embodiment of the present invention.

Detailed Description

The terms "first," "second," "third," "fourth," and the like in the description and in the claims, as well as in the drawings, if any, are used for distinguishing between similar elements and not necessarily for describing a particular sequential or chronological order. It is to be understood that the data so used is interchangeable under appropriate circumstances such that the embodiments of the invention described herein are, for example, capable of operation in sequences other than those illustrated or otherwise described herein. Furthermore, the terms "comprises," "comprising," and "having," and any variations thereof, are intended to cover a non-exclusive inclusion, such that a process, method, system, article, or apparatus that comprises a list of steps or elements is not necessarily limited to those steps or elements expressly listed, but may include other steps or elements not expressly listed or inherent to such process, method, article, or apparatus.

It should be understood that the present invention may be applied to a scenario in which a server sends alarm information to a client, please refer to fig. 1, where fig. 1 is a topological diagram of cloud service monitoring in an embodiment of the present invention, as shown in the figure, taking a cloud service charging system as an example, a monitoring point for real-time traffic monitoring in the system is configured with a real-time monitoring rule, the monitoring point may be a client a, a client B, a client C, a client D, and a client E in fig. 1, the cloud service charging system sends information of the monitoring point to the server, and the server performs training by using data monitored in real time, so as to learn a fluctuation track and a fluctuation rule. A dynamic model can be obtained through real-time sample selection and training, each monitoring point is continuously monitored by using the model, and once the result output by the model indicates that the data of the current cloud service has problems, warning information can be transmitted to the client so that a user can master the condition of the cloud service more quickly.

The alarm information acquisition method provided by the invention mainly depends on an optimal sample pool dynamic learning algorithm, and the optimal sample pool dynamic learning algorithm can be called as a preset monitoring rule, so that the problem that the optimal sample pool is learned under the condition that fault data and health data are mixed can be solved, and a reliable basis is provided for the monitoring process.

The core part of the preset monitoring rule mainly comprises: and determining the optimal number of samples through sample division, selecting a candidate set by minimizing the fluctuation accumulated difference value of the initial sample sampling sequence, and then maximizing the cumulative sum of the correlation coefficients of each sample combination in the candidate set to obtain the optimal sample. In addition, training of the preset monitoring rules also supports a new sample marked by an artificial experience value, a new sample meeting conditions, namely a custom experience sample, is injected into the sample pool to form a preliminary sample pool, finally, in the algorithm execution process, self-help learning is carried out on the current sample in each statistical period, artificial experience participation is supported, the abnormal history is removed firstly in the next track updating period, and the abnormal sample is directly skipped in the optimal sample selection process. The sample pool is continuously updated in the process, and the dynamic optimal sample pool is finally formed through self-help dynamic learning and empirical value definition.

Referring to fig. 2, a method for acquiring alarm information according to the present invention will be described below from the perspective of a server, where an embodiment of the method for acquiring alarm information according to the present invention includes:

101. acquiring service data, wherein the service data is data monitored by a server at present;

in this embodiment, first, the server obtains service data, where the service data refers to data currently monitored by the server, such as charging data of cloud services.

It can be understood that in the cloud service charging system, the server may use each domain name as a monitoring point and analyze the traffic charging condition of each domain name. The server may also assign a unique identifier, that is, domain _ id, to the monitoring point, and in practical applications, the monitoring point may also be other content, which is only an illustration here and should not be construed as a limitation to the present invention.

102. Determining service data to be alarmed from the service data according to a preset monitoring rule, wherein the preset monitoring rule is obtained according to learning of an optimal sample and a custom experience sample, the optimal sample is a sample determined according to a preset sample amount, and the custom experience sample is a pre-designated sample;

in this embodiment, the server determines service data to be alarmed from the service data acquired in real time according to a preset monitoring rule, where the service data to be alarmed may be abnormal service data.

Specifically, the preset monitoring rule is obtained by learning according to an optimal sample and a custom experience sample, the optimal sample is a healthy sample combination which does not contain fault dirty data or contains the fault dirty data as little as possible, the sequence trends of each sample in the optimal sample are basically consistent, sudden fluctuation of mutation does not occur, and the optimal sample can represent the overall level of the current monitoring point. The custom experience sample is a sample which is selected and designated by a senior business person or an algorithm designer according to experience participation. The server can store the optimal sample and the user-defined experience sample into the optimal sample pool, the optimal sample pool is continuously updated along with continuous development and continuation of the business, and the preset monitoring rule can be obtained by periodically learning according to the optimal sample pool. The above process may be understood as a dynamic learning process.

It is understood that the sampling value sequence of a statistical period of the monitoring point is recorded as a sample sequence. Assuming "day" as the statistical analysis period, the sequence of samples for the optimal sample in a day is the sample sequence. For example, if the granularity is 1 minute, the sample length is 1440, and if the granularity is 5 minutes, the sample length is 288, the sampling granularity may be different for different monitoring points in different services, which is not limited herein.

103. And generating alarm information according to the service data to be alarmed, and sending the alarm information to the client.

In this embodiment, after acquiring the service data to be alarmed, the server may generate corresponding alarm information according to the type and content of the service data to be alarmed, and send the alarm information to the client.

Optionally, on the basis of the embodiment corresponding to fig. 2, in a first optional embodiment of the method for acquiring alarm information provided in the embodiment of the present invention, before determining the service data to be alarmed from the service data according to the preset monitoring rule, the method may further include:

acquiring a sample set, wherein the sample set comprises a plurality of sample data, and each sample data is preprocessed data;

determining a training sample size and a preset sample size according to the total amount of sample data in the sample set;

calculating a fluctuation rate difference sequence of each sample data in the sample set;

selecting a sample set to be selected corresponding to the training sample size from the sample set according to the fluctuation rate difference sequence of each sample data in the sample set;

and selecting the optimal sample corresponding to the preset sample size from the sample set to be selected.

In this embodiment, a method for obtaining an optimal sample will be described, and the process mainly includes dividing the preprocessed sample, learning a candidate set, and determining the optimal sample.

Specifically, the server acquires a sample set containing a plurality of sample data, and the sample data in the sample set is preprocessed. According to a common data set partitioning principle (namely a training set: a test set: a verification set: 1:1) of an automatic algorithm design and analysis correlation theory, a preprocessed sample set ModelData can be partitioned, and if N sample data exist in the sample set, the training sample amount belonging to a training and testing stage can be determined to be

The preset sample size of the optimal sample set is

Then, the server calculates the wave rate difference sequence of each sample data in the sample set, and according to the calculation processing result, the sample data is arranged in ascending order and is selected to be arranged in the front

The sample set to be selected is learned (i.e. the difference sequence of the fluctuation rates is minimum)

Sample data) to select a sample set to be selected, wherein the sample set to be selected does not fluctuate severely in Modldata.

Through the learning of the sample set to be selected, the sample data with abnormal fluctuation is removed as much as possible, and the final optimal sample is selected and directly selected from the sample set to be selected.

Secondly, in the embodiment of the invention, a method for obtaining an optimal sample is introduced, namely a sample set is required to be obtained firstly, then a training sample size and a preset sample size are determined according to the total amount of sample data in the sample set, further a fluctuation rate difference sequence of each sample data is calculated, a sample set to be selected corresponding to the training sample size is selected from the sample set according to a calculation result, and finally the optimal sample corresponding to the preset sample size is selected from the sample set to be selected. By the method, the optimal sample can be dynamically selected from the sample set, and the abnormal value which is not beneficial to the training accuracy is removed from the sample set, so that the accuracy of the preset monitoring rule for training is improved, and the feasibility of the scheme is improved.

Optionally, on the basis of the first embodiment corresponding to fig. 2, in a second optional embodiment of the method for acquiring alarm information provided in the embodiment of the present invention, calculating the fluctuation rate difference sequence of each sample data in the sample set may include:

calculating the fluctuation rate difference sequence of each sample data as follows:

wherein, VolatySumSeq_kRepresenting the fluctuation rate difference sequence of the sample data, k is a positive integer which is greater than or equal to 1 and less than or equal to the total amount of the sample data, i is a sampling point identifier, n is the maximum value of the sampling point identifier, VolatySeq_k(i) VolatySeq, which represents the calculation of the fluctuation rate sequence with the sampling point labeled i_k(i +1) represents the calculation result of the fluctuation rate sequence with the sampling point labeled (i +1), M₀The interval of fluctuation rate adopted is represented as M₀And t represents (M)₀+ i) sample point identifications, X_k(i) Indicating sample data with the kth sample point identified as i.

In this embodiment, any sample data X in the sample set model data is subjected to_k(i) And the calculation result of the corresponding fluctuation rate sequence is recorded as VolatySeq_kWherein X is_k(i) E.g. ModelData, sample identificationk is 1,2, …, N, and the sample point identifier i is 1,2, …, N. For any sampling point i, defining the calculation result of the fluctuation rate sequence as follows:

wherein, i ═ M₀+1,M₀+2, n, when X_k(i-M₀) When 0, VolatySeq is defined_k(i)＝|X_k(i) I ═ 1,2, …, M₀When 1 to M₀Sampling points with a fluctuation rate at intervals of M₀Length of M₀A continuous fluctuation rate sequence of +1 is defined by moving the average forward. For example, the fluctuation rate of the 1 st sampling point, M of the result is calculated by using the fluctuation rate sequence₀+1 to 2M₀The average of +1 points is substituted, since the calculation formula of the calculation result of the available fluctuation ratio sequence is:

next, a fluctuation rate difference sequence of each sample data is calculated according to the calculation result of the fluctuation rate sequence. Specifically, all sample data are circulated in a sample set, and a fluctuation rate difference sequence VolatySeq of each sample data is calculated according to formula (1) and formula (2)_kNamely:

where k is 1,2, …, N.

Then, a sample set to be selected can be obtained according to the calculation result of the formula (3), specifically, the fluctuation rate difference sequence VolatySumSeq is obtained_kThen, sorting the obtained data in ascending order to obtain: SORT (VolatySumSeq, 1), selects the row in front

Corresponding sample data, i.e. fluctuation rateMinimum cumulative difference

The sample data selected by the minimum fluctuation rate accumulated difference sequence is the sample data which is the sample set to be selected of the algorithm and is the least possible to generate severe mutation fluctuation, namely the sample set to be selected is marked as Candidsamp.

Thirdly, the embodiment of the invention provides a mode for calculating the sample data fluctuation rate differential sequence, namely, a specific calculation formula is adopted to obtain a result. By the mode, the feasibility and operability of the scheme can be further improved.

Optionally, on the basis of the first embodiment corresponding to fig. 2, in a third optional embodiment of the method for acquiring alarm information provided in the embodiment of the present invention, selecting an optimal sample corresponding to a preset sample size from a sample set to be selected may include:

determining at least one array subset according to the training sample amount and a preset sample amount by adopting a permutation and combination mode;

calculating the cumulative sum and range of the corresponding correlation coefficients of the array subset;

and selecting the optimal sample corresponding to the preset sample size from at least one array subset according to the cumulative sum and the range of the correlation coefficients corresponding to the array subsets.

In this embodiment, the server obtains at least one array subset by way of permutation and combination, and the training sample size and the preset sample size need to be considered during permutation and combination. And calculating the cumulative sum and range of the correlation coefficients corresponding to each array subset, and selecting the optimal sample corresponding to the preset sample size from at least one array subset according to the calculation result.

The correlation coefficient is a statistical index for reflecting the closeness of the correlation between the variables. The correlation coefficient is calculated according to a product difference method, and the degree of correlation between two variables is reflected by multiplying the two dispersion differences on the basis of the dispersion difference of the two variables and the respective average value.

The range is the data obtained by subtracting the minimum value from the maximum value, which is the difference between the maximum value and the minimum value, to represent the number of variations in the statistical data.

In the embodiment of the present invention, a method for selecting an optimal sample from a sample set to be selected is described, that is, at least one data subset is exhausted in a permutation and combination manner, then the cumulative sum and the range of the correlation coefficients corresponding to the data subset are calculated by using the symmetry of the matrix, and finally the optimal sample is selected according to the calculation result. Through the mode, a specific implementation mode can be provided for implementation of the scheme, and therefore the practicability and feasibility of the scheme are improved.

Optionally, on the basis of the third embodiment corresponding to fig. 2, in a fourth optional embodiment of the method for acquiring alarm information provided in the embodiment of the present invention, calculating the cumulative sum and the range of the correlation coefficients corresponding to the array subset may include:

and calculating the cumulative sum of the corresponding correlation coefficients of the array subsets according to the following modes:

summr(j)＝SUM(R_u)；

R_u＝{r₁,r₂,…,r_P}；

wherein, summr (j) represents the cumulative sum of the related coefficients corresponding to the j-th array subset, R_uRepresenting the corresponding correlation coefficient of each array subset, X representing a first array subset, Y representing a second array subset, both the first array subset and the second array subset belonging to the array subsets, r₁Representing the correlation coefficient of the first array subset and the second array subset, P representing the calculation times, and A representing the preset sample size;

the range of the array subset is calculated as follows:

mmr(j)＝MAX(R_u)-MIN(R_u)；

wherein mmr (j) represents the polar difference, MAX (R), corresponding to the j-th array subset_u) Denotes the maximum value of the correlation coefficient, MIN (R)_u) Representing the minimum value of the correlation coefficient.

In this embodiment, the number of sample combinations for constructing the sample set to be selected is exhaustive, and the sample set to be selected includes

Individual sample data, and the last required optimal sample is

The sample data is the problem of the number of combinations in a permutation and combination, and the exhaustive schemes are all

And (4) seed preparation. Numbering the sample data in the sample set to be selected and recording the sample data as the sample data

The problem can be categorized as a set of slaves

Is selected out

The problem of array subset, which is just exhaustive, is here denoted as:

next, take one set of CombIndexs arbitrarily, assume that the subset of the set is:

for any two samples in comblndexs (j), i.e., the first array subset X and the second array subset Y, the correlation coefficient is defined as follows:

combining all pairwise array subsets in the CombIndexs (j) in a loop to obtain a correlation coefficient matrix, also called a correlation matrix, of the CombIndexs (j), because the CombIndexs (j) has

For each sample data, the calculation times P of the correlation coefficient is:

the characteristic of the correlation matrix is analyzed, the symmetry of the correlation matrix is utilized, and the main diagonal elements of the matrix are all 1, so that the calculation times of the correlation coefficient can be reduced to the degree that the correlation coefficient is calculated by directly utilizing the two properties without circulating all pairwise array subset combinations

The number of times is noted as P, i.e.

Ratio of this to

The time cost is greatly reduced, and the algorithm efficiency is improved. Taking all the elements above the main diagonal of the correlation matrix of CombIndexs (j), and recording as the correlation coefficient R_u＝{r₁,r₂,…,r_PThus, the correlation coefficients of CombIndexs (j) can be accumulated and summr (j) SUM (R)_u) Polar difference mmr (j) MAX (R)_u)-MIN(R_u)。

Further, in the embodiment of the present invention, a way of calculating a cumulative sum of correlation coefficients and calculating a range difference is provided, that is, a correlation formula is used for calculation. By the method, the feasibility and the practicability of the scheme can be increased.

Optionally, on the basis of the third or fourth embodiment corresponding to fig. 2, in a fifth optional embodiment of the method for acquiring alarm information according to the embodiment of the present invention, selecting an optimal sample corresponding to a preset sample size from at least one array subset according to the cumulative sum and the range of the correlation coefficients corresponding to each array subset may include:

selecting an optimal sample to be selected corresponding to a preset sample amount from the array subset according to the cumulative sum of the correlation coefficients;

obtaining a correlation coefficient maximum value set and a correlation coefficient minimum value set, wherein the correlation coefficient maximum value set and the correlation coefficient minimum value set are used for calculating range, the correlation coefficient maximum value set comprises at least one correlation coefficient maximum value, and the correlation coefficient minimum value set comprises at least one correlation coefficient minimum value;

and if the maximum value set of the correlation coefficient and the minimum value set of the correlation coefficient have coincident parameters, selecting an optimal sample from the optimal samples to be selected.

In this embodiment, the server may select the optimal sample corresponding to the preset sample size from at least one array subset according to the sum and the range of the correlation coefficients corresponding to each array subset.

In particular, since CombIndexs is always in common

For the sample combination, j of the cumulative sum of correlation coefficients summers (sum) and the polar difference mmr (sum) is set as

Each j is cycled, and the cumulative sum and the range of the sample combination number of the sample set to be selected and the corresponding correlation coefficients can be obtained, and can be recorded as Candidate { comblndex (j), summr (j), mmr (j) }, and

here, the second dimension of the set Candidate is sorted in descending order, with the top being fetched

I.e. with the largest correlation coefficient

A combination of samples, renumbered by bestcandite { comblndexs (t), summr (t), mmr (t) }, where

Arrangement of correlation coefficients

Thereby obtaining the optimal sample to be selected.

And then, selecting the optimal sample from the BestCandidate to be selected, wherein the selection rule is that the cumulative sum of the correlation coefficients is as maximum as possible, and the range is as minimum as possible. For example, finding the correlation coefficient running sum maximum in BestCandidate

The corresponding combination number is S₁Then find the minimum worst

The corresponding combination number is S₂

Since there may be more than one maximum and minimum values, S₁And S₂Not necessarily a unique number, but a set, where the set of comparisons S₁And S₂If there is a pair of identical values, the values are denoted as S₀I.e. S₀＝S₁S₂If so, finding the optimal sample and carrying out the next operation; if S₁And S₂If the values are different from each other, the optimal sample does not exist, and only the suboptimal sample can be searched, wherein the searching method comprises the steps of firstly removing the sample combination (possibly a plurality of) with the maximum range from the BestCandidate, then selecting the sample combination with the accumulated correlation coefficient and the maximum correlation coefficient from the rest sample combinations, and updating S by using the obtained combination number₁At this time, if S₁Unique value, then S₀＝S₁Finding out suboptimal sample, proceeding the next step of algorithm, otherwise, proceeding from S₁Selecting a sample combination with minimum range, and updating S₀The combination of samples at this time is marked as a sub-optimal sample. Thus, the optimal sample of the algorithm is obtained, and the combination number is S₀The corresponding sample is marked as the optimal sample BestSamp.

Further, in this embodiment of the present invention, the server may select, according to the cumulative sum and the range of correlation coefficients corresponding to each array subset, an optimal sample corresponding to a preset sample size from at least one array subset, and the selected rule may select the optimal sample from the optimal samples to be selected when a parameter that coincides between the maximum value set of correlation coefficients and the minimum value set of correlation coefficients exists. By the method, the optimal sample selected by the server eliminates sample data which fluctuates severely, and the influence of abnormal sample data on the rule training effect is reduced.

Optionally, on the basis of the first embodiment corresponding to fig. 2 or fig. 2, in a sixth optional embodiment of the method for acquiring alarm information provided in the embodiment of the present invention, before determining the service data to be alarmed from the service data according to the preset monitoring rule, the method may further include:

receiving a custom experience data set, wherein the custom experience data set comprises a plurality of custom experience data;

obtaining a fluctuation rate sequence calculation result corresponding to the user-defined experience data set;

determining a fluctuation rate confidence interval according to the calculation result of the fluctuation rate sequence;

and judging whether the custom experience data is in the fluctuation rate confidence interval or not, and if so, determining that the custom experience data belongs to the custom experience sample.

In this embodiment, after the optimal sample is obtained, the custom experience data added manually may be further obtained, but not all the custom experience data may be directly used for training.

Specifically, the server may first receive a custom experience data set, where the custom experience data set includes a plurality of custom experience data, and then calculate a fluctuation rate sequence calculation result corresponding to the custom experience set. E.g. arbitrarily taking one of the labels kSelf-defining empirical data, and calculating the corresponding fluctuation rate sequence to obtain VolatySeq_kThe calculation method may refer to formula (2), which is not described herein.

In a sample set Candidamp to be selected, according to the calculation results of the fluctuation rate sequences, calculating the calculation results CVolatySeq of the fluctuation rate sequences of all samples in the Candidamp, and further calculating the confidence interval ConfSeq of the fluctuation rate of a candidate set to be [ mu-3, mu +3 ═ 3]Where μ is the MEAN sequence of CVolatySeq, and is the standard deviation sequence, i.e., μ ═ MEAN { CVolatySeq },

VolatySeq for custom empirical data sets may then be applied_kStrictly judging with the confidence interval sequence ConfSeq by the fluctuation rate VolatySeq of any sampling point i_k(i) If the point is out of the confidence interval, the sample is judged not to meet the empirical sample condition and cannot enter a sample pool, namely, VolatySeq is required_k(i) E, confseq (i), i ═ 1,2, …, n. All the manual experience value samples meeting the conditions are taken as custom experience samples in the current period and are recorded as DefindSamp.

And finally, the optimal sample BestSamp and the custom empirical sample DefindSamp form an optimal sample pool of the algorithm, and the optimal sample pool is recorded as AgoriSampPool. And (4) learning related monitoring rules according to AgoriSampPool, and providing a monitoring basis for service operation.

Thirdly, in the embodiment of the invention, a rule that the server acquires the custom experience data is introduced, that is, the server receives a custom experience data set at first, wherein the custom experience data set comprises a plurality of custom experience data, then a fluctuation rate sequence calculation result corresponding to the custom experience data set is acquired, and finally the server determines a fluctuation rate confidence interval according to the fluctuation rate sequence calculation result, so as to judge whether the custom experience data is in the fluctuation rate confidence interval or not, and if so, the custom experience data is determined to belong to a custom experience sample. Through the mode, the optimal sample learning is adopted, and the user-defined experience sample is added, so that the sample pool is representative to the current monitoring point, the false alarm of the service monitoring can be reduced, and the reasonability of the rule is improved.

Optionally, on the basis of the first embodiment corresponding to fig. 2, in a seventh optional embodiment of the method for acquiring alarm information provided in the embodiment of the present invention, before acquiring the sample set, the method may further include:

continuously acquiring sample data to be processed according to preset sample data acquisition conditions, wherein the preset sample data acquisition conditions are used for indicating at least one of a data path, a data type, a sampling period and a sampling time label;

and when the data volume of the sample data to be processed is not within the range of the preset sampling data volume, stopping acquiring the sample data to be processed and generating a sample set to be processed.

In this embodiment, before the server obtains the sample set, sample data to be processed is continuously obtained according to a preset sample data collection condition, where the preset sample data collection condition is used to indicate at least one of a data path, a data type, a sampling period, and a sampling time tag.

The data path is used for indicating the source of data, the data type may carry a tag, that is, data _ type, and it is specified that data _ type-1 represents rate data, such as a success rate or a source recovery rate, and data _ type-1 represents non-rate data, such as traffic, a number of users, and the like. The sampling time of the monitoring point is labeled m _ factor, and the unit is minutes, and if m _ factor is 5, the sampling time represents that one data is sampled every 5 minutes. Calculating time delay M of fluctuation rate₀Threshold value N of the number of burr points₀Determined by M _ factor, and if M _ factor is 5, the value M is taken₀＝3，N₀If M _ factor is 1, the value M is taken as 3₀＝5，N₀4. The sampling period includes the minimum sampling value Min₀And Max of samples₀. For example, in statistical units of days, the default Min is set₀＝7，Max₀30, i.e. at least 7 days, at mostThe algorithm starts learning 30 days more sample data.

The server automatically pulls the original sample data ModelDataTmp to be processed according to the specified data path, sampling period, data type data _ type, sampling time tag m _ factor and the like. Then judging whether the data volume N in the sample data ModoldDataTmp to be processed is [ Min ]₀,Max₀]And if not, finishing the algorithm, otherwise, calculating the length n of the sample, and continuing to execute subsequent operations.

And thirdly, before the server acquires the sample set, the server also needs to collect corresponding sample data to be processed according to preset sample data acquisition conditions, and stops acquiring the sample data to be processed when a certain number of the sample data to be processed is reached and generates the sample set to be processed. By the method, the server can acquire more real-time sample data to be processed, and the data volume of the sample data to be processed has certain limitation, so that the regularity and the accuracy of rule learning are improved.

Optionally, on the basis of the seventh embodiment corresponding to fig. 2, in an eighth optional embodiment of the method for acquiring alarm information according to the embodiment of the present invention, after stopping acquiring sample data to be processed and generating a sample set to be processed, the method may further include:

and if the missing target sample data to be processed exists in the sample data to be processed, acquiring the target sample data to be processed by adopting a moving average method, and adding the target sample data to be processed into the sample set to be processed.

In this embodiment, for some special services, data may need to be reported after being expanded or reduced by a certain multiple, and in this case, the data may be restored according to a convention.

And if the missing target sample data to be processed exists in the sample data to be processed, the missing target sample data to be processed should be supplemented. Specifically, using the forward moving average method, the moving step is N₀E.g. sample data samp to be processed_kIf data loss occurs at the point i, the completion method is as follows:

other points are used in this manner, and are not described herein.

Further, in the embodiment of the present invention, if the server detects that the missing target sample data to be processed exists in the sample data to be processed, the target sample data to be processed may also be obtained by using a moving average method, and the target sample data to be processed is added to the sample set to be processed. Through the mode, when a certain sampling point has a service fault or a machine fault and other reasons, the data which cannot be normally uploaded can be restored, so that the problem of data loss is solved, and the practicability of the scheme is improved.

Optionally, on the basis of the eighth embodiment corresponding to fig. 2, in a ninth optional embodiment of the method for acquiring alarm information provided in the embodiment of the present invention, after acquiring target sample data to be processed by using a moving average method, the method may further include:

acquiring a sample data subsequence from a sample set to be processed through a sliding window;

and if the length of the sample data subsequence is less than or equal to a preset threshold, smoothing each sample data to be processed in the sample data subsequence to obtain a preprocessed sample set.

In this embodiment, the sample data to be processed in the sample set may be further smoothed, so as to complete the data preprocessing process.

Specifically, a sample set to be processed is scanned through a sliding window, and when a sample data subsequence with sudden fluctuation is found, whether the data length l of the sample data subsequence is less than or equal to a preset threshold N or not is judged₀If l > N₀Then the sample data subsequence is considered to be a normal subsequence, and the sliding window continues to slide forward. If l is less than or equal to N₀If the sample data subsequence has burrs, smoothing the sample data subsequence; to obtainTo a sample set.

The embodiment adopts a forward moving average method, and the moving step length is N₀Firstly, smoothing the first sampling point in the sample data subsequence, and then smoothing the next sampling point, so that the phenomenon of pseudo-smoothing of the sampling points can be avoided.

It should be noted that, because the current service is rapidly developed, the timeliness problem of the dynamic learning process of the optimal sample pool must be considered in priority, so the time delay M is calculated for the fluctuation ratio in the invention₀And a threshold value N of the number of burr points₀Are set to fixed default values based on sample granularity, and parameter optimization methods may be employed where timeliness requirements are low. In this example, M₀And N₀The value of (A) is also the result of the optimization in the early stage of the algorithm design, wherein M is₀And N₀The value of (2) can be 3, 4 or 5, and under different value conditions, by analyzing the sampling granularity and with the help of the minimum residual principle, the value rule can be finally determined as follows: if M _ factor is equal to 5, then M₀＝3，N₀3; if M _ factor is equal to 1, then M₀＝5，N₀At this point the algorithm works best at 4.

Furthermore, in the embodiment of the present invention, after the server obtains the target sample data to be processed by using the moving average method, a sample data subsequence may be obtained from the sample set to be processed by using a sliding window, and if the length of the sample data subsequence is less than or equal to a preset threshold, each sample data to be processed in the sample data subsequence is subjected to smoothing processing, so as to obtain a preprocessed sample set. By the method, smooth sample data to be processed can be obtained, adverse effects of the burr data on sample learning are reduced, and accuracy of the preset monitoring rule is improved.

Referring to fig. 3, fig. 3 is a schematic diagram of an embodiment of a server according to an embodiment of the present invention, where the server 20 includes:

a first obtaining module 201, configured to obtain service data, where the service data is data currently monitored by a server;

a first confirming module 202, configured to determine service data to be alarmed from the service data acquired by the first acquiring module 201 according to a preset monitoring rule, where the preset monitoring rule is obtained according to an optimal sample and a custom experience sample, the optimal sample is a sample determined according to a preset sample amount, and the custom experience sample is a pre-specified sample;

a sending module 203, configured to generate alarm information according to the service data to be alarmed determined by the first determining module 202, and send the alarm information to a client.

In this embodiment, a first obtaining module 201 obtains service data, where the service data is data currently monitored by a server, a first determining module 202 determines service data to be alarmed from the service data obtained by the first obtaining module 201 according to a preset monitoring rule, where the preset monitoring rule is obtained by learning according to an optimal sample and a custom experience sample, the optimal sample is a sample determined according to a preset sample size, the custom experience sample is a pre-specified sample, and a sending module 203 generates alarm information according to the service data to be alarmed determined by the first determining module 202 and sends the alarm information to a client.

The embodiment of the invention provides a server, which comprises the steps of firstly obtaining service data by the server, determining the service data to be alarmed from the service data according to a preset monitoring rule, wherein the preset monitoring rule is obtained by learning according to an optimal sample and a custom experience sample, the optimal sample is a sample determined according to a preset sample amount, the custom experience sample is a pre-designated sample, and finally generating alarm information by the server according to the service data to be alarmed and sending the alarm information to a client. By the method, the preset monitoring rule is obtained by training the optimal sample and the custom experience sample, on one hand, the optimal sample can be adjusted in real time according to the current monitored data, so that the flexibility of the algorithm is improved, on the other hand, the custom experience sample is introduced, more representative experience samples can be added, and the monitoring accuracy of the business monitoring system is further improved.

Alternatively, on the basis of the embodiment corresponding to fig. 3, referring to fig. 4, in another embodiment of the server 20 provided in the embodiment of the present invention,

the server 20 may further include:

a second obtaining module 204A, configured to obtain a sample set before the first determining module 202 determines, according to a preset monitoring rule, to-be-alarmed service data from the service data, where the sample set includes multiple sample data, and each sample data is preprocessed data;

a second determining module 204B, configured to determine a training sample size and the preset sample size according to the total amount of the sample data in the sample set acquired by the second acquiring module 204A;

a calculating module 204C, configured to calculate a fluctuation rate difference sequence of each sample data in the sample set acquired by the second acquiring module 204A;

a first selecting module 204D, configured to select, according to the fluctuation rate difference sequence of each sample data in the sample set calculated by the calculating module 204C, a to-be-selected sample set corresponding to the training sample size determined by the second determining module 204B from the sample set;

a second selecting module 204E, configured to select the optimal sample corresponding to the preset sample size from the sample set to be selected by the first selecting module 204D.

Alternatively, on the basis of the embodiment corresponding to fig. 4, referring to fig. 5, in another embodiment of the server 20 provided in the embodiment of the present invention,

the calculation module 204C includes:

a first calculating unit 204C1, configured to calculate the fluctuation rate difference sequence of each sample data as follows:

wherein the VolatySumSeq_kRepresenting a fluctuation rate difference sequence of the sample data;

the k is a positive integer greater than or equal to 1 and less than or equal to the total amount of the sample data;

the i is a sampling point identifier, and the n is the maximum value of the sampling point identifier;

the VolatySeq_k(i) Representing the calculation result of the fluctuation rate sequence with the sampling point identification i;

the VolatySeq_k(i +1) represents the calculation result of the fluctuation rate sequence with the sampling point identifier of (i + 1);

the M is₀The interval of fluctuation rate adopted is represented as M₀；

Said t represents said (M)₀+ i) said sample point identifications;

said X_k(i) Representing the sample data with the kth sampling point identification i.

Alternatively, on the basis of the embodiment corresponding to fig. 4, referring to fig. 6, in another embodiment of the server 20 provided in the embodiment of the present invention,

the second selection module 204E includes:

a determining unit 204E1, configured to determine at least one array subset according to the training sample amount and the preset sample amount in a permutation and combination manner;

a second calculating unit 204E2, configured to calculate cumulative sums and range of correlation coefficients corresponding to the array subset determined by the determining unit 204E 1;

a selecting unit 204E3, configured to select the optimal sample corresponding to the preset sample size from the at least one array subset according to the cumulative sum of correlation coefficients and the range calculated by the second calculating unit 204E2 for the array subset.

Alternatively, on the basis of the embodiment corresponding to fig. 6, referring to fig. 7, in another embodiment of the server 20 provided in the embodiment of the present invention,

the second calculation unit 204E2 includes:

a calculating subunit 204E21, configured to calculate the cumulative sum of correlation coefficients corresponding to the array subset as follows:

summr(j)＝SUM(R_u)；

R_u＝{r₁,r₂,…,r_P}；

wherein, the summr (j) represents the cumulative sum of the correlation coefficients corresponding to the jth array subset;

the R is_uRepresenting the relevant coefficient corresponding to each array subset;

the X represents a first array subset, the Y represents a second array subset, and the first array subset and the second array subset both belong to the array subset;

said r₁A correlation coefficient representing the first array subset and the second array subset;

the P represents the number of calculations;

the A represents the preset sample size;

a computing subunit 204E21, further configured to compute the range for the array subset as follows:

mmr(j)＝MAX(R_u)-MIN(R_u)；

wherein, the mmr (j) represents the range corresponding to the j-th array subset;

the MAX (R)_u) Represents the maximum value of the correlation coefficient;

the MIN (R)_u) Representing the minimum value of the correlation coefficient.

Alternatively, on the basis of the embodiments corresponding to fig. 6 or fig. 7, referring to fig. 8, in another embodiment of the server 20 provided in the embodiment of the present invention,

the selection unit 204E3 includes:

a first selecting subunit 204E31, configured to select, according to the cumulative sum of the correlation coefficients, an optimal sample to be selected corresponding to the preset sample size from the array subset;

an obtaining subunit 204E32, configured to obtain a set of maximum correlation coefficient values and a set of minimum correlation coefficient values, where the set of maximum correlation coefficient values and the set of minimum correlation coefficient values are used to calculate the range, the set of maximum correlation coefficient values includes at least one maximum correlation coefficient value, and the set of minimum correlation coefficient values includes at least one minimum correlation coefficient value;

a second selecting subunit 204E33, configured to select the optimal sample from the optimal samples to be selected by the first selecting subunit 204E31, if the maximum value set of correlation coefficients acquired by the acquiring subunit 204E32 and the minimum value set of correlation coefficients have a parameter that coincides with each other.

Alternatively, on the basis of the embodiment corresponding to fig. 3 or fig. 4, referring to fig. 9, in another embodiment of the server 20 provided in the embodiment of the present invention,

the server 20 further includes:

a receiving module 205A, configured to receive a custom experience data set before the first determining module 202 determines, according to a preset monitoring rule, to-be-alerted service data from the service data, where the custom experience data set includes a plurality of custom experience data;

a third obtaining module 205B, configured to obtain a calculation result of a fluctuation rate sequence corresponding to the custom empirical data set received by the receiving module 205A;

a third determining module 205C, configured to determine a fluctuation rate confidence interval according to the calculation result of the fluctuation rate sequence acquired by the third acquiring module 205B;

a determining module 205D, configured to determine whether the custom experience data is within the fluctuation rate confidence interval determined by the third determining module 205C, and if so, determine that the custom experience data belongs to the custom experience sample.

Alternatively, referring to fig. 10 on the basis of the embodiment corresponding to fig. 4, in another embodiment of the server 20 provided in the embodiment of the present invention,

the server 20 further includes:

a fourth obtaining module 206A, configured to, before the second obtaining module 204A obtains the sample set, continuously obtain sample data to be processed according to a preset sample data collecting condition, where the preset sample data collecting condition is used to indicate at least one of a data path, a data type, a sampling period, and a sampling time tag;

a stopping module 206B, configured to stop obtaining the sample data to be processed and generate a sample set to be processed when the data size of the sample data to be processed obtained by the fourth obtaining module 206A is not within a preset sampling data size range.

Alternatively, referring to fig. 11 on the basis of the embodiment corresponding to fig. 10, in another embodiment of the server 20 provided in the embodiment of the present invention,

the server 20 further includes:

a fifth obtaining module 207, configured to, after the stopping module 206B stops obtaining the sample data to be processed and generates a sample set to be processed, if missing target sample data to be processed exists in the sample data to be processed, obtain the target sample data to be processed by using a moving average method, and add the target sample data to be processed to the sample set to be processed.

Alternatively, referring to fig. 12 on the basis of the embodiment corresponding to fig. 11, in another embodiment of the server 20 provided in the embodiment of the present invention,

the server 20 further includes:

a sixth obtaining module 208A, configured to, after the fifth obtaining module 207 obtains the target sample data to be processed by using a moving average method, obtain a sample data subsequence from the sample set to be processed through a sliding window;

a processing module 208B, configured to, if the length of the sample data subsequence obtained by the sixth obtaining module 208A is less than or equal to a preset threshold, perform smoothing processing on each sample data to be processed in the sample data subsequence to obtain the preprocessed sample set.

Fig. 13 is a schematic diagram of a server 300 according to an embodiment of the present invention, where the server 300 may have a relatively large difference due to different configurations or performances, and may include one or more Central Processing Units (CPUs) 322 (e.g., one or more processors) and a memory 332, and one or more storage media 330 (e.g., one or more mass storage devices) for storing applications 342 or data 344. Memory 332 and storage media 330 may be, among other things, transient storage or persistent storage. The program stored on the storage medium 330 may include one or more modules (not shown), each of which may include a series of instruction operations for the server. Still further, the central processor 322 may be configured to communicate with the storage medium 330 to execute a series of instruction operations in the storage medium 330 on the server 300.

The server 300 may also include one or more power supplies 326, one or more wired or wireless network interfaces 350, one or more input-output interfaces 358, and/or one or more operating systems 341, such as Windows Server, Mac OS XTM, UnixTM, LinuxTM, FreeBSDTM, and the like.

The steps performed by the server in the above embodiment may be based on the server structure shown in fig. 13.

The central processing unit 322 is configured to perform the following steps:

Optionally, the central processor 322 is further configured to perform the following steps:

determining a training sample size and the preset sample size according to the total amount of the sample data in the sample set;

Optionally, the central processor 322 is specifically configured to execute the following steps:

calculating the differential sequence of the fluctuation rate of each sample data as follows:

the M is₀The interval of fluctuation rate adopted is represented as M₀；

Said t represents said (M)₀+ i) said sample point identifications;

determining at least one array subset according to the training sample amount and the preset sample amount in a permutation and combination mode;

and selecting the optimal sample corresponding to the preset sample size from the at least one array subset according to the correlation coefficient cumulative sum and the range corresponding to the array subset.

calculating the cumulative sum of the correlation coefficients corresponding to the array subset as follows:

summr(j)＝SUM(R_u)；

R_u＝{r₁,r₂,…,r_P}；

the P represents the number of calculations;

the A represents the preset sample size;

calculating the range of the array subset as follows:

mmr(j)＝MAX(R_u)-MIN(R_u)；

the MAX (R)_u) Represents the maximum value of the correlation coefficient;

the MIN (R)_u) Representing the minimum value of the correlation coefficient.

selecting the optimal sample to be selected corresponding to the preset sample amount from the array subset according to the cumulative sum of the correlation coefficients;

obtaining a set of correlation coefficient maximum values and a set of correlation coefficient minimum values, wherein the set of correlation coefficient maximum values and the set of correlation coefficient minimum values are used for calculating the range, the set of correlation coefficient maximum values comprises at least one correlation coefficient maximum value, and the set of correlation coefficient minimum values comprises at least one correlation coefficient minimum value;

and if the correlation coefficient maximum value set and the correlation coefficient minimum value set have coincident parameters, selecting the optimal sample from the optimal samples to be selected.

acquiring a sample data subsequence from the sample set to be processed through a sliding window;

and if the length of the sample data subsequence is less than or equal to a preset threshold, smoothing each sample data to be processed in the sample data subsequence to obtain the preprocessed sample set.

It is clear to those skilled in the art that, for convenience and brevity of description, the specific working processes of the above-described systems, apparatuses and units may refer to the corresponding processes in the foregoing method embodiments, and are not described herein again.

In the several embodiments provided in the present application, it should be understood that the disclosed system, apparatus and method may be implemented in other manners. For example, the above-described apparatus embodiments are merely illustrative, and for example, the division of the units is only one logical division, and other divisions may be realized in practice, for example, a plurality of units or components may be combined or integrated into another system, or some features may be omitted, or not executed. In addition, the shown or discussed mutual coupling or direct coupling or communication connection may be an indirect coupling or communication connection through some interfaces, devices or units, and may be in an electrical, mechanical or other form.

The units described as separate parts may or may not be physically separate, and parts displayed as units may or may not be physical units, may be located in one place, or may be distributed on a plurality of network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of the embodiment.

In addition, functional units in the embodiments of the present invention may be integrated into one processing unit, or each unit may exist alone physically, or two or more units are integrated into one unit. The integrated unit can be realized in a form of hardware, and can also be realized in a form of a software functional unit.

The integrated unit, if implemented in the form of a software functional unit and sold or used as a stand-alone product, may be stored in a computer readable storage medium. Based on such understanding, the technical solution of the present invention may be embodied in the form of a software product, which is stored in a storage medium and includes instructions for causing a computer device (which may be a personal computer, a server, or a network device) to execute all or part of the steps of the method according to the embodiments of the present invention. And the aforementioned storage medium includes: a U-disk, a removable hard disk, a Read-Only Memory (ROM), a Random Access Memory (RAM), a magnetic disk or an optical disk, and other various media capable of storing program codes.

The above-mentioned embodiments are only used for illustrating the technical solutions of the present invention, and not for limiting the same; although the present invention has been described in detail with reference to the foregoing embodiments, it will be understood by those of ordinary skill in the art that: the technical solutions described in the foregoing embodiments may still be modified, or some technical features may be equivalently replaced; and such modifications or substitutions do not depart from the spirit and scope of the corresponding technical solutions of the embodiments of the present invention.

Claims

1. A method for acquiring alarm information is characterized by comprising the following steps:

determining service data to be alarmed from the service data according to a preset monitoring rule, wherein the preset monitoring rule is obtained according to learning of an optimal sample and a custom experience sample, the optimal sample is a sample determined according to a preset sample amount, sequence trends of each sample in the optimal sample are kept consistent and represent the overall level of a current monitoring point, and the custom experience sample is a sample which is selected and designated in advance according to experience participation;

2. The method according to claim 1, wherein before determining the service data to be alarmed from the service data according to the preset monitoring rule, the method further comprises:

3. The method according to claim 2, wherein said calculating a differential sequence of fluctuation rates for each of said sample data in said set of samples comprises:

the VolatySeq_k(i +1) represents the calculation result of the fluctuation rate sequence with the sampling point identification of i + 1;

the M is₀The interval of fluctuation rate adopted is represented as M₀；

Said t represents said M₀+ i of said sample point identifications;

4. The method according to claim 2, wherein the selecting the optimal sample corresponding to the preset sample size from the sample set to be selected comprises:

5. The method according to claim 4, wherein said calculating the cumulative sum and range of correlation coefficients corresponding to the subset of arrays comprises:

summr(j)＝SUM(R_u)；

R_u＝{r₁,r₂,…,r_P}；

the P represents the number of calculations;

the A represents the preset sample size;

calculating the range of the array subset as follows:

mmr(j)＝MAX(R_u)-MIN(R_u)；

the MAX (R)_u) Represents the maximum value of the correlation coefficient;

the MIN (R)_u) Representing the minimum value of the correlation coefficient.

6. The method according to claim 4 or 5, wherein the selecting the optimal sample corresponding to the preset sample size from the at least one array subset according to the correlation coefficient cumulative sum and the range corresponding to each array subset comprises:

7. The method according to claim 1 or 2, wherein before determining the service data to be alarmed from the service data according to the preset monitoring rule, the method further comprises:

8. The method of claim 2, wherein prior to obtaining the set of samples, the method further comprises:

9. The method according to claim 8, wherein after stopping acquiring the sample data to be processed and generating the set of samples to be processed, the method further comprises:

10. The method according to claim 9, wherein after the target sample data to be processed is obtained by using a moving average method, the method further comprises:

11. A server, comprising:

the first confirming module is used for determining the service data to be alarmed from the service data acquired by the first acquiring module according to a preset monitoring rule, wherein the preset monitoring rule is obtained by learning according to an optimal sample and a user-defined experience sample, the optimal sample is a sample determined according to a preset sample amount, the sequence trends of each sample in the optimal sample are kept consistent and represent the overall level of a current monitoring point, and the user-defined experience sample is a sample which is selected and designated in advance according to experience participation;

12. The server according to claim 11, further comprising:

the second obtaining module is used for obtaining a sample set before the first confirming module determines the service data to be alarmed from the service data according to a preset monitoring rule, wherein the sample set comprises a plurality of sample data, and each sample data is preprocessed data;

a second determining module, configured to determine a training sample size and the preset sample size according to the total amount of the sample data in the sample set acquired by the second acquiring module;

the calculating module is used for calculating the fluctuation rate difference sequence of each sample data in the sample set acquired by the second acquiring module;

a first selecting module, configured to select, according to the fluctuation rate difference sequence of each sample data in the sample set calculated by the calculating module, a to-be-selected sample set corresponding to the training sample size from the sample set;

and the second selection module is used for selecting the optimal sample corresponding to the preset sample size from the sample set to be selected by the first selection module.

13. A server, comprising: a memory, a transceiver, a processor, and a bus system;

wherein the memory is used for storing programs;

the processor is used for executing the program in the memory and realizing the following steps:

14. The server according to claim 13, wherein the processor is further configured to perform the steps of:

15. A computer-readable storage medium, characterized in that the storage medium has stored therein a computer program for executing the method of alarm information acquisition of any one of claims 1-10.