CN110287241A - A method and device for generating an alarm data report - Google Patents

Abstract

Embodiments of the present invention provide a method and device for generating an alarm data report, which relate to the technical field of financial technology. The method includes: using alarm data to construct a data frame, and for each alarm analysis task, extracting the alarm analysis task corresponding to each alarm analysis task from the data frame. Then perform statistical analysis on the local data blocks to determine the result data blocks of the alarm analysis task. The result data blocks of each alarm analysis task are spliced to determine the alarm data report, so all the alarm data to be analyzed only generate one alarm data report, which includes the content of all alarm analysis tasks, which is convenient for report management and user query report. Secondly, the alarm data is processed in the form of a data frame, and the type data corresponding to the report is generated, which can improve the efficiency of generating the alarm data report. By performing row and column operations on the large data frame, the update of the alarm data report is realized, which makes the management and maintenance of the alarm data report more convenient.

Description

A method and device for generating an alarm data report

technical field

Embodiments of the present invention relate to the technical field of financial technology (Fintech), in particular to a method and device for generating an alarm data report.

Background technique

With the development of computer technology, more and more technologies are applied in the financial field, and the traditional financial industry is gradually transforming into Fintech. However, due to the security and real-time requirements of the financial industry, higher requirements are placed on technology. requirements. At present, when performing alarm analysis on the performance indicators of various machines in the financial system and the health status of service software, the collected raw data is processed and stored in the big data platform bazaar. Since there are many data source tables involved in the data mart of the big data platform, when using SQL (Structured Query Language, Structured Query Language) statements to extract data from different areas of the data mart, configure the data fetching method for different areas of the report. The sql statement is particularly complicated and inconvenient for data query.

Contents of the invention

Since there are many data source tables involved in the big data mart, query statements need to extract data from different areas, resulting in complex query statements and inconvenient data query problems. Embodiments of the present invention provide a method and device for generating alarm data reports .

On the one hand, an embodiment of the present invention provides a method for generating an alarm data report, including:

Obtain the alarm data to be analyzed and use the alarm data to construct a data frame;

For each alarm analysis task, extract a local data block corresponding to the alarm analysis task from the data frame;

Perform statistical analysis on the local data block corresponding to the alarm analysis task, and determine the result data block of the alarm analysis task;

The result data blocks corresponding to each alarm analysis task are spliced to determine the alarm data report.

Optionally, splicing the result data blocks corresponding to each alarm analysis task to determine the alarm data report includes:

Add the result data block corresponding to each alarm analysis task to the corresponding data frame group;

Splice all the result data blocks in each data frame group to determine the result data frame corresponding to each alarm analysis task;

The result data frames corresponding to each alarm analysis task are spliced to determine the alarm data report.

Optionally, performing statistical analysis on the local data block corresponding to the alarm analysis task, and determining the result data block of the alarm analysis task includes:

grouping and counting the local data blocks corresponding to the alarm analysis task to obtain a plurality of statistical result blocks;

The plurality of statistical result blocks are analyzed and sorted, and a result data block of the alarm analysis task is generated according to the top N analysis results, where N is a preset integer.

Optionally, the data frame is a two-dimensional data structure comprising rows and columns.

Optionally, for each alarm analysis task, before extracting the local data block corresponding to the alarm analysis task from the data frame corresponding to the alarm data, the method further includes:

Using a regular expression set to extract a data feature string from the mixed character string of the data frame, and using the data feature string to replace the mixed character string of the data frame;

Perform type conversion on the data frame and assign values to missing values of the data frame.

On the one hand, an embodiment of the present invention provides an apparatus for generating an alarm data report, including:

An acquisition module, configured to acquire alarm data to be analyzed and use the alarm data to construct a data frame;

An extraction module, configured to extract a local data block corresponding to the alarm analysis task from the data frame for each alarm analysis task;

An analysis module, configured to perform statistical analysis on the local data block corresponding to the alarm analysis task, and determine the result data block of the alarm analysis task;

The splicing module is used to splice the result data blocks corresponding to each alarm analysis task to determine the alarm data report.

Optionally, the splicing module is specifically used for:

Add the result data block corresponding to each alarm analysis task to the corresponding data frame group;

Splice all the result data blocks in each data frame group to determine the result data frame corresponding to each alarm analysis task;

The result data frames corresponding to each alarm analysis task are spliced to determine the alarm data report.

Optionally, the analysis module is specifically used for:

grouping and counting the local data blocks corresponding to the alarm analysis task to obtain a plurality of statistical result blocks;

The plurality of statistical result blocks are analyzed and sorted, and a result data block of the alarm analysis task is generated according to the top N analysis results, where N is a preset integer.

Optionally, the data frame is a two-dimensional data structure comprising rows and columns.

Optionally, a preprocessing module is also included;

The preprocessing module is specifically used for:

For each alarm analysis task, before extracting the local data block corresponding to the alarm analysis task from the data frame corresponding to the alarm data, the data feature string is extracted from the mixed character string of the data frame by using a set of regular expressions, And using the data feature string to replace the mixed character string of the data frame;

Perform type conversion on the data frame and assign values to missing values of the data frame.

On the one hand, an embodiment of the present invention provides a computer device, including a memory, a processor, and a computer program stored on the memory and operable on the processor. When the processor executes the program, the alarm data report form is generated. method steps.

On the one hand, an embodiment of the present invention provides a computer-readable storage medium, which stores a computer program that can be executed by a computer device. When the program is run on the computer device, the computer device executes the process of generating an alarm data report. method steps.

In the embodiment of the present invention, the alarm data to be analyzed is obtained and a data frame is constructed using the alarm data. For each alarm analysis task, the local data block corresponding to the alarm analysis task is extracted from the data frame, and then the local data block corresponding to the alarm analysis task is statistically analyzed to determine the result data block of the alarm analysis task, and then each alarm The result data blocks corresponding to the analysis tasks are spliced to determine the alarm data report. Therefore, only one alarm data report is generated for all the alarm data to be analyzed, and the alarm data report includes the content of all alarm analysis tasks, which is convenient for report management and user query report. Secondly, the alarm data is processed in the form of a data frame, and the type data corresponding to the report is generated, which can improve the efficiency of generating the alarm data report.

Description of drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings that need to be used in the description of the embodiments will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present invention. For Those of ordinary skill in the art can also obtain other drawings based on these drawings without any creative effort.

FIG. 1 is a schematic diagram of an application scenario provided by an embodiment of the present invention;

FIG. 2 is a schematic flowchart of a method for generating an alarm data report provided by an embodiment of the present invention;

FIG. 3 is a schematic flowchart of a method for generating an alarm data report provided by an embodiment of the present invention;

FIG. 4 is a schematic structural diagram of a device for generating alarm data reports provided by an embodiment of the present invention;

FIG. 5 is a schematic structural diagram of a computer device provided by an embodiment of the present invention.

Detailed ways

In order to make the object, technical solution and beneficial effects of the present invention more clear, the present invention will be further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described here are only used to explain the present invention, not to limit the present invention.

For the convenience of understanding, the terms involved in the embodiments of the present invention are explained below.

Pandas: A Python data analysis package that provides the tools needed to efficiently manipulate large datasets.

Mysql: A relational database management system.

CMDB: Configuration Management Database, configuration management database.

The method for generating an alarm data report in the embodiment of the present invention can be applied to the application scenario shown in FIG. The big data synchronization system 101 collects alarm data from a data source and writes the alarm data into the source database 102. The data source may be a business system of a financial institution such as a bank. The report generating system 103 generates an alarm data report based on the alarm data in the source database. Specifically, the report generating system 103 loads the alarm data to be analyzed from the source database and uses the alarm data to construct a data frame. For each alarm analysis task, the local data block corresponding to the alarm analysis task is extracted from the data frame, and then the local data block corresponding to the alarm analysis task is statistically analyzed to determine the result data block of the alarm analysis task, and each alarm analysis task The corresponding result data blocks are spliced to determine the alarm data report. Afterwards, the alarm data report is saved in the report database 104 .

Based on the application scenario diagram shown in Figure 1, the embodiment of the present invention provides a flow of a method for generating an alarm data report, the flow of the method can be executed by a device for generating an alarm data report, and the device for generating an alarm data report can be as shown in FIG. The report generation system 103 shown in Figure 1, as shown in Figure 2, includes the following steps:

In step S201, the alarm data to be analyzed is obtained and a data frame is constructed using the alarm data.

Specifically, the big data synchronization system downloads the alarm data from the data source and saves the alarm data in the source database. In order to facilitate the analysis of alarm data, the alarm data in the source database can be updated according to the analysis period. For example, if the analysis period is one month, you can set the source database to be updated regularly every month; The source database is updated on a weekly basis. When the analysis period is one day, you can set the source database to be updated regularly every day.

The report generation system loads the alarm data to be analyzed from the source database. The data frame is a two-dimensional data structure including rows and columns. Operations can be performed on the rows and columns of the data frame, and the rows and columns of the data frame can also be expanded. In the specific implementation, use the pandas interface to load the alarm data to be analyzed from the source database into the memory, and then arrange the alarm data into a two-dimensional data structure in the form of rows and columns, thereby constructing a pandas data frame. Due to the large amount of loaded data, it is possible to filter the feature fields first, and only load the necessary fields for data analysis, reducing the scale of loaded data; secondly, the speed of loading alarm data can be accelerated through multi-process/multi-thread parallel loading technology; finally, loading The alarm data in the memory is compressed and stored, and the alarm data is constructed into a data frame using the pandas interface to reduce the time spent on loading data.

Step S202, for each alarm analysis task, extract a local data block corresponding to the alarm analysis task from the data frame.

Specifically, the alarm analysis task may be an analysis task for different fields, such as analyzing the loan field, analyzing the deposit field, analyzing the settlement field, and so on. Alarm analysis tasks can also be analysis tasks for different levels, such as analyzing alarm content, analyzing machines with frequent alarm content, analyzing the time when alarm content is frequently issued, and so on. Extract local data blocks column by column from the data frame, and the extracted local data blocks correspond to the same alarm analysis task. In a specific implementation, the local data blocks of each alarm analysis task may be configured in advance through parameterized configuration, and the local data blocks of each alarm analysis task may be different.

Step S203, perform statistical analysis on the local data block corresponding to the alarm analysis task, and determine the result data block of the alarm analysis task.

In a possible implementation, the local data blocks corresponding to the alarm analysis task are grouped and counted to obtain multiple statistical result blocks; the multiple statistical result blocks are analyzed and sorted, and the analysis results ranked in the top N A result data block of the alarm analysis task is generated, and N is a preset integer.

In the specific implementation, the pivot table can be used to group and count the local data blocks, and the cross table can be used to calculate the grouping frequency. A special kind of pivot table that can be replaced by a pivot table. The difference is that the cross table is dedicated to calculating the grouping frequency, while the pivot table is a function for grouping statistics, and the statistical type is specified by parameters.

After analyzing the statistical result block, the analysis result block can be generated, wherein the statistical result block corresponds to the new column, the analysis result block corresponds to the new column, and the columns used in the necessary grouping and the new column are spliced to obtain the result data block . When sorting, you can sort from high to low, or from low to high.

Exemplarily, the partial data blocks are grouped according to time, the partial data blocks of the same analysis period are grouped, and multiple grouped data blocks are obtained. Then count the number of occurrences of the same alarm content in each packet data block based on the alarm title field, and then add a new column to save the number of occurrences of each alarm content in each analysis cycle. The new columns corresponding to different analysis periods are spliced horizontally, and the increment and increase ratio of each alarm content are counted through the spliced columns. Then add a new column corresponding to the increment and a new column corresponding to the increase ratio and splice them horizontally, sort the increment values in the new column in the order of increment from high to low, and take the first N increments in the new column value. Sort the increase ratio values in the new column in order of increase ratio from high to low, take the first N digit increase ratio values in the new column, and then generate a result data block based on the new column and mark the type of the result data block.

It should be noted that when it is necessary to continue to perform statistical analysis on the analysis results of the top N bits, for example, in the case of knowing the number of alarm content, the increment of alarm content, and the increase ratio of alarm content, it is necessary to locate frequent alarms. When the machine, the date of frequent alarms, and the object of frequent alarms, new local data blocks can be extracted from the data frame based on the analysis results of the first N bits, and then the new local data blocks can be grouped, counted, analyzed and analyzed. Sorting, taking the new analysis results ranked in the top M positions, and generating a new result data block. The size of the new result data block is N*M, where N may or may not be equal to M.

Step S204, splicing the result data blocks corresponding to each alarm analysis task to determine the alarm data report.

The result data block corresponds to the text, table, graph and other object types in the data report, and each result data block corresponds to a unique identifier. After splicing the result data blocks corresponding to each alarm analysis task, a large data frame can be obtained. Access the CMDB configuration system through the http(s) interface, and update the data items in the big data frame. Use the pandas interface to convert large data frames into alarm data reports, and write the alarm data reports into the report database. The big data frame can be updated by performing row and column operations on the big data frame. When an alarm analysis task is added, different types of result data blocks are added to the big data frame, and column fields are added to the big data frame, thereby Change the storage structure of the large data frame.

In the embodiment of the present invention, the alarm data is used to construct the data frame, and then the local data blocks in the data frame are extracted for alarm analysis to obtain the result data blocks of the alarm analysis task, and then the result data blocks corresponding to each alarm analysis task are spliced , to determine the alarm data report, so all the alarm data to be analyzed only generate one alarm data report, which includes the content of all alarm analysis tasks, which is convenient for report management and user query report. Secondly, the alarm data is processed in the form of a data frame, and the type data corresponding to the report is generated, which can improve the efficiency of generating the alarm data report. By performing row and column operations on the large data frame, the update of the alarm data report is realized, which makes the management and maintenance of the alarm data report more convenient.

Optionally, in the above step S204, when generating the alarm data report, the embodiment of the present invention provides at least the following two implementation modes:

In a possible implementation manner, after marking the type of the result data block corresponding to each alarm analysis task, it is added to the global data frame group. Then splice all the result data blocks in the global data frame group to obtain a large data frame, and then convert the large data frame into an alarm data report.

In the specific implementation, all the result data blocks in the global data frame group are spliced vertically. Each result data block uses the type column field to identify the type. When the type column field is different, it will automatically expand horizontally and fill the missing values at the same time. large data frame. The number of rows of the obtained large data frame is the sum of the number of rows of all result data blocks, and the number of columns is the union of the columns of all result data blocks, that is, the same columns of the result data blocks are shared during splicing.

In a possible implementation, each alarm analysis task may correspond to a data frame group, and the data frame group is used to save the result data block of the alarm analysis task, so after generating the result data block corresponding to each alarm analysis task , the result data block corresponding to each alarm analysis task can be added to the corresponding data frame group; then all the result data blocks in each data frame group are spliced to determine the result data frame corresponding to each alarm analysis task; The result data frames corresponding to each alarm analysis task are spliced to determine the alarm data report.

In specific implementation, all the result data blocks in the data frame group are spliced vertically to obtain the result data frame. The process of vertical splicing is the same as that in the foregoing embodiments, and will not be repeated here. Then all the result data frames are spliced vertically to obtain a large data frame, and then the large data frame is converted into an alarm data report. By setting different data frame groups to save the result data blocks of different alarm analysis tasks, first splicing the result data blocks in the data frame group to obtain the result data frame, and then splicing the result data frames to obtain the alarm data report, thereby improving the generation of alarm data Reporting efficiency.

Optionally, before the above step S202, that is, before extracting the local data block corresponding to the alarm analysis task from the data frame corresponding to the alarm data, the data frame needs to be preprocessed. The preprocessing method includes: using a set of regular expressions from The data feature string is extracted from the mixed string of the data frame, and the mixed string of the data frame is replaced by the data feature string, and the type conversion of the data frame and the assignment of the missing value of the data frame are performed.

In the specific implementation, the method of pandas matrix calculation is used to perform data frame preprocessing. When executing a regular expression to extract data feature strings according to a keyword, due to the large amount of data, the time-consuming is about 0.8-1s. If more keywords are set, the sequential processing time will increase linearly. For example, 5 keywords will take about 4-5s. If the regular expressions corresponding to these five keywords are combined into one regular expression, the time-consuming is almost the same as executing a regular expression. Therefore, in the embodiment of the present invention, regular expressions with different keywords but similar extraction feature string patterns are combined to construct a regular expression set. Then, the regular expression set is used to extract the data characteristic string from the mixed character string of the data frame, and the data characteristic string is used to replace the mixed character string of the data frame, thereby improving the efficiency of feature string extraction and replacement. Perform datetime type or integer type conversion on specific columns through data frame column type conversion, perform missing value processing on data frames according to conditions through pandas interface, and assign values to data frame rows according to conditions. By preprocessing the data frame, the data frame can meet the requirements of sorting and statistics, which is convenient for subsequent alarm analysis based on the data frame.

In order to better explain the embodiment of the present invention, a method for generating an alarm data report provided by the embodiment of the present invention is described below in conjunction with specific implementation scenarios. The method is composed of a big data synchronization system, a source database, a report generation system, and a report database. Execution, as shown in Figure 3, the method includes the following steps:

The big data synchronization system collects alarm data from the data source and writes the alarm data into the source database. The data source can be the business system of a financial institution such as a bank. The alarm data in the source database is updated regularly. The report generation system includes a big data loading module, a preprocessing module, a report data generation module, a data frame update module, and a report storage module. The big data loading module uses the pandas interface to load the alarm data to be analyzed from the source database into the memory, and then uses the alarm data to construct a pandas data frame. The preprocessing module uses pandas matrix calculation to perform data frame preprocessing. Preprocessing includes data feature string extraction, data type conversion, and missing value processing. The report data generation module extracts the local data blocks corresponding to the alarm analysis task from the data frame, groups and counts the local data blocks corresponding to the alarm analysis task, and obtains multiple statistical result blocks. Multiple result data blocks are spliced horizontally, and multiple statistical result blocks are analyzed to obtain analysis result blocks, the analysis results in each analysis result block are sorted, and the top N analysis results in each analysis result block are selected As a result, the result data block of the alarm analysis task is generated based on the alarm analysis task, the statistical result block, and the sorted analysis result block for value operation, and N is a preset integer. Add the type of the resulting data block to the global data frame group. Determine whether to continue to extract local data blocks, if so, perform the above steps of extracting data blocks, grouping, counting, analyzing, sorting, and generating result data blocks; otherwise, longitudinally splice the result data blocks in the global data frame group, each result The data block uses the type column field to identify the type. When the type column field is different, it will automatically expand horizontally, and at the same time fill in the missing values to form a large data frame. The data frame update module accesses the CMDB configuration system through the http(s) interface, and updates the data items in the large data frame. The report storage module uses the pandas write data interface to convert the large data frame into an alarm data report, and writes the alarm data report into the report database.

In the embodiment of the present invention, the alarm data is used to construct the data frame, and then the local data blocks in the data frame are extracted for alarm analysis to obtain the result data blocks of the alarm analysis task, and then the result data blocks of the same alarm analysis task are spliced to obtain the result Data frame, the result data frames of all alarm analysis tasks are spliced to obtain an alarm data report, so all the alarm data to be analyzed only generates an alarm data report, which includes the content of all alarm analysis tasks, which is convenient for report management and User query report. Secondly, the alarm data is processed in the form of a data frame, and the type data corresponding to the report is generated, which can improve the efficiency of generating the alarm data report. By performing row and column operations on the large data frame, the update of the alarm data report is realized, which makes the management and maintenance of the alarm data report more convenient.

Based on the same technical concept, an embodiment of the present invention provides a schematic structural diagram of a device for generating an alarm data report, as shown in FIG. 4 , the device 400 includes:

An acquisition module 401, configured to acquire alarm data to be analyzed and use the alarm data to construct a data frame;

The extraction module 402 is configured to, for each alarm analysis task, extract a local data block corresponding to the alarm analysis task from the data frame;

The analysis module 403 is configured to perform statistical analysis on the local data block corresponding to the alarm analysis task, and determine the result data block of the alarm analysis task;

The splicing module 404 is configured to splice the result data blocks corresponding to each alarm analysis task to determine an alarm data report.

Optionally, the splicing module 404 is specifically used for:

Add the result data block corresponding to each alarm analysis task to the corresponding data frame group;

Splice all the result data blocks in each data frame group to determine the result data frame corresponding to each alarm analysis task;

The result data frames corresponding to each alarm analysis task are spliced to determine the alarm data report.

Optionally, the analysis module 403 is specifically configured to:

grouping and counting the local data blocks corresponding to the alarm analysis task to obtain a plurality of statistical result blocks;

The plurality of statistical result blocks are analyzed and sorted, and a result data block of the alarm analysis task is generated according to the top N analysis results, where N is a preset integer.

Optionally, the data frame is a two-dimensional data structure comprising rows and columns.

Optionally, a preprocessing module 405 is also included;

The preprocessing module 405 is specifically used for:

For each alarm analysis task, before extracting the local data block corresponding to the alarm analysis task from the data frame corresponding to the alarm data, the data feature string is extracted from the mixed character string of the data frame by using a set of regular expressions, And using the data feature string to replace the mixed character string of the data frame;

Perform type conversion on the data frame and assign values to missing values of the data frame.

Based on the same technical concept, an embodiment of the present invention provides a computer device, as shown in FIG. 5 , including at least one processor 501, and a memory 502 connected to at least one processor. The processor is not limited in the embodiment of the present invention. As for the specific connection medium between 501 and memory 502, the bus connection between processor 501 and memory 502 in FIG. 5 is taken as an example. The bus can be divided into address bus, data bus, control bus and so on.

In the embodiment of the present invention, the memory 502 stores instructions executable by at least one processor 501, and at least one processor 501 executes the instructions stored in the memory 502 to perform the steps included in the aforementioned method for generating an alarm data report .

Among them, the processor 501 is the control center of the computer equipment, which can use various interfaces and lines to connect various parts of the computer equipment, and generate alarms by running or executing instructions stored in the memory 502 and calling data stored in the memory 502 data report. Optionally, the processor 501 may include one or more processing units, and the processor 501 may integrate an application processor and a modem processor. The tuner processor mainly handles wireless communication. It can be understood that the foregoing modem processor may not be integrated into the processor 501 . In some embodiments, the processor 501 and the memory 502 can be implemented on the same chip, and in some embodiments, they can also be implemented on independent chips.

The processor 501 may be a general processor, such as a central processing unit (CPU), a digital signal processor, an application specific integrated circuit (Application Specific Integrated Circuit, ASIC), a field programmable gate array or other programmable logic devices, discrete gates or transistors Logic devices and discrete hardware components can implement or execute the methods, steps and logic block diagrams disclosed in the embodiments of the present invention. A general purpose processor may be a microprocessor or any conventional processor or the like. The steps of the methods disclosed in connection with the embodiments of the present invention may be directly implemented by a hardware processor, or implemented by a combination of hardware and software modules in the processor.

The memory 502, as a non-volatile computer-readable storage medium, can be used to store non-volatile software programs, non-volatile computer-executable programs and modules. The memory 502 may include at least one type of storage medium, such as flash memory, hard disk, multimedia card, card-type memory, random access memory (Random Access Memory, RAM), static random access memory (Static Random Access Memory, SRAM), Programmable Read Only Memory (PROM), Read Only Memory (ROM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Magnetic Memory, Disk, discs and more. Memory 502 is, but is not limited to, any other medium that can be used to carry or store desired program code in the form of instructions or data structures and that can be accessed by a computer. The memory 502 in the embodiment of the present invention may also be a circuit or any other device capable of implementing a storage function, and is used for storing program instructions and/or data.

Based on the same technical concept, an embodiment of the present invention provides a computer-readable storage medium, which stores a computer program executable by a computer device, and when the program is run on the computer device, the computer device is executed to generate an alarm. The steps of the method of the data report.

Those skilled in the art should understand that the embodiments of the present invention may be provided as methods or computer program products. Accordingly, the present invention can take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein.

The present invention is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It should be understood that each procedure and/or block in the flowchart and/or block diagram, and a combination of procedures and/or blocks in the flowchart and/or block diagram can be realized by computer program instructions. These computer program instructions may be provided to a general purpose computer, special purpose computer, embedded processor, or processor of other programmable data processing equipment to produce a machine such that the instructions executed by the processor of the computer or other programmable data processing equipment produce a An apparatus for realizing the functions specified in one or more procedures of the flowchart and/or one or more blocks of the block diagram.

These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing apparatus to operate in a specific manner, such that the instructions stored in the computer-readable memory produce an article of manufacture comprising instruction means, the instructions The device realizes the function specified in one or more procedures of the flowchart and/or one or more blocks of the block diagram.

These computer program instructions can also be loaded onto a computer or other programmable data processing device, causing a series of operational steps to be performed on the computer or other programmable device to produce a computer-implemented process, thereby The instructions provide steps for implementing the functions specified in the flow chart or blocks of the flowchart and/or the block or blocks of the block diagrams.

While preferred embodiments of the invention have been described, additional changes and modifications to these embodiments can be made by those skilled in the art once the basic inventive concept is appreciated. Therefore, it is intended that the appended claims be construed to cover the preferred embodiment as well as all changes and modifications which fall within the scope of the invention.

Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and equivalent technologies thereof, the present invention also intends to include these modifications and variations.

Claims (10)

1. a kind of method for generating alarm data report characterized by comprising

It obtains alarm data to be analyzed and data frame is constructed using the alarm data；

For each alert analysis task, the corresponding local data's block of the alert analysis task is extracted from the data frame；

It is for statistical analysis to the corresponding local data's block of the alert analysis task, determine the result of the alert analysis task Data block；

The corresponding result data block of each alert analysis task is spliced, determines alarm data report.

2. the method as described in claim 1, which is characterized in that described by the corresponding result data block of each alert analysis task Spliced, determine alarm data report, comprising:

The corresponding result data block of each alert analysis task is added in corresponding data frame group；

All result data blocks in each data frame group are spliced, determine the corresponding number of results of each alert analysis task According to frame；

The corresponding result data frame of each alert analysis task is spliced, determines alarm data report.

3. the method as described in claim 1, which is characterized in that described to the corresponding local data's block of the alert analysis task It is for statistical analysis, determine the result data block of the alert analysis task, comprising:

The corresponding local data's block of the alert analysis task is grouped and is counted, multiple statistical result blocks are obtained；

The multiple statistical result block is analyzed and sorted, the alarm point is generated according to the analysis result for coming top N The result data block of analysis task, N are default integer.

4. the method as described in claim 1, which is characterized in that the data frame is the two dimensional data structure for including row and column.

5. the method as described in Claims 1-4 is any, which is characterized in that it is described to be directed to each alert analysis task, from described Before extracting the corresponding local data's block of the alert analysis task in the corresponding data frame of alarm data, further includes:

Data characteristics string is extracted from the mixed characters string of the data frame using regular expression set, and uses the data Feature string replaces the mixed characters string of the data frame；

Type conversion is carried out to the data frame and to the missing values assignment of the data frame.

6. a kind of device for generating alarm data report characterized by comprising

Module is obtained, for obtaining alarm data to be analyzed and constructing data frame using the alarm data；

It is corresponding to extract the alert analysis task for being directed to each alert analysis task from the data frame for abstraction module Local data's block；

Analysis module determines the alarm for for statistical analysis to the corresponding local data's block of the alert analysis task The result data block of analysis task；

Splicing module determines alarm data report for splicing the corresponding result data block of each alert analysis task.

7. device as claimed in claim 6, which is characterized in that the splicing module is specifically used for:

The corresponding result data block of each alert analysis task is added in corresponding data frame group；

All result data blocks in each data frame group are spliced, determine the corresponding number of results of each alert analysis task According to frame；

The corresponding result data frame of each alert analysis task is spliced, determines alarm data report.

8. device as claimed in claim 6, which is characterized in that the analysis module is specifically used for:

The corresponding local data's block of the alert analysis task is grouped and is counted, multiple statistical result blocks are obtained；

The multiple statistical result block is analyzed and sorted, and the alarm is generated according to the analysis result for coming top N The result data block of analysis task, N are default integer.

9. a kind of computer equipment including memory, processor and stores the meter that can be run on a memory and on a processor Calculation machine program, which is characterized in that the processor is realized described in Claims 1 to 5 any claim when executing described program The step of method.

10. a kind of computer readable storage medium, which is characterized in that it is stored with the computer journey that can be executed by computer equipment Sequence, when described program is run on a computing device, so that computer equipment perform claim requirement 1~5 is any described The step of method.