CN111367777A - Alarm processing method, device, equipment and computer readable storage medium - Google Patents
Alarm processing method, device, equipment and computer readable storage medium Download PDFInfo
- Publication number
- CN111367777A CN111367777A CN202010139744.7A CN202010139744A CN111367777A CN 111367777 A CN111367777 A CN 111367777A CN 202010139744 A CN202010139744 A CN 202010139744A CN 111367777 A CN111367777 A CN 111367777A
- Authority
- CN
- China
- Prior art keywords
- abnormal
- time
- alarm
- similarity
- alarms
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/30—Monitoring
- G06F11/34—Recording or statistical evaluation of computer activity, e.g. of down time, of input/output operation ; Recording or statistical evaluation of user activity, e.g. usability assessment
- G06F11/3447—Performance evaluation by modeling
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/30—Monitoring
- G06F11/32—Monitoring with visual or acoustical indication of the functioning of the machine
- G06F11/324—Display of status information
- G06F11/327—Alarm or error message display
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/30—Monitoring
- G06F11/34—Recording or statistical evaluation of computer activity, e.g. of down time, of input/output operation ; Recording or statistical evaluation of user activity, e.g. usability assessment
- G06F11/3452—Performance evaluation by statistical analysis
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/30—Monitoring
- G06F11/34—Recording or statistical evaluation of computer activity, e.g. of down time, of input/output operation ; Recording or statistical evaluation of user activity, e.g. usability assessment
- G06F11/3466—Performance evaluation by tracing or monitoring
- G06F11/3495—Performance evaluation by tracing or monitoring for systems
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- General Engineering & Computer Science (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- Quality & Reliability (AREA)
- Computer Hardware Design (AREA)
- Bioinformatics & Cheminformatics (AREA)
- Evolutionary Biology (AREA)
- Bioinformatics & Computational Biology (AREA)
- Life Sciences & Earth Sciences (AREA)
- Probability & Statistics with Applications (AREA)
- Debugging And Monitoring (AREA)
- Alarm Systems (AREA)
Abstract
The embodiment of the application provides a method, a device, equipment and a computer readable storage medium for alarm processing, wherein the method comprises the following steps: acquiring at least one time series data set; determining the identifier of each abnormal time sequence and the abnormal starting time of each abnormal time sequence in at least one time sequence data set according to at least one time sequence data set; determining the similarity between the abnormal time sequences according to the identification of each abnormal time sequence and the abnormal starting time; determining a cluster identifier of an alarm set according to the similarity between the abnormal time sequences; and displaying the alarms in the alarm set according to the cluster identifiers of the alarm set. The method realizes accurate positioning to the abnormal starting time and determines the similarity among a plurality of alarms, thereby effectively clustering the plurality of alarms and reducing the sending quantity of the alarms.
Description
Technical Field
The present application relates to the field of computer technologies, and in particular, to a method, an apparatus, a device, and a computer-readable storage medium for alarm processing.
Background
The internet company usually monitors thousands of service indexes, server indexes or flow indexes, so as to ensure the stability of the whole system; the service index, the server index or the flow index are displayed in a time series mode. In the prior art, 64 characteristics of a time sequence need to be calculated when some systems operate, and due to high calculation complexity, when 52 time sequences are calculated, the calculation time is up to 1478 seconds; however, in an actual service scenario, the number of pieces of a typical time sequence under one service line is greater than 100, and even greater than thousands. Many alarms are generated for the monitored abnormal time series every day, and how to reduce the sending amount of the alarms is a problem to be solved.
Disclosure of Invention
The present application provides a method, an apparatus, an electronic device, and a computer-readable storage medium for processing an alarm, which are used to solve the problem of how to reduce the sending amount of the alarm.
In a first aspect, the present application provides a method for processing an alarm, including:
acquiring at least one time series data set;
determining the identifier of each abnormal time sequence and the abnormal starting time of each abnormal time sequence in at least one time sequence data set according to at least one time sequence data set;
determining the similarity between the abnormal time sequences according to the identification of each abnormal time sequence and the abnormal starting time;
determining a cluster identifier of an alarm set according to the similarity between the abnormal time sequences;
and displaying the alarms in the alarm set according to the cluster identifiers of the alarm set.
Optionally, the type of time series comprises at least one of:
the utilization rate of a processor of the server, the utilization rate of a memory of the server and a service index;
the service index includes at least one of:
the number of online real-time requests, the number of online users, and the success rate of calling interfaces.
Optionally, determining, from the at least one time-series data set, an identifier of each abnormal time series in the at least one time-series data set and an abnormal start time of each abnormal time series, including:
and inputting the at least one time series data set into a time series abnormality detection model for abnormality detection, and determining the identifier of each abnormal time series in the at least one time series data set, the abnormality starting time of each abnormal time series and the abnormality ending time of each abnormal time series.
Optionally, determining a similarity between the abnormal time sequences according to the identifier of each abnormal time sequence and the abnormal starting time includes:
determining each abnormal time sequence to comprise a time sequence value according to the identification of each abnormal time sequence and the abnormal starting time;
determining a correlation coefficient between each abnormal time sequence according to the value of the time sequence;
and determining the similarity between the abnormal time sequences according to the correlation coefficient.
Optionally, determining a cluster identifier of the alarm set according to the similarity between the abnormal time sequences includes:
and according to the similarity between the abnormal time sequences, clustering the alarms corresponding to the abnormal time sequences with the similarity within a preset threshold range to obtain an alarm set, and determining the clustering identification of the alarm set.
Optionally, displaying the alarms in the alarm set according to the cluster identifier of the alarm set, including:
according to the clustering identification, determining the similarity sum corresponding to N alarms belonging to the alarm set respectively, wherein N is a positive integer;
and respectively sequencing the similarity sum corresponding to the N alarms, determining a sequencing result, and displaying the N alarms in the alarm set according to the sequencing result.
Optionally, determining, according to the cluster identifier, a sum of similarity corresponding to each of the N alarms belonging to the alarm set, includes:
and summing the similarity between the Mth alarm in the N alarms and the N-1 alarms except the Mth alarm to obtain the similarity sum corresponding to the Mth alarm, wherein M is a positive integer.
In a second aspect, the present application provides an apparatus for alarm processing, including:
the first processing module is used for acquiring at least one time sequence data set;
the second processing module is used for determining the identifier of each abnormal time sequence and the abnormal starting time of each abnormal time sequence in at least one time sequence data set according to at least one time sequence data set;
the third processing module is used for determining the similarity between the abnormal time sequences according to the identification of each abnormal time sequence and the abnormal starting time;
the fourth processing module is used for determining the cluster identifier of the alarm set according to the similarity between the abnormal time sequences;
and the fifth processing module is used for displaying the alarms in the alarm set according to the cluster identifiers of the alarm set.
Optionally, the type of time series comprises at least one of:
the utilization rate of a processor of the server, the utilization rate of a memory of the server and a service index;
the service index includes at least one of:
the number of online real-time requests, the number of online users, and the success rate of calling interfaces.
Optionally, the second processing module is specifically configured to input the at least one time-series data set into the time-series abnormality detection model for abnormality detection, and determine an identifier of each abnormal time series in the at least one time-series data set, an abnormality start time of each abnormal time series, and an abnormality end time of each abnormal time series.
Optionally, the third processing module is specifically configured to determine that each abnormal time sequence includes a time sequence value according to the identifier of each abnormal time sequence and the abnormal start time; determining a correlation coefficient between each abnormal time sequence according to the value of the time sequence; and determining the similarity between the abnormal time sequences according to the correlation coefficient.
Optionally, the fourth processing module is specifically configured to perform clustering processing on the alarms corresponding to the abnormal time sequences with the similarity within a preset threshold range according to the similarity between the abnormal time sequences to obtain an alarm set, and determine a cluster identifier of the alarm set.
Optionally, the fifth processing module is specifically configured to determine, according to the cluster identifier, a sum of similarities corresponding to N alarms belonging to the alarm set, where N is a positive integer; and respectively sequencing the similarity sum corresponding to the N alarms, determining a sequencing result, and displaying the N alarms in the alarm set according to the sequencing result.
Optionally, the fifth processing module is specifically configured to sum similarities between an mth alarm of the N alarms and N-1 alarms except for the mth alarm, to obtain a sum of similarities corresponding to the mth alarm, where M is a positive integer.
In a third aspect, the present application provides an electronic device, comprising: a processor, a memory, and a bus;
a bus for connecting the processor and the memory;
a memory for storing operating instructions;
and the processor is used for executing the alarm processing method of the first aspect of the application by calling the operation instruction.
In a fourth aspect, the present application provides a computer-readable storage medium storing a computer program for performing the method of alert processing of the first aspect of the present application.
The technical scheme provided by the embodiment of the application at least has the following beneficial effects:
acquiring at least one time series data set; determining the identifier of each abnormal time sequence and the abnormal starting time of each abnormal time sequence in at least one time sequence data set according to at least one time sequence data set; determining the similarity between the abnormal time sequences according to the identification of each abnormal time sequence and the abnormal starting time; determining a cluster identifier of an alarm set according to the similarity between the abnormal time sequences; and displaying the alarms in the alarm set according to the cluster identifiers of the alarm set. Therefore, the time sequence is detected, the abnormal starting time is accurately positioned, and the similarity among a plurality of alarms is determined, so that the plurality of alarms are effectively clustered, the sending amount of the alarms is reduced, and the communication cost is saved.
Drawings
In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings used in the description of the embodiments of the present application will be briefly described below.
Fig. 1 is a schematic flowchart of a method for processing an alarm according to an embodiment of the present application;
fig. 2 is a schematic diagram of a time sequence provided by an embodiment of the present application;
fig. 3 is a schematic flowchart of another alarm processing method according to an embodiment of the present application;
FIG. 4 is a schematic diagram of another time series provided by the embodiments of the present application;
FIG. 5 is a schematic diagram of another time series provided by an embodiment of the present application;
fig. 6 is a schematic structural diagram of an apparatus for processing an alarm according to an embodiment of the present application;
fig. 7 is a schematic structural diagram of an electronic device according to an embodiment of the present application.
Detailed Description
In order to make the objects, features and advantages of the present invention more apparent and understandable, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present application, and it is apparent that the described embodiments are only a part of the embodiments of the present application, and not all the embodiments of the present application. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present application.
Reference will now be made in detail to embodiments of the present application, examples of which are illustrated in the accompanying drawings, wherein like or similar reference numerals refer to the same or similar elements or elements having the same or similar function throughout. The embodiments described below with reference to the drawings are exemplary only for the purpose of explaining the present application and are not to be construed as limiting the present application.
As used herein, the singular forms "a", "an", "the" and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will be further understood that the terms "comprises" and/or "comprising," when used in this specification, specify the presence of stated features, integers, steps, operations, elements, and/or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and/or groups thereof. It will be understood that when an element is referred to as being "connected" or "coupled" to another element, it can be directly connected or coupled to the other element or intervening elements may also be present. Further, "connected" or "coupled" as used herein may include wirelessly connected or wirelessly coupled. As used herein, the term "and/or" includes all or any element and all combinations of one or more of the associated listed items.
Artificial Intelligence (AI) is a theory, method, technique and application system that uses a digital computer or a machine controlled by a digital computer to simulate, extend and expand human Intelligence, perceive the environment, acquire knowledge and use the knowledge to obtain the best results. In other words, artificial intelligence is a comprehensive technique of computer science that attempts to understand the essence of intelligence and produce a new intelligent machine that can react in a manner similar to human intelligence. Artificial intelligence is the research of the design principle and the realization method of various intelligent machines, so that the machines have the functions of perception, reasoning and decision making.
The artificial intelligence technology is a comprehensive subject and relates to the field of extensive technology, namely the technology of a hardware level and the technology of a software level. The artificial intelligence infrastructure generally includes technologies such as sensors, dedicated artificial intelligence chips, cloud computing, distributed storage, big data processing technologies, operation/interaction systems, mechatronics, and the like. The artificial intelligence software technology mainly comprises a computer vision technology, a voice processing technology, a natural language processing technology, machine learning or deep learning and the like.
Machine Learning (ML) is a multi-domain cross discipline, and relates to a plurality of disciplines such as probability theory, statistics, approximation theory, convex analysis, algorithm complexity theory and the like. The special research on how a computer simulates or realizes the learning behavior of human beings so as to acquire new knowledge or skills and reorganize the existing knowledge structure to continuously improve the performance of the computer. Machine learning is the core of artificial intelligence, is the fundamental approach for computers to have intelligence, and is applied to all fields of artificial intelligence. Machine learning and deep learning generally include techniques such as artificial neural networks, belief networks, reinforcement learning, transfer learning, inductive learning, and formal education learning.
For better understanding and description of the embodiments of the present application, some technical terms used in the embodiments of the present application will be briefly described below.
Time series: refers to a group of data point sequences arranged according to chronological order. Typically, the time intervals of a time series are constant (e.g., 1 second, 1 minute, 5 minutes, etc.). For example, each minute corresponds to a monitoring data point, in a time series of minutes.
Time-series outliers: the abnormal point of the time series refers to a point where values at certain time stamps in the time series deviate from the trend of the time series as a whole or are obviously inconsistent with the historical trend.
And (4) alarming: when the system fails, the system presents a sudden increase or sudden decrease condition on the corresponding time sequence, so that a notice needs to be sent to related personnel. When a plurality of abnormal points appear in the time series, for example, an abnormality of three minutes continuously or an abnormality of four points within five minutes, a notice needs to be sent to the responsible person, and the notice is called an alarm. Generally speaking, there are two important factors for an alarm, namely, the unique identification ID of the time series and the starting time of the exception.
Alarm convergence: alarm convergence refers to merging and sending related alarms after the alarms occur, so that the effects of reducing the alarms and the function of completing alarm merging are achieved.
Differential integration moving average autoregressive model ARIMA: ARIMA is also known as an integrated moving average autoregressive model (moving may also be referred to as sliding), one of the time series prediction analysis methods.
Timing prediction model fbProphet: the principle of fbProphet is to analyze various time series characteristics such as periodicity, trend, holiday effect and partial abnormal values. In the aspect of trend, the method supports the addition of change points and realizes piecewise linear fitting. In terms of period, Fourier series is used for establishing a period model, and in terms of holidays and emergencies, a user can specify holidays and N days before and after holidays in a table mode. fbProphet is an integrated solution for timing.
Three sigma model 3-sigma: and (3) an abnormal value detection algorithm commonly used in the machine learning characteristic engineering.
A support vector machine oneplasssvm: a Support Vector Machine (SVM), which is a two-class classification model based on supervision. The SVM classifies data by selecting a hyperplane in a high-dimensional space, the hyperplane is a classification plane, and a vector forming the hyperplane is a support vector. SVMs have been widely used in statistical analysis, regression analysis and machine learning. Unlike conventional SVMs, oneplasssvm is an unsupervised algorithm. It means that there is only one type of positive or negative data in the training set, and no other type. At this time, what is needed to learn the learns is the boundary, not the maximum interval maximum margin.
Exponentially weighted moving average model EWMA: the EWMA is a method of giving different weights to observed values, obtaining a moving average value according to the different weights, and determining a predicted value based on the final moving average value. EWMA is adopted because recent observations of observation period have a greater influence on the predicted value, which reflects more recent changes. The EWMA means that the weighting coefficient of each numerical value decreases exponentially along with time, and the numerical value weighting coefficient is larger closer to the current moment.
Polynomial model: the polynomial model is a mathematical model, and the local trend in general time series can be well approximated by low-order polynomials, and particularly in short-term prediction, the local trend can be well fitted by the polynomial model not exceeding the high order. Also, problems in most time series can be dealt with when such trend models are overlaid with seasonal, regressive, etc. component models. The polynomial model has a low order and a high order type.
One-pass clustering: the one-pass clustering algorithm is an unsupervised clustering algorithm and has the characteristics of high efficiency and simplicity. The clustering can be completed by traversing the data set once. The one-pass clustering algorithm has good identification on the data with the hypersphere distribution and poor identification on the convex data distribution. The characteristics of high efficiency and simplicity can be exerted under the condition of large-scale data, secondary clustering or combination of clustering and other algorithms.
KMeans: the K-means clustering algorithm (K-means clustering algorithm) is an iterative solution clustering analysis algorithm, and the steps are that K objects are randomly selected as initial clustering centers, then the distance between each object and each seed clustering center is calculated, and each object is allocated to the clustering center closest to the object. The cluster centers and the objects assigned to them represent a cluster. The cluster center of a cluster is recalculated for each sample assigned based on the objects existing in the cluster. This process will be repeated until some termination condition is met. The termination condition may be that no (or minimum number) objects are reassigned to different clusters, no (or minimum number) cluster centers are changed again, and the sum of squared errors is locally minimal.
Hierarchical clustering: hierarchical Clustering (Hierarchical Clustering) is one of the Clustering algorithms, and creates a Hierarchical nested cluster tree by calculating the similarity between data points of different classes. In a cluster tree, the original data points of different classes are the lowest level of the tree, and the top level of the tree is the root node of a cluster. The clustering tree is created by two methods of bottom-up combination and top-down division.
Pearson coefficient: pearson Correlation Coefficient (Pearson Correlation Coefficient) is used to measure whether two data sets are on a line, and is used to measure the linear relation between distance variables.
Euclidean distance: euclidean metric (also known as euclidean distance) is a commonly used definition of distance, referring to the true distance between two points in an m-dimensional space, or the natural length of a vector (i.e., the distance of the point from the origin). The euclidean distance in two and three dimensions is the actual distance between two points.
DTW: the distance measurement Dynamic Time Warping (DTW) of Time series is a method for measuring the similarity of two Time series with different lengths. The method is widely applied, and is mainly used in template matching, such as isolated word speech recognition (whether two speech segments represent the same word or not), gesture recognition, data mining, information retrieval and the like.
LB _ Keogh: and (3) solving upper and lower envelope lines of the query sequence, comparing the data sequence with the upper and lower envelope lines, if the data sequence is not in the range of the upper and lower envelope lines, solving the Euclidean distance between the point and the point on the corresponding envelope line, finally summing to obtain an error, and comparing the error with the previously obtained error, wherein the error in the whole data is the minimum and is the target sequence.
Segment aggregation approximation: a segment aggregation Approximation (PAA) generally divides a time sequence into a plurality of sub-sequences, each sub-sequence being represented by a mean value of an original sequence, and a value of the time of the original sequence being represented by a value of the sub-sequence.
The technical solution provided by the embodiment of the present application relates to machine learning of artificial intelligence, and the following detailed description is provided for the technical solution of the present application and how to solve the above technical problems with the technical solution of the present application. The following several specific embodiments may be combined with each other, and details of the same or similar concepts or processes may not be repeated in some embodiments. Embodiments of the present application will be described below with reference to the accompanying drawings.
Example one
An embodiment of the present application provides a method for processing an alarm, a flowchart of the method is shown in fig. 1, and the method includes:
s101, at least one time sequence data set is obtained.
Optionally, the time series data set comprises a plurality of time series.
Optionally, the type of time series comprises at least one of:
the utilization rate of a processor of the server, the utilization rate of a memory of the server and a service index;
the service index includes at least one of:
the number of online real-time requests, the number of online users, and the success rate of calling interfaces.
Alternatively, the service refers to a product line, such as an instant messaging software QQ product line, a QQ space product line, a wechat applet product line, a wechat public number product line, and the like. The product line may include a plurality of sub-services, which may report corresponding time sequences.
S102, according to at least one time sequence data set, the identification of each abnormal time sequence and the abnormal starting time of each abnormal time sequence in at least one time sequence data set are determined.
Optionally, the time series ID refers to the name of the time series, and the time series IDs are stored in a time series storage system, each ID corresponds to a time series, and each time series has a unique name.
Optionally, the alarm corresponding to the abnormal time series includes an identification ID of the abnormal time series and an abnormal start time of the abnormal time series.
S103, determining the similarity between the abnormal time sequences according to the identifications of the abnormal time sequences and the abnormal starting time.
Optionally, the similarity between the abnormal time sequences is used to characterize the similarity between the alarms corresponding to the abnormal time sequences.
Optionally, determining a similarity between the abnormal time sequences according to the identifier of each abnormal time sequence and the abnormal starting time includes:
determining each abnormal time sequence to comprise a time sequence value according to the identification of each abnormal time sequence and the abnormal starting time;
determining a correlation coefficient between each abnormal time sequence according to the value of the time sequence;
and determining the similarity between the abnormal time sequences according to the correlation coefficient.
Optionally, the abnormal time series includes a timestamp and a time series value corresponding to the timestamp, where the timestamp indicates a time point, for example, the timestamp is 2020-01-0100: 00:00, the time point indicated by 2020-01-0100: 00:00 is 0 minutes 0 seconds at 1 month 1 day 0 of 2020, 2020-01-0100: 00:00 is corresponding to a time series value of 200, the timestamp is 2020-01-0100: 01:00, the timestamp is 202, the timestamp is 2020-01-0100: 02:00, the time series value corresponding to 2020-01-0100: 02:00 is 203, and 200, 202, and 203 are time series values.
Optionally, as shown in fig. 2, two time sequences of the plurality of time sequences corresponding to the service 1 are abnormal time sequences, and the identification IDs of the two time sequences are a and c, respectively, that is, the identification IDs of the two abnormal time sequences are a and c, respectively; the abnormal time sequence with the identifier ID of a has four time stamps, wherein the time sequence value corresponding to the time stamp 2019-12-1000: 00:00 is 0, the time sequence value corresponding to the time stamp 2019-12-1000: 01:00 is 0, the time sequence value corresponding to the time stamp 2019-12-1000: 02:00 is 1, and the time sequence value corresponding to the time stamp 2019-12-1000: 03:00 is 1.
Optionally, the correlation coefficient is a Pearson coefficient.
And S104, determining the cluster identifier of the alarm set according to the similarity among the abnormal time sequences.
Optionally, a plurality of alarms simultaneously appear in a time period corresponding to the plurality of abnormal time sequences, the plurality of alarms are divided into different alarm sets according to the similarity between the plurality of alarms, and each alarm set is identified by one cluster identifier. For example, alarm 1, alarm 2, alarm 3, alarm 4, and alarm 5 appear in a certain time period, where the cluster identifier of the alarm set to which alarm 1, alarm 2, and alarm 3 belong is a, and the cluster identifier of the alarm set to which alarm 4 and alarm 5 belong is B.
And S105, displaying the alarms in the alarm set according to the cluster identifiers of the alarm set.
Optionally, the set of alarms identified by a cluster identifier includes one alarm or a plurality of alarms. When the alarm set identified by one cluster identifier comprises a plurality of alarms, sequencing the plurality of alarms, and sending and displaying the alarms which are sequenced in the front to a user.
In the embodiment of the application, at least one time sequence data set is obtained; determining the identifier of each abnormal time sequence and the abnormal starting time of each abnormal time sequence in at least one time sequence data set according to at least one time sequence data set; determining the similarity between the abnormal time sequences according to the identification of each abnormal time sequence and the abnormal starting time; determining a cluster identifier of an alarm set according to the similarity between the abnormal time sequences; and displaying the alarms in the alarm set according to the cluster identifiers of the alarm set. Therefore, the time sequence is detected, the abnormal starting time is accurately positioned, and the similarity among a plurality of alarms is determined, so that the plurality of alarms are effectively clustered, the sending amount of the alarms is reduced, and the communication cost is saved.
Optionally, determining, from the at least one time-series data set, an identifier of each abnormal time series in the at least one time-series data set and an abnormal start time of each abnormal time series, including:
and inputting the at least one time series data set into a time series abnormality detection model for abnormality detection, and determining the identifier of each abnormal time series in the at least one time series data set, the abnormality starting time of each abnormal time series and the abnormality ending time of each abnormal time series.
The time series anomaly detection model comprises at least one of a difference integration moving average autoregressive model ARIMA, a time sequence prediction model fbProphet, a three-sigma model 3-sigma, a class I support vector machine OneClassSVM, an exponential weighting moving average model EWMA and a polynomial model.
Optionally, by performing anomaly detection on various time sequences reported by the service, when a time period when the time sequence is abnormal is located, the time sequence is an abnormal time sequence. And detecting the time sequence through at least one of a difference integration moving average autoregressive model ARIMA, a time sequence prediction model fbProphet, a three-sigma model 3-sigma, a support vector machine OneClassSVM, an exponential weighting moving average model EWMA and a polynomial model, determining the abnormal starting time and the abnormal ending time of the time sequence, namely determining the abnormal starting time and the abnormal ending time of the abnormal time sequence, and obtaining the identifier of the abnormal time sequence.
Optionally, determining a cluster identifier of the alarm set according to the similarity between the abnormal time sequences includes:
and according to the similarity between the abnormal time sequences, clustering the alarms corresponding to the abnormal time sequences with the similarity within a preset threshold range to obtain an alarm set, and determining the clustering identification of the alarm set.
Optionally, the larger the absolute value of the similarity is, the stronger the correlation between the alarms is; the closer the similarity is to 1 or-1, the stronger the correlation among the alarms is; the closer the similarity is to 0, the weaker the correlation between the alarms. The range of the value of the similarity is in the interval [ -1, 1], wherein the range of the value of the similarity in the interval [0.8, 1] represents a very strong correlation between the alarms, the range of the value of the similarity in the interval [0.6, 0.8) represents a strong correlation between the alarms, the range of the value of the similarity in the interval [0.4, 0.6) represents a medium correlation between the alarms, the range of the value of the similarity in the interval [0.2, 0.4) represents a weak correlation between the alarms, and the range of the value of the similarity in the interval [0.0, 0.2) represents an irrelevance between the alarms. When the preset threshold range is [0.8, 1], carrying out clustering processing on a plurality of alarms with the similarity within [0.8, 1] to obtain an alarm set, and determining a clustering identifier of the alarm set, wherein the alarm set comprises a plurality of alarms with the similarity within [0.8, 1 ].
Optionally, displaying the alarms in the alarm set according to the cluster identifier of the alarm set, including:
according to the clustering identification, determining the similarity sum corresponding to N alarms belonging to the alarm set respectively, wherein N is a positive integer;
and respectively sequencing the similarity sum corresponding to the N alarms, determining a sequencing result, and displaying the N alarms in the alarm set according to the sequencing result.
Optionally, determining, according to the cluster identifier, a sum of similarity corresponding to each of the N alarms belonging to the alarm set, includes:
and summing the similarity between the Mth alarm in the N alarms and the N-1 alarms except the Mth alarm to obtain the similarity sum corresponding to the Mth alarm, wherein M is a positive integer.
Optionally, the alarm set identified by a cluster identifier ID includes N alarm alerts1,…,alertnRespectively summing the similarity between the ith alarm in the N alarms and the N-1 alarms except the ith alarm to obtain the similarity and sim corresponding to the ith alarmiWherein N, n and i are both positive integers. And selecting the alarm with the largest similarity from the N alarms as Top 1. And respectively calculating the similarity between the alarms except the similarity and the maximum alarm and the similarity and the maximum alarm, and sequencing the determined similarities from big to small to obtain the sequencing from Top2 to Top N, namely determining the sequencing result among N alarms alert 1, … and alert N in the alarm set identified by the cluster identifier ID. simiThe calculation formula (1) is as follows:
wherein, s (alert)i,alertj) Indicating an alertiAnd alertjThe similarity between i, j and n is positive integer. Will { simiI is more than or equal to 1 and less than or equal to nThe order arrangement, corresponding to {1 ≦ i ≦ n } can obtain a new set of order { i ≦ n ≦ i ≦ n }1,i2,…,in}. The alarms are arranged at the time of presentation,
placed in the first position Top1,
the second Top is placed at the position of the second Top2, …,
placed at the nth Top n.
Another method for processing an alarm is provided in the embodiment of the present application, a flowchart of the method is shown in fig. 3, and the method includes:
s201, a plurality of time sequences are obtained through a time sequence data reporting module.
Alternatively, the time series may represent the real-time condition of the server of the service, such as the utilization rate of the CPU of the processor, the utilization rate of the memory, and the like; the time series may also represent various indicators of the service, such as the number of online real-time requests, the number of online users, the success rate of invoking interfaces, and so on. Before the time series abnormity detection is carried out, a plurality of time series are acquired through a time series data reporting module.
S202, a time series abnormality detection module detects a plurality of time series.
Optionally, the time series anomaly detection model includes any one of a differential integration moving average autoregressive model ARIMA, a time series prediction model fbProphet, a three-sigma model 3-sigma, a support vector machine oneplasssvm, an exponential weighted moving average model EWMA, and a polynomial model. And detecting the plurality of time sequences through a time sequence abnormality detection module, and determining the identifier of each abnormal time sequence, the abnormality starting time of each abnormal time sequence and the abnormality ending time of each abnormal time sequence in the plurality of time sequences.
Optionally, as shown in fig. 4, two time sequences of the plurality of time sequences corresponding to the service 1 are abnormal time sequences, and the identification IDs of the two time sequences are a and c, respectively, that is, the identification IDs of the two abnormal time sequences are a and c, respectively; the abnormal starting time of the abnormal time sequence marked as a is 0 min 0 s at 10 h 12 month in 2019, and the abnormal ending time of the abnormal time sequence marked as a is 3 min 0 s at 10 h 12 month in 2019; the abnormality start time of the abnormality time series denoted by c is 1 minute 0 second at 10.10.12.2019, and the abnormality end time of the abnormality time series denoted by c is 5 minutes 0 second at 10.10.12.10.2019. One of the plurality of time series corresponding to the service 2 is an abnormal time series, and the identification ID of the time series is b, that is, the identification ID of the abnormal time series is b; the abnormality start time of the abnormality time series denoted by b is 0 minutes 0 seconds at 12 months, 10 days, 11 hours in 2019, and the abnormality end time of the abnormality time series denoted by b is 3 minutes 0 seconds at 10 months, 10 days, 11 hours in 2019. Three time series in the plurality of time series corresponding to the service 3 are abnormal time series, and the identification IDs of the three time series are d, e and f, respectively, that is, the identification IDs of the three abnormal time series are d, e and f, respectively; the abnormal starting time of the abnormal time sequence marked as d is 0 minute and 0 second at 12 months, 10 days and 12 hours in 2019, and the abnormal ending time of the abnormal time sequence marked as d is 13 minutes and 0 second at 12 months, 10 days and 12 hours in 2019; the abnormal starting time of the abnormal time sequence marked as e is 2 minutes and 0 seconds at 12 months, 10 days and 12 hours in 2019, and the abnormal ending time of the abnormal time sequence marked as e is 13 minutes and 0 seconds at 12 months, 10 days and 12 hours in 2019; the abnormal time series denoted by f has an abnormal start time of 1 minute 0 second at 12.12.12.12.2019, and an abnormal end time of 13 minutes 0 second at 12.12.10.12.2019.
S203, generating a plurality of alarms through the alarm generating module.
Optionally, after detecting the abnormal time sequence, when the abnormal time sequence has an abnormality for 3 minutes or 5 minutes continuously, the alarm generating module generates an alarm, which is not sent at this moment. The alarm includes an identification ID of the abnormal time series and an abnormal start time of the abnormal time series.
S204, determining the similarity among a plurality of alarms through an alarm convergence algorithm module.
Optionally, the alarm convergence algorithm module includes a similarity algorithm module of a time series and a one-pass clustering algorithm module.
Optionally, the similarity algorithm module of the time series determines a similarity between the abnormal time series according to the identifier of each abnormal time series and the abnormal starting time, and the similarity between the abnormal time series is used to represent the similarity between the alarms corresponding to each abnormal time series. The similarity between the abnormal time series is calculated based on Pearson coefficient, X ═ X (X) for two abnormal time series1,x2,…,xn) And Y ═ Y1,y2,...,yn) Calculating a Pearson coefficient r between the abnormal time series X and the abnormal time series Y according to the formula (2)xy. Wherein r isxyThe closer to 1, the more the abnormal time series X and the abnormal time series Y are positively correlated, which means that the more similar the abnormal time series X and the abnormal time series Y are; r isxyThe closer to-1, the inverse correlation of X with Y is indicated. Equation (2) is as follows:
wherein n is a positive integer.
Optionally, the abnormal time sequence is subjected to Piecewise Aggregation Approximation (PAA) to obtain a new sequence, and the new sequence is compared for similarity. For abnormal time series with length n ═ X (X)1,x2,…,xn) In other words, a new time series of length N may be used
To make an approximation of the difference between the measured values,
the calculation formula (3) is as follows:
wherein N and N are both positive integers.
Refers to a new time series of length N. The average value of the abnormal time series X in a period of time is used as a new time series
The value of (a). While its length N is reduced compared to the original time series. For abnormal time series with length n ═ Y (Y)1,y2,...,yn) Obtaining a new time series
Refers to a new time series of length N. By aligning new time series
And
a Pearson coefficient describing the similarity between the abnormal time series X and the abnormal time series Y is calculated.
Optionally, two alerts alert1＝(id1,begtime1) And alert2＝(id2,begtime2)，id1And id2Representing the identity of an abnormal time series, begtime1And begtime2An abnormality start time indicating an abnormality time series. By using a slave begime1And begtime2Begin to extract the time sequence of n minutes to get two alarms alert1And alert2The corresponding time series takes values. According to the value of the time sequence, the similarity between the two abnormal time sequences is obtained through Pearson coefficient or piecewise aggregation approximation, and the similarity between the two abnormal time sequences is used asFor two alarms alert1And alert2Similarity between them, in terms of s (alert)1,alert2) Indicating two alarms alert1And alert2Similarity between two alarms alert1And alert2The value range of the similarity between [ -1,1 [)]In the meantime.
Optionally, the one-pass clustering algorithm module determines the clustering identifier of the alarm set according to the similarity between the alarms corresponding to each abnormal time sequence. Each time a new element comes, its similarity to the representative elements of all current clusters can be calculated. If the cluster is similar to the current cluster, putting the new element into the current most similar cluster; if none are similar, the new element is classified, and the representative element is the new element. In alarm convergence, the element is an alarm. Comparing the new alarm with the alarms in the alarm cluster every time a new alarm comes, and putting the new alarm into the alarm cluster when the new alarm is similar to the alarms in the alarm cluster, wherein the alarm cluster is an alarm set; when the new alarm is not similar to the alarm in the alarm cluster, a new alarm set is formed by itself, and the new alarm is in the new alarm set. And acquiring the corresponding relation between the alarm and the cluster identifier ID through a one-pass clustering algorithm module, and combining a plurality of alarms belonging to the same cluster identifier into one alarm for sending when the alarm is sent.
S205, the alarms included in the alarm set are sorted through the alarm sorting module.
Optionally, each cluster set identified by a cluster identification ID comprises one alarm or a plurality of alarms. And the alarm sequencing module sequences the alarms contained in the cluster set identified by each cluster identification ID according to the alarm importance.
And S206, sending the alarm through the alarm sending module.
Optionally, after the user receives the alarm and enters the alarm, a plurality of alarms related to the alarm are sorted according to the alarm importance and displayed to the user; wherein the alarm is the most important alarm in all alarms, the alarm is ranked at the head according to the alarm importance, and a plurality of alarms related to the alarm are ranked behind the alarm.
In the embodiment of the application, the time sequence is detected, the abnormal starting time is accurately positioned, and the similarity among a plurality of alarms is determined, so that the plurality of alarms are effectively clustered, the sending amount of the alarms is reduced, and the communication cost is saved.
In order to better understand the method provided by the embodiment of the present application, the following further describes the scheme of the embodiment of the present application with reference to an example of a specific application scenario.
As shown in fig. 5, on the applet cloud monitoring assistant of the cloud service platform, the presented product form is that a plurality of alarms are combined into one alarm to be sent, after a user enters one alarm, the user can see a plurality of alarms related to the alarm, and the alarms are also sorted according to the importance of the alarms. The small program cloud monitoring assistant of the cloud service platform provides an abnormal detection function and an alarm sending function of a time sequence, and provides alarm convergence and alarm sequencing functions according to the service line, so that a user can conveniently check the alarm, and the sending amount of the alarm is effectively reduced.
Example two
Based on the same inventive concept, the embodiment of the present application further provides an apparatus for processing an alarm, a schematic structural diagram of the apparatus is shown in fig. 6, and the apparatus 60 for processing an alarm includes a first processing module 601, a second processing module 602, a third processing module 603, a fourth processing module 604, and a fifth processing module 605.
A first processing module 601, configured to obtain at least one time series data set;
a second processing module 602, configured to determine, according to the at least one time series data set, an identifier of each abnormal time series in the at least one time series data set and an abnormal start time of each abnormal time series;
a third processing module 603, configured to determine similarity between each abnormal time sequence according to the identifier of each abnormal time sequence and the abnormal start time;
a fourth processing module 604, configured to determine a cluster identifier of the alarm set according to a similarity between the abnormal time sequences;
the fifth processing module 605 is configured to display the alarms in the alarm set according to the cluster identifier of the alarm set.
Optionally, the type of time series comprises at least one of:
the utilization rate of a processor of the server, the utilization rate of a memory of the server and a service index;
the service index includes at least one of:
the number of online real-time requests, the number of online users, and the success rate of calling interfaces.
Optionally, the second processing module 602 is specifically configured to input the at least one time-series data set into the time-series abnormality detection model for abnormality detection, and determine an identifier of each abnormal time series in the at least one time-series data set, an abnormality start time of each abnormal time series, and an abnormality end time of each abnormal time series.
Optionally, the third processing module 603 is specifically configured to determine that each abnormal time sequence includes a time sequence value according to the identifier of each abnormal time sequence and the abnormal start time; determining a correlation coefficient between each abnormal time sequence according to the value of the time sequence; and determining the similarity between the abnormal time sequences according to the correlation coefficient.
Optionally, the fourth processing module 604 is specifically configured to perform clustering processing on the alarms corresponding to the abnormal time sequences with the similarity within a preset threshold range according to the similarity between the abnormal time sequences, to obtain an alarm set, and determine a cluster identifier of the alarm set.
Optionally, the fifth processing module 605 is specifically configured to determine, according to the cluster identifier, a sum of similarities corresponding to N alarms belonging to the alarm set, where N is a positive integer; and respectively sequencing the similarity sum corresponding to the N alarms, determining a sequencing result, and displaying the N alarms in the alarm set according to the sequencing result.
Optionally, the fifth processing module 605 is specifically configured to sum similarity between an mth alarm of the N alarms and N-1 alarms except for the mth alarm, to obtain a sum of similarity corresponding to the mth alarm, where M is a positive integer.
For the content that is not described in detail in the alarm processing device provided in the embodiment of the present application, reference may be made to the method for alarm processing provided in the first embodiment, and the beneficial effects that the alarm processing device provided in the embodiment of the present application can achieve are the same as the method for alarm processing provided in the first embodiment, and are not described herein again.
The application of the embodiment of the application has at least the following beneficial effects:
acquiring at least one time series data set; determining the identifier of each abnormal time sequence and the abnormal starting time of each abnormal time sequence in at least one time sequence data set according to at least one time sequence data set; determining the similarity between the abnormal time sequences according to the identification of each abnormal time sequence and the abnormal starting time; determining a cluster identifier of an alarm set according to the similarity between the abnormal time sequences; and displaying the alarms in the alarm set according to the cluster identifiers of the alarm set. Therefore, the time sequence is detected, the abnormal starting time is accurately positioned, and the similarity among a plurality of alarms is determined, so that the plurality of alarms are effectively clustered, the sending amount of the alarms is reduced, and the communication cost is saved.
EXAMPLE III
Based on the same inventive concept, an embodiment of the present application further provides an electronic device, a schematic structural diagram of the electronic device is shown in fig. 7, the electronic device 6000 includes at least one processor 6001, a memory 6002, and a bus 6003, and each of the at least one processor 6001 is electrically connected to the memory 6002; the memory 6002 is configured to store at least one computer-executable instruction that the processor 6001 is configured to execute in order to perform the steps of any of the methods of alert processing as provided in any one of the embodiments or any alternative implementations of this application.
Further, the processor 6001 may be an FPGA (Field-Programmable gate array) or other device with logic processing capability, such as an MCU (micro controller Unit) or a CPU (Central processing Unit).
The application of the embodiment of the application has at least the following beneficial effects:
acquiring at least one time series data set; determining the identifier of each abnormal time sequence and the abnormal starting time of each abnormal time sequence in at least one time sequence data set according to at least one time sequence data set; determining the similarity between the abnormal time sequences according to the identification of each abnormal time sequence and the abnormal starting time; determining a cluster identifier of an alarm set according to the similarity between the abnormal time sequences; and displaying the alarms in the alarm set according to the cluster identifiers of the alarm set. Therefore, the time sequence is detected, the abnormal starting time is accurately positioned, and the similarity among a plurality of alarms is determined, so that the plurality of alarms are effectively clustered, the sending amount of the alarms is reduced, and the communication cost is saved.
Example four
Based on the same inventive concept, the present application provides another computer-readable storage medium, which stores a computer program, and the computer program is used for implementing the steps of any one of the alert processing provided in any one of the embodiments or any one of the alternative embodiments of the present application when the computer program is executed by a processor.
The computer-readable storage medium provided by the embodiments of the present application includes, but is not limited to, any type of disk (including floppy disks, hard disks, optical disks, CD-ROMs, and magneto-optical disks), ROMs (Read-Only memories), RAMs (random access memories), EPROMs (Erasable Programmable Read-Only memories), EEPROMs (Electrically Erasable Programmable Read-Only memories), flash memories, magnetic cards, or optical cards. That is, a readable storage medium includes any medium that stores or transmits information in a form readable by a device (e.g., a computer).
The application of the embodiment of the application has at least the following beneficial effects:
acquiring at least one time series data set; determining the identifier of each abnormal time sequence and the abnormal starting time of each abnormal time sequence in at least one time sequence data set according to at least one time sequence data set; determining the similarity between the abnormal time sequences according to the identification of each abnormal time sequence and the abnormal starting time; determining a cluster identifier of an alarm set according to the similarity between the abnormal time sequences; and displaying the alarms in the alarm set according to the cluster identifiers of the alarm set. Therefore, the time sequence is detected, the abnormal starting time is accurately positioned, and the similarity among a plurality of alarms is determined, so that the plurality of alarms are effectively clustered, the sending amount of the alarms is reduced, and the communication cost is saved.
It will be understood by those within the art that each block of the block diagrams and/or flowchart illustrations, and combinations of blocks in the block diagrams and/or flowchart illustrations, can be implemented by computer program instructions. Those skilled in the art will appreciate that the computer program instructions may be implemented by a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, implement the aspects specified in the block or blocks of the block diagrams and/or flowchart illustrations disclosed herein.
Those of skill in the art will appreciate that the various operations, methods, steps in the processes, acts, or solutions discussed in this application can be interchanged, modified, combined, or eliminated. Further, other steps, measures, or schemes in various operations, methods, or flows that have been discussed in this application can be alternated, altered, rearranged, broken down, combined, or deleted. Further, steps, measures, schemes in the prior art having various operations, methods, procedures disclosed in the present application may also be alternated, modified, rearranged, decomposed, combined, or deleted.
The foregoing is only a partial embodiment of the present application, and it should be noted that, for those skilled in the art, several modifications and decorations can be made without departing from the principle of the present application, and these modifications and decorations should also be regarded as the protection scope of the present application.
Claims (10)
1. A method of alarm handling, comprising:
acquiring at least one time series data set;
determining the identification of each abnormal time sequence in the at least one time sequence data set and the abnormal starting time of each abnormal time sequence according to the at least one time sequence data set;
determining the similarity between the abnormal time sequences according to the identifications of the abnormal time sequences and the abnormal starting time;
determining the clustering identification of the alarm set according to the similarity among the abnormal time sequences;
and displaying the alarms in the alarm set according to the cluster identifiers of the alarm set.
2. The method of claim 1, wherein the type of the time series comprises at least one of:
the utilization rate of a processor of the server, the utilization rate of a memory of the server and a service index;
the service index includes at least one of:
the number of online real-time requests, the number of online users, and the success rate of calling interfaces.
3. The method of claim 1, wherein determining, from the at least one time series data set, an identification of each anomalous time series in the at least one time series data set and an anomaly start time for the each anomalous time series comprises:
inputting the at least one time series data set into a time series abnormity detection model for abnormity detection, and determining the identification of each abnormal time series in the at least one time series data set, the abnormity starting time of each abnormal time series and the abnormity ending time of each abnormal time series.
4. The method according to claim 1, wherein said determining similarity between said abnormal time series according to said identification of each abnormal time series and said abnormal start time comprises:
determining that each abnormal time sequence comprises a time sequence value according to the identifier of each abnormal time sequence and the abnormal starting time;
determining a correlation coefficient between the abnormal time sequences according to the time sequence value;
and determining the similarity among the abnormal time sequences according to the correlation coefficient.
5. The method according to claim 1, wherein the determining a cluster identifier of an alarm set according to the similarity between the abnormal time series comprises:
and according to the similarity between the abnormal time sequences, clustering the alarms corresponding to the abnormal time sequences with the similarity within a preset threshold range to obtain an alarm set, and determining the clustering identification of the alarm set.
6. The method according to claim 1, wherein said presenting the alarms in the alarm set according to the cluster identifiers of the alarm set comprises:
according to the clustering identification, determining the similarity sum corresponding to N alarms belonging to the alarm set respectively, wherein N is a positive integer;
and respectively sequencing the similarity sum corresponding to the N alarms, determining a sequencing result, and displaying the N alarms in the alarm set according to the sequencing result.
7. The method according to claim 6, wherein said determining, according to the cluster identifier, a sum of similarity corresponding to each of the N alarms belonging to the alarm set comprises:
and summing the similarity between the Mth alarm in the N alarms and the N-1 alarms except the Mth alarm to obtain the similarity sum corresponding to the Mth alarm, wherein M is a positive integer.
8. An apparatus for alarm handling, comprising:
the first processing module is used for acquiring at least one time sequence data set;
the second processing module is used for determining the identification of each abnormal time sequence in the at least one time sequence data set and the abnormal starting time of each abnormal time sequence according to the at least one time sequence data set;
the third processing module is used for determining the similarity between the abnormal time sequences according to the identifications of the abnormal time sequences and the abnormal starting time;
the fourth processing module is used for determining the cluster identifier of the alarm set according to the similarity among the abnormal time sequences;
and the fifth processing module is used for displaying the alarms in the alarm set according to the cluster identifiers of the alarm set.
9. An electronic device, comprising: a processor, a memory;
the memory for storing a computer program;
the processor for executing the method of alarm handling according to any of claims 1-7 by invoking the computer program.
10. A computer-readable storage medium, in which a computer program is stored which, when being executed by a processor, is adapted to carry out the method of alarm handling according to any one of claims 1-7.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202010139744.7A CN111367777B (en) | 2020-03-03 | 2020-03-03 | Alarm processing method, device, equipment and computer readable storage medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202010139744.7A CN111367777B (en) | 2020-03-03 | 2020-03-03 | Alarm processing method, device, equipment and computer readable storage medium |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN111367777A true CN111367777A (en) | 2020-07-03 |
| CN111367777B CN111367777B (en) | 2022-07-05 |
Family
ID=71206971
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202010139744.7A Active CN111367777B (en) | 2020-03-03 | 2020-03-03 | Alarm processing method, device, equipment and computer readable storage medium |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN111367777B (en) |
Cited By (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN112564988A (en) * | 2021-02-19 | 2021-03-26 | 腾讯科技（深圳）有限公司 | Alarm processing method and device and electronic equipment |
| CN112699113A (en) * | 2021-01-12 | 2021-04-23 | 上海交通大学 | Industrial manufacturing process operation monitoring system driven by time sequence data stream |
| CN113014575A (en) * | 2021-02-23 | 2021-06-22 | 清华大学 | Ore digging flow detection method and device based on time series tracking |
| CN113961425A (en) * | 2021-08-04 | 2022-01-21 | 云智慧（北京）科技有限公司 | Method, device and equipment for processing alarm message |
| CN116991684A (en) * | 2023-08-03 | 2023-11-03 | 北京优特捷信息技术有限公司 | Alarm information processing method, device, equipment and medium |
Citations (10)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101145969A (en) * | 2007-10-25 | 2008-03-19 | 中兴通讯股份有限公司 | A method and system for reducing quantity of alarms reported by network elements |
| US20110246865A1 (en) * | 2008-12-16 | 2011-10-06 | Huawei Technologies Co., Ltd. | Method, apparatus, and user equipment for checking false alarm |
| CN104123368A (en) * | 2014-07-24 | 2014-10-29 | 中国软件与技术服务股份有限公司 | Big data attribute significance and recognition degree early warning method and system based on clustering |
| US20140372813A1 (en) * | 2013-06-18 | 2014-12-18 | Samsung Sds Co., Ltd. | Method for verifying bad pattern in time series sensing data and apparatus thereof |
| CN105069115A (en) * | 2015-08-11 | 2015-11-18 | 浙江中控技术股份有限公司 | Alarming restraining method based on distributed clustering of historical alarming |
| KR101621019B1 (en) * | 2015-01-28 | 2016-05-13 | 한국인터넷진흥원 | Method for detecting attack suspected anomal event |
| CN106021063A (en) * | 2016-05-09 | 2016-10-12 | 北京蓝海讯通科技股份有限公司 | An event message aggregation method, application and system |
| CN107124298A (en) * | 2017-03-31 | 2017-09-01 | 北京奇艺世纪科技有限公司 | Alert aggregation method and system |
| CN108804574A (en) * | 2018-05-23 | 2018-11-13 | 东软集团股份有限公司 | Alarm prompt method, apparatus, computer readable storage medium and electronic equipment |
| CN110457178A (en) * | 2019-07-29 | 2019-11-15 | 江苏艾佳家居用品有限公司 | A kind of full link monitoring alarm method based on log collection analysis |
-
2020
- 2020-03-03 CN CN202010139744.7A patent/CN111367777B/en active Active
Patent Citations (10)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101145969A (en) * | 2007-10-25 | 2008-03-19 | 中兴通讯股份有限公司 | A method and system for reducing quantity of alarms reported by network elements |
| US20110246865A1 (en) * | 2008-12-16 | 2011-10-06 | Huawei Technologies Co., Ltd. | Method, apparatus, and user equipment for checking false alarm |
| US20140372813A1 (en) * | 2013-06-18 | 2014-12-18 | Samsung Sds Co., Ltd. | Method for verifying bad pattern in time series sensing data and apparatus thereof |
| CN104123368A (en) * | 2014-07-24 | 2014-10-29 | 中国软件与技术服务股份有限公司 | Big data attribute significance and recognition degree early warning method and system based on clustering |
| KR101621019B1 (en) * | 2015-01-28 | 2016-05-13 | 한국인터넷진흥원 | Method for detecting attack suspected anomal event |
| CN105069115A (en) * | 2015-08-11 | 2015-11-18 | 浙江中控技术股份有限公司 | Alarming restraining method based on distributed clustering of historical alarming |
| CN106021063A (en) * | 2016-05-09 | 2016-10-12 | 北京蓝海讯通科技股份有限公司 | An event message aggregation method, application and system |
| CN107124298A (en) * | 2017-03-31 | 2017-09-01 | 北京奇艺世纪科技有限公司 | Alert aggregation method and system |
| CN108804574A (en) * | 2018-05-23 | 2018-11-13 | 东软集团股份有限公司 | Alarm prompt method, apparatus, computer readable storage medium and electronic equipment |
| CN110457178A (en) * | 2019-07-29 | 2019-11-15 | 江苏艾佳家居用品有限公司 | A kind of full link monitoring alarm method based on log collection analysis |
Cited By (8)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN112699113A (en) * | 2021-01-12 | 2021-04-23 | 上海交通大学 | Industrial manufacturing process operation monitoring system driven by time sequence data stream |
| CN112564988A (en) * | 2021-02-19 | 2021-03-26 | 腾讯科技（深圳）有限公司 | Alarm processing method and device and electronic equipment |
| CN112564988B (en) * | 2021-02-19 | 2021-06-18 | 腾讯科技（深圳）有限公司 | Alarm processing method and device and electronic equipment |
| CN113014575A (en) * | 2021-02-23 | 2021-06-22 | 清华大学 | Ore digging flow detection method and device based on time series tracking |
| CN113961425A (en) * | 2021-08-04 | 2022-01-21 | 云智慧（北京）科技有限公司 | Method, device and equipment for processing alarm message |
| CN113961425B (en) * | 2021-08-04 | 2022-06-07 | 云智慧（北京）科技有限公司 | Method, device and equipment for processing alarm message |
| CN116991684A (en) * | 2023-08-03 | 2023-11-03 | 北京优特捷信息技术有限公司 | Alarm information processing method, device, equipment and medium |
| CN116991684B (en) * | 2023-08-03 | 2024-01-30 | 北京优特捷信息技术有限公司 | Alarm information processing method, device, equipment and medium |
Also Published As
| Publication number | Publication date |
|---|---|
| CN111367777B (en) | 2022-07-05 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN111367777B (en) | Alarm processing method, device, equipment and computer readable storage medium | |
| CN109218114B (en) | Decision tree-based server fault automatic detection system and detection method | |
| US8630962B2 (en) | Error detection method and its system for early detection of errors in a planar or facilities | |
| CN113496262B (en) | Data-driven active power distribution network abnormal state sensing method and system | |
| Lai et al. | A method for pattern mining in multiple alarm flood sequences | |
| CN108985380B (en) | Point switch fault identification method based on cluster integration | |
| CN111459700A (en) | Method and apparatus for diagnosing device failure, diagnostic device, and storage medium | |
| CN110247910A (en) | A kind of detection method of abnormal flow, system and associated component | |
| CN107301118A (en) | A kind of fault indices automatic marking method and system based on daily record | |
| CN113626607B (en) | Abnormal work order identification method and device, electronic equipment and readable storage medium | |
| CN113592019A (en) | Fault detection method, device, equipment and medium based on multi-model fusion | |
| CN111160329A (en) | Root cause analysis method and device | |
| CN111291096A (en) | Data set construction method and device, storage medium and abnormal index detection method | |
| CN110796159A (en) | Power data classification method and system based on k-means algorithm | |
| CN114386538A (en) | Method for marking wave band characteristics of KPI (Key performance indicator) curve of monitoring index | |
| CN113537337A (en) | Training method, abnormality detection method, apparatus, device, and storage medium | |
| CN114970643A (en) | High-speed electric spindle fault identification method based on UMAP dimension reduction algorithm | |
| CN115309575A (en) | Micro-service fault diagnosis method, device and equipment based on graph convolution neural network | |
| CN109635008B (en) | Equipment fault detection method based on machine learning | |
| CN117170915A (en) | Data center equipment fault prediction method and device and computer equipment | |
| CN110837953A (en) | Automatic abnormal entity positioning analysis method | |
| CN111239484A (en) | Non-invasive load electricity consumption information acquisition method for non-resident users | |
| CN116245212A (en) | PCA-LSTM-based power data anomaly detection and prediction method and system | |
| Qin | Software reliability prediction model based on PSO and SVM | |
| CN111221704B (en) | Method and system for determining running state of office management application system |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| REG | Reference to a national code |
Ref country code: HK Ref legal event code: DE Ref document number: 40025866 Country of ref document: HK |
|
| GR01 | Patent grant | ||
| GR01 | Patent grant |