CN112667479A - Information monitoring method and device - Google Patents
Information monitoring method and device Download PDFInfo
- Publication number
- CN112667479A CN112667479A CN202011613414.3A CN202011613414A CN112667479A CN 112667479 A CN112667479 A CN 112667479A CN 202011613414 A CN202011613414 A CN 202011613414A CN 112667479 A CN112667479 A CN 112667479A
- Authority
- CN
- China
- Prior art keywords
- dynamic threshold
- value
- numerical value
- algorithm
- values
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
- 238000012544 monitoring process Methods 0.000 title claims abstract description 62
- 238000000034 method Methods 0.000 title claims abstract description 57
- 238000004422 calculation algorithm Methods 0.000 claims abstract description 116
- 238000012545 processing Methods 0.000 claims abstract description 10
- 230000008713 feedback mechanism Effects 0.000 claims abstract description 9
- 238000004364 calculation method Methods 0.000 claims description 29
- 238000002372 labelling Methods 0.000 claims description 15
- 230000000694 effects Effects 0.000 abstract description 3
- 238000012937 correction Methods 0.000 abstract description 2
- 238000003860 storage Methods 0.000 description 16
- 238000012423 maintenance Methods 0.000 description 8
- 230000008569 process Effects 0.000 description 6
- 230000002159 abnormal effect Effects 0.000 description 5
- 230000008901 benefit Effects 0.000 description 5
- 238000013500 data storage Methods 0.000 description 4
- 238000004519 manufacturing process Methods 0.000 description 4
- 230000001960 triggered effect Effects 0.000 description 4
- 230000008878 coupling Effects 0.000 description 3
- 238000010168 coupling process Methods 0.000 description 3
- 238000005859 coupling reaction Methods 0.000 description 3
- 230000005611 electricity Effects 0.000 description 3
- 238000007726 management method Methods 0.000 description 3
- 238000004891 communication Methods 0.000 description 2
- 238000010586 diagram Methods 0.000 description 2
- 230000003287 optical effect Effects 0.000 description 2
- 230000010355 oscillation Effects 0.000 description 2
- 230000000737 periodic effect Effects 0.000 description 2
- 238000006467 substitution reaction Methods 0.000 description 2
- 230000009286 beneficial effect Effects 0.000 description 1
- 238000006243 chemical reaction Methods 0.000 description 1
- 230000006870 function Effects 0.000 description 1
- 230000010365 information processing Effects 0.000 description 1
- 238000005259 measurement Methods 0.000 description 1
- 230000007246 mechanism Effects 0.000 description 1
- 238000012821 model calculation Methods 0.000 description 1
- 238000004080 punching Methods 0.000 description 1
- 238000012795 verification Methods 0.000 description 1
Images
Landscapes
- Debugging And Monitoring (AREA)
Abstract
The invention discloses an information monitoring method and device. After the monitoring data is obtained, a dynamic threshold value is determined by combining a dynamic threshold value algorithm and information such as parameters, experience threshold values or time intervals and the like specified according to expert experience values, and an alarm is given by using the dynamic threshold value. The information such as parameters, experience thresholds or effective time windows and the like specified according to the expert experience values are obtained by summarizing and processing different experience values marked by a plurality of administrators or obtained from expert systems, and the values obtained after continuous correction through an information feedback mechanism are more objective and more accurate than the experience values marked by a single administrator or a single expert system, and can be continuously adjusted and optimized according to actual effects. The combination with the above information specified by expert experience values can greatly reduce the false alarm rate generated when the alarm is given by using the dynamic threshold value.
Description
Technical Field
The invention relates to the field of computer information processing, in particular to an information monitoring method and device.
Background
For large enterprises and cloud service providers, with the continuous expansion of services and the digital management of services, the scale of equipment needing to monitor operation and maintenance is increasingly huge.
The traditional monitoring operation and maintenance uses a threshold value marked by an experience value for monitoring, the monitoring granularity is generally coarse, the operation and maintenance effect often depends on the personal experience and management capability of operation and maintenance personnel, and the operation and maintenance requirements of large-scale equipment and the personalized maintenance of different applications or systems are difficult to deal with; and the dynamic threshold monitoring can realize personalized dynamic threshold monitoring alarm to a certain extent, but the dynamic threshold alarm based on a mathematical algorithm may have a certain false alarm rate.
For this reason, dynamic threshold monitoring combined with empirical value labeling is a new trend. However, when a plurality of system administrators manage a certain system together, due to different perspectives of the problems seen by different administrators, the respective experiences and factors to be considered may be different, and when the experience values are labeled, the set values may be different, which may cause the quality of the operation and maintenance of the system to fluctuate.
In addition, the operation and maintenance skills and experiences of different administrators are limited as individuals, and each individual also has expertise.
Therefore, how to exert the specialties and advantages of different administrators when dynamic threshold monitoring is combined with empirical value labeling and finally determine a better value by integrating different settings of a plurality of administrators still remains a technical problem to be solved.
Disclosure of Invention
In view of the above problems, embodiments of the present invention provide a method and an apparatus.
According to a first aspect of an embodiment of the present invention, an information monitoring method includes: acquiring monitoring data; acquiring a first numerical value for assisting in determining a dynamic threshold according to a dynamic threshold algorithm, wherein the first numerical value is a value obtained by performing centralized processing on a plurality of second numerical values with independent sources and continuously correcting the plurality of second numerical values through an information feedback mechanism; determining a dynamic threshold value according to a dynamic threshold value algorithm and a first numerical value; and judging whether the monitoring data is in the range limited by the dynamic threshold value, and if not, alarming.
According to an embodiment of the present invention, obtaining a first value according to a dynamic threshold algorithm includes: if the dynamic threshold algorithm is a first dynamic threshold algorithm, acquiring a parameter of the first dynamic threshold algorithm as a first numerical value; accordingly, determining the dynamic threshold based on the dynamic threshold algorithm and the first value includes: and calculating by using a first dynamic threshold algorithm and the first numerical value to obtain the dynamic threshold.
According to an embodiment of the present invention, obtaining a first value according to a dynamic threshold algorithm includes: if the dynamic threshold algorithm is the second dynamic threshold algorithm, acquiring a first dynamic threshold as a first numerical value; accordingly, determining a first dynamic threshold value based on the dynamic threshold algorithm and the first value includes: calculating according to a second dynamic threshold algorithm to obtain a second dynamic threshold; a dynamic threshold is determined based on the first value and the second dynamic threshold.
According to an embodiment of the present invention, obtaining a first value according to a dynamic threshold algorithm includes: if the dynamic threshold algorithm comprises a third dynamic threshold algorithm and a fourth dynamic threshold algorithm, acquiring a time window value as a first numerical value; accordingly, determining a first dynamic threshold value based on the dynamic threshold algorithm and the first value includes: calculating according to a third dynamic threshold algorithm to obtain a third dynamic threshold; calculating according to a fourth dynamic threshold algorithm to obtain a fourth dynamic threshold; and if the time windows of the third dynamic threshold and the fourth dynamic threshold are less than or equal to the first value, determining the third dynamic threshold and the fourth dynamic threshold as effective dynamic thresholds.
According to an embodiment of the present invention, before obtaining the first value for assisting in determining the dynamic threshold according to the dynamic threshold algorithm, the method further includes: obtaining a plurality of second values having independent sources; a plurality of second values having independent origins are calculated to obtain a first value.
According to an embodiment of the present invention, calculating a plurality of second values having independent sources to obtain a first value includes: obtaining a weight value of each second numerical value source, wherein the second numerical value sources are independent sources of the second numerical values; and according to the weight value of each second numerical value source, carrying out weighted calculation on a plurality of second numerical values with independent sources to obtain a first numerical value.
According to an embodiment of the present invention, before obtaining the weight value of each second value source, the method further includes: acquiring the labeling quality of each second numerical value source; and determining the weight value of the corresponding second numerical value source according to the labeling quality.
According to an embodiment of the present invention, before obtaining the plurality of second values having independent sources, the method further includes: and providing the first numerical value and the historical record of the actual result corresponding to the first numerical value to each second numerical value source so that each second numerical value source can revise the second numerical value independently.
According to an embodiment of the present invention, before obtaining the first value for assisting in determining the dynamic threshold according to the dynamic threshold algorithm, the method further includes: and judging whether the first numerical value exists or not, if not, further judging whether a second numerical value exists or not, if so, performing subsequent operation by taking the second numerical value as the first numerical value to obtain a first alarm result, and sending the first alarm result to a second numerical value source corresponding to the second numerical value.
According to a second aspect of the embodiments of the present invention, an information monitoring apparatus includes: the monitoring data acquisition module is used for acquiring monitoring data; the first numerical value acquisition module is used for acquiring a first numerical value for assisting in determining the dynamic threshold value according to a dynamic threshold value algorithm, wherein the first numerical value is a value obtained by performing centralized processing on a plurality of second numerical values with independent sources and continuously correcting the plurality of second numerical values through an information feedback mechanism; the dynamic threshold value determining module is used for determining a dynamic threshold value according to a dynamic threshold value algorithm and a first numerical value; and the alarm module is used for judging whether the monitoring data is in the range limited by the dynamic threshold value, and if not, alarming.
According to a third aspect of embodiments of the present invention, there is provided a computer-readable storage medium, wherein the storage medium includes a set of computer-executable instructions, and when the instructions are executed, the storage medium is configured to perform any one of the information monitoring methods described above.
The embodiment of the invention provides an information monitoring method and device and a computer readable storage medium, and discloses an information monitoring method and device. After the monitoring data is obtained, a dynamic threshold value is determined by combining a dynamic threshold value algorithm and information such as parameters, experience threshold values or time intervals and the like specified according to expert experience values, and an alarm is given by using the dynamic threshold value. The information such as parameters, experience thresholds or effective time windows and the like specified according to the expert experience values are obtained by summarizing and processing different experience values marked by a plurality of administrators or obtained from expert systems, and the values obtained after continuous correction through an information feedback mechanism are more objective and more accurate than the experience values marked by a single administrator or a single expert system, and can be continuously adjusted and optimized according to actual effects. The combination with the above information specified by expert experience values can greatly reduce the false alarm rate generated when the alarm is given by using the dynamic threshold value.
It is to be understood that the teachings of the present invention need not achieve all of the above-described benefits, but rather that specific embodiments may achieve specific technical results, and that other embodiments of the present invention may achieve benefits not mentioned above.
Drawings
The above and other objects, features and advantages of exemplary embodiments of the present invention will become readily apparent from the following detailed description read in conjunction with the accompanying drawings. Several embodiments of the invention are illustrated by way of example, and not by way of limitation, in the figures of the accompanying drawings and in which:
in the drawings, the same or corresponding reference numerals indicate the same or corresponding parts.
FIG. 1 is a schematic view of an application scenario of an information monitoring method according to an embodiment of the present invention;
FIG. 2 is a schematic diagram of a flow chart of an implementation of an information monitoring method according to an embodiment of the present invention;
FIG. 3 is a flowchart illustrating an embodiment of a method for information monitoring according to the present invention, wherein the method is implemented by performing a weighted calculation based on a second value to obtain a first value;
fig. 4 is a schematic structural diagram of an information monitoring apparatus according to an embodiment of the present invention.
Detailed Description
In order to make the objects, features and advantages of the present invention more obvious and understandable, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention, and it is apparent that the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present invention.
In the description herein, references to the description of the term "one embodiment," "some embodiments," "an example," "a specific example," or "some examples," etc., mean that a particular feature, structure, material, or characteristic described in connection with the embodiment or example is included in at least one embodiment or example of the invention. Furthermore, the particular features, structures, materials, or characteristics described may be combined in any suitable manner in any one or more embodiments or examples. Furthermore, various embodiments or examples and features of different embodiments or examples described in this specification can be combined and combined by one skilled in the art without contradiction.
Furthermore, the terms "first", "second" and "first" are used for descriptive purposes only and are not to be construed as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one such feature. In the description of the present invention, "a plurality" means two or more unless specifically defined otherwise.
Fig. 1 shows an application scenario of the information monitoring method according to the embodiment of the present invention. In the information monitoring system shown in fig. 1, three major parts are mainly included: a dynamic threshold generation section, a write adapter section, and an external system section. The dynamic threshold generation part is mainly combined with a dynamic threshold calculation method and information (such as parameter values marked by empirical values, empirical thresholds, effective window time and the like) stored in a parameter database to generate dynamic thresholds at regular time; and after receiving the monitoring data, comparing the monitoring data with the generated dynamic threshold, if the monitoring data exceeds the range and the condition defined by the dynamic threshold, writing the monitoring data into the adapter, and then sending the monitoring data to an external system through the adapter to alarm.
As shown in fig. 1, the dynamic threshold calculation process started at regular time is different according to the selected algorithm, and corresponding dynamic threshold calculation is performed, for example:
1) in some dynamic threshold algorithms for amplitude, fluctuation degree and periodic oscillation, parameter information of related applications and nodes is obtained through a parameter database, and the obtained parameters are used for calculation;
2) in some dynamic threshold algorithms with determined upper and lower limits, for example, an ESD dynamic threshold algorithm, a percentile dynamic threshold algorithm, a quartile dynamic threshold algorithm, and the like, a certain threshold interval is obtained by calculation. If the monitored data is outside the threshold interval, an alarm is triggered. At the moment, the alarm threshold range marked by the expert experience value is obtained through the parameter database, and the alarm is only given out when the alarm threshold range marked by the expert experience value is exceeded and the alarm threshold range marked by the expert experience value is exceeded;
3) in some combinations where it is desirable to combine the dynamic threshold calculation method I and the dynamic threshold calculation method II, it is considered valid or invalid if it occurs within a time window of contiguous length L, which is also recorded in the parameter database. For example, the dynamic threshold algorithm II needs to be calculated after the value of the division calculated by the dynamic threshold algorithm I exceeds a certain range, and the dynamic threshold algorithm II and the event monitored by the dynamic threshold algorithm I are required to be within the time window L.
Fig. 2 shows an implementation flow of the information monitoring method according to the embodiment of the present invention. Referring to fig. 2, an embodiment of the present invention provides an information monitoring method, where the method includes: operation 210, acquiring monitoring data; operation 220, obtaining a first value for assisting in determining the dynamic threshold according to a dynamic threshold algorithm, where the first value is a value obtained by performing centralized processing on a plurality of second values having independent sources and continuously modifying the second values through an information feedback mechanism; operation 230, determining a dynamic threshold according to the dynamic threshold algorithm and the first value; and operation 240, judging whether the monitoring data is in the range limited by the dynamic threshold value, and if not, alarming.
In operation 210, the monitoring data is typically real-time data collected by a data collector, for example, access conditions of an application, room temperature collected under production conditions, power consumption of a mobile phone, available internal disk space, IO operation statistics, system error information statistics, and the like. These data are also used for real-time monitoring and for finding out abnormal conditions by comparison with dynamic thresholds.
In operation 220, the first value is typically a value of some data stored in a data storage system, such as a parameter database, that is used to assist the dynamic threshold algorithm in jointly determining the final dynamic threshold for use. Such as the parameter values, empirical thresholds, and validity window times mentioned in the application scenarios above.
It should be noted that the first value referred to in the embodiments of the present invention is different from the empirical threshold value commonly used in the prior art systems, and is obtained based on a plurality of second values from different, independent sources. The second value with independent source may be expert experience value labeled by different administrators or obtained from different expert systems.
The first and second values are both somewhat estimated or empirical values and will typically be somewhat in error from the target values. The target value here refers to a value that can capture more abnormal events and control the false alarm rate to a certain degree, and this target value is usually the value that is best implemented through verification over a period of time.
But since the first value incorporates a plurality of second values having independent sources, it is more objective and more accurate than the empirical value labeled by a single administrator or a single expert system.
The information feedback mechanism is used for feeding back the first value and an actual result of alarming by using the first value, such as alarm information, monitoring data for triggering the alarm information, a processing result of the alarm information and the like, to each data source of the second value, and each data source of the second value correspondingly adjusts the second value available for the next time after receiving the feedback information. Thus, after a number of iterations, the accuracy of the second value and the first value, i.e. the proximity to the target value, also increases.
Then, a dynamic threshold may be determined according to the first value and determined according to the dynamic threshold through operations 230 and 240, and if the monitored data is within the range defined by the dynamic threshold, an alarm may be issued by triggering an alarm event, etc.
The first value may be a parameter of the dynamic threshold algorithm, an empirical threshold used in combination with the dynamic threshold, or a valid time window length between two dynamic thresholds in combination in different application scenarios. The following is an exemplary description of the above cases.
According to an embodiment of the present invention, obtaining a first value according to a dynamic threshold algorithm includes: if the dynamic threshold algorithm is a first dynamic threshold algorithm, acquiring a parameter of the first dynamic threshold algorithm as a first numerical value; accordingly, determining the dynamic threshold based on the dynamic threshold algorithm and the first value includes: and calculating by using a first dynamic threshold algorithm and the first numerical value to obtain the dynamic threshold.
The first dynamic threshold algorithm generally refers to an algorithm that performs dynamic calculation according to certain parameters, for example, some dynamic threshold algorithms related to amplitude, fluctuation degree, and periodic oscillation; the first value mainly refers to parameters of related application or server nodes; the dynamic threshold is calculated by substituting the parameters into a dynamic threshold algorithm.
For example, a server runs an application providing card punching service, which has high access volume during the working day's peak hours from work to work (e.g. 8 o ' clock to 10 o ' clock, 6 o ' clock to 9 o ' clock later), and has low access volume during other hours, the access volume during the day is periodically fluctuated, and 8 o ' clock, 10 o ' clock, 6 o ' clock and 9 o ' clock are parameters used by the dynamic threshold algorithm to specify the peak hours in weekdays. The time interval may be different at the beginning of the year, in the middle of the year and at the end of the year, and the time interval may be different between the season of heavy traffic and the season of light traffic, and needs to be adjusted accordingly.
In the monitoring and early warning example, the parameters to be adjusted are labeled through expert experience values and can be stored in a data storage system such as a parameter database and the like for being used at any time when a dynamic threshold algorithm is used for monitoring.
According to an embodiment of the present invention, obtaining a first value according to a dynamic threshold algorithm includes: if the dynamic threshold algorithm is the second dynamic threshold algorithm, acquiring a first dynamic threshold as a first numerical value; accordingly, determining a first dynamic threshold value based on the dynamic threshold algorithm and the first value includes: calculating according to a second dynamic threshold algorithm to obtain a second dynamic threshold; a dynamic threshold is determined based on the first value and the second dynamic threshold.
The second dynamic threshold algorithm mainly refers to a dynamic threshold algorithm with a determined upper limit and a lower limit, for example, an ESD dynamic threshold algorithm, a percentile dynamic threshold algorithm, a quartile dynamic threshold algorithm and the like; correspondingly, the first numerical value mainly refers to an alarm threshold range labeled according to expert experience values; the dynamic threshold determined according to the first value and the second dynamic threshold is generally a boundary value of an intersection or a union of a first interval obtained by a dynamic threshold algorithm and a second interval determined by the first value.
For example, when monitoring the room temperature in the production condition, the room temperature in the production environment may need to be finely adjusted according to the real-time humidity, and when the humidity is extremely high or extremely low, the threshold value of the room temperature may become correspondingly high or low, but actually, the threshold value of the room temperature at this time does not need to be adjusted greatly, in this case, the maximum threshold value of the room temperature or the minimum threshold value of the room temperature specified by the expert experience value may be obtained, and an alarm may be given as long as the room temperature in the production environment exceeds the maximum threshold value of the room temperature or the minimum threshold value of the room temperature in the parameter library.
In the monitoring and early warning example, the maximum room temperature threshold or the minimum room temperature threshold is the first numerical value that needs to be labeled by the expert experience value, and can be stored in a data storage system such as a parameter database and the like for being used at any time when a dynamic threshold algorithm is used for monitoring.
According to an embodiment of the present invention, obtaining a first value according to a dynamic threshold algorithm includes: if the dynamic threshold algorithm comprises a third dynamic threshold algorithm and a fourth dynamic threshold algorithm, acquiring a time window value as a first numerical value; accordingly, determining a first dynamic threshold value based on the dynamic threshold algorithm and the first value includes: calculating according to a third dynamic threshold algorithm to obtain a third dynamic threshold; calculating according to a fourth dynamic threshold algorithm to obtain a fourth dynamic threshold; and if the time windows of the third dynamic threshold and the fourth dynamic threshold are less than or equal to the first value, determining the third dynamic threshold and the fourth dynamic threshold as effective dynamic thresholds.
The third dynamic threshold algorithm and the fourth dynamic threshold algorithm, such as the dynamic threshold calculation method I and the dynamic threshold calculation method II described in fig. 1, are combinations of two dynamic thresholds used for determining whether the monitored data is abnormal; the first value refers to a time window for determining that the combination condition is satisfied.
Assuming that the dynamic threshold calculation method I calculates that the available power is lower than 20%, that is, the low power warning condition, the time for generating the low power warning is 15: 05, carrying out a reaction; when the dynamic threshold calculation method II obtains that the electricity consumption of a certain application reaches 5% when the electricity consumption is lower than 20%, and the time window is within 1 hour (20% of the electricity can be standby for 1 hour approximately). When the time window exceeds 1 hour, it may have been recharged or is being recharged, at which time it is no longer alarmed.
In the monitoring and early warning example, 20% is the third dynamic threshold of the dynamic threshold calculation method I; and 5% is a fourth threshold obtained by the dynamic threshold calculation method II when the third dynamic threshold is reached, and the time window of 1 hour is a first numerical value designated by the value needing expert experience and can be stored in a data storage system such as a parameter database and the like for being used at any time when the dynamic threshold algorithm is monitored.
According to an embodiment of the present invention, before obtaining the first value for assisting in determining the dynamic threshold according to the dynamic threshold algorithm, the method further includes: obtaining a plurality of second values having independent sources; a plurality of second values having independent origins are calculated to obtain a first value.
Wherein, the indexes measured by the plurality of second values are the same, but the sources are different. These sources are independent of each other and are not related to each other, and therefore, the second values are also independent of each other and are calculated based on different experience or systems. In this way, objectivity of the first numerical value based on the plurality of second numerical values can be ensured. When calculating the first value from the second value, various suitable calculation methods may be employed, such as taking an average; after the maximum value and the minimum value are removed, taking an average number; carrying out weighted average calculation according to the specified weight value to obtain a numerical value; an end-to-end model can also be established, and a value is obtained through model calculation.
Since the first value incorporates a plurality of second values having independent sources, it is more objective and more accurate than the empirical value labeled by a single administrator or a single expert system.
According to an embodiment of the present invention, calculating a plurality of second values having independent sources to obtain a first value includes: obtaining a weight value of each second numerical value source, wherein the second numerical value sources are independent sources of the second numerical values; and according to the weight value of each second numerical value source, carrying out weighted calculation on a plurality of second numerical values with independent sources to obtain a first numerical value.
The accuracy of the second value may vary greatly due to differences in the methods used for the estimates from source to source, differences in the focus of interest, or differences in accumulated experience, differences in the level of expertise, differences in the algorithms used in the system, etc. At this time, if the average is made by number without any weight value, it is likely to pull down the accuracy of the first value.
In order to make the first value closer to the target value, in this embodiment, a weight value of the second value source is obtained, and the first value is obtained by performing weighted average calculation according to the weight value of the second value source. The weight value of the second numerical source is usually set in advance. The weighted value may be a fixed value set by referring to expert level, administrator rating or other information, or may be dynamically updated according to the alarm result and the difference between the second value and the accurate value.
According to an embodiment of the present invention, before obtaining the weight value of each second value source, the method further includes: acquiring the labeling quality of each second numerical value source; and determining the weight value of the corresponding second numerical value source according to the labeling quality.
The labeled quality of the second value source mainly means that the second value provided by the second value source enables the first value to be closer to a target value, namely a measurement index.
The labeling quality of the second numerical source can be obtained by dividing the number of effective alarms which are found to be really abnormal by the number of alarms which are possibly triggered by using the second numerical source to alarm to obtain the abnormal event capturing rate; or by how close the second value is to the target value.
Generally, the higher the quality of the label from the second value source, the higher the accuracy of the second value, and the higher the weight value from the second value source.
In this embodiment, the weight value of the second numerical source is not fixed, but is dynamically updated according to the label quality of the second numerical source. Compared with a fixed value set by referring to expert level, administrator score or other information, the dynamically updated weight value can reflect the labeling quality of the second numerical value better, and can enable the first numerical value to be closer to the target value.
Fig. 3 is a flowchart illustrating a specific implementation of an information monitoring method according to an embodiment of the present invention, in which an application performs a weighted calculation based on a second value to obtain a first value. In the application shown in fig. 3, different experts label the parameters used in the dynamic threshold through an expert labeling system, the expert experience value labeled by each expert is the second numerical value referred in the embodiment of the present invention, and the parameter p calculated by the weight w based on the expert experience value labeled by each expert is the first numerical value referred in the embodiment of the present invention.
Specifically, the process of calculating the parameter p by the expert experience value through the weight w mainly comprises the following steps:
the historical data comprises expert experience values which are independently labeled by each expert, a parameter p which is calculated by a weight w based on the expert experience values labeled by each expert, actually triggered alarm events, effective alarm events in the actually triggered alarm events, and the like.
After acquiring the historical data, the historical data can be sent to each expert to be referred to so as to adjust the expert experience values which are labeled later. Furthermore, the labeling quality of different experts under a specific application, field or label can be calculated according to the historical data, and the weight w can be calculated according to the labeling quality.
and step 340, calculating to obtain a parameter p according to the weight w of each expert and the expert experience value labeled by each expert.
According to an embodiment of the present invention, before obtaining the plurality of second values having independent sources, the method further includes: and providing the first numerical value and the historical record of the actual result corresponding to the first numerical value to each second numerical value source so that each second numerical value source can revise the second numerical value independently.
In this embodiment, the first value and the actual result corresponding to the first value are fed back to the second value source. The second value source can adjust a second value for next use according to the first value and an actual result corresponding to the first value. In this way, a closed loop and iterative mechanism of information feedback can be formed to bring the second value infinitely close to the target value, and thus the first value also infinitely close to the target value.
According to an embodiment of the present invention, before obtaining the first value for assisting in determining the dynamic threshold according to the dynamic threshold algorithm, the method further includes: and judging whether the first numerical value exists or not, if not, further judging whether a second numerical value exists or not, if so, performing subsequent operation by taking the second numerical value as the first numerical value to obtain a first alarm result, and sending the first alarm result to a second numerical value source corresponding to the second numerical value.
Determining the first value from the second value typically requires a time period and requires that all values from the second value source be collected before calculation can occur. Meanwhile, there may be an empty period, that is, the first value calculated last time has expired, but the first value to be used this time has not been obtained yet. At this time, a single second numerical value can be selected for trial operation, and the alarm result of the dynamic threshold value calculated by using the second numerical value is returned to the corresponding second numerical value source.
The result is not sent to other second value sources, but only to the second value source that provides the second value, so that the second value source optimizes the second value provided next time. This provides more reference information for the second value source, allowing the second value to be continually optimized and increasingly closer to the target value.
Further, an embodiment of the present invention further provides an information monitoring apparatus, as shown in fig. 4, where the apparatus 40 includes: a monitoring data obtaining module 401, configured to obtain monitoring data; a first value obtaining module 402, configured to obtain, according to a dynamic threshold algorithm, a first value for assisting in determining a dynamic threshold, where the first value is a value obtained by performing centralized processing on a plurality of second values having independent sources and continuously modifying the second values through an information feedback mechanism; a dynamic threshold determining module 403, configured to determine a dynamic threshold according to a dynamic threshold algorithm and the first value; and the alarm module 404 is configured to determine whether the monitoring data is within a range limited by the dynamic threshold, and if not, alarm.
According to an embodiment of the present invention, the first numerical value obtaining module 402 is specifically configured to obtain a parameter of a first dynamic threshold algorithm as a first numerical value if the dynamic threshold algorithm is the first dynamic threshold algorithm; accordingly, the dynamic threshold determination module 403 is specifically configured to calculate the dynamic threshold by using a first dynamic threshold algorithm and a first numerical value.
According to an embodiment of the present invention, the first numerical value obtaining module 402 is specifically configured to obtain a first dynamic threshold value as a first numerical value if the dynamic threshold value algorithm is the second dynamic threshold value algorithm; correspondingly, the dynamic threshold determining module 403 is specifically configured to calculate a second dynamic threshold according to a second dynamic threshold algorithm; a dynamic threshold is determined based on the first value and the second dynamic threshold.
According to an embodiment of the present invention, the first numerical value obtaining module 402 is specifically configured to obtain a time window value as a first numerical value if the dynamic threshold algorithm includes a third dynamic threshold algorithm and a fourth dynamic threshold algorithm; correspondingly, the dynamic threshold determining module 403 is specifically configured to calculate a third dynamic threshold according to a third dynamic threshold algorithm; calculating according to a fourth dynamic threshold algorithm to obtain a fourth dynamic threshold; and if the time windows of the third dynamic threshold and the fourth dynamic threshold are less than or equal to the first value, determining the third dynamic threshold and the fourth dynamic threshold as effective dynamic thresholds.
According to an embodiment of the present invention, the apparatus 40 further includes: the second numerical value acquisition module is used for acquiring a plurality of second numerical values with independent sources; the first numerical value calculation module is used for calculating a plurality of second numerical values with independent sources to obtain a first numerical value.
According to an embodiment of the present invention, the first numerical calculation module includes: the weight value obtaining submodule is used for obtaining the weight value of each second numerical value source, wherein the second numerical value source is an independent source of the second numerical value; and the weighting calculation submodule is used for carrying out weighting calculation on a plurality of second numerical values with independent sources according to the weight value of each second numerical value source to obtain a first numerical value.
According to an embodiment of the present invention, the first numerical calculation module further includes: the expected result obtaining submodule is used for obtaining an expected result corresponding to each second numerical value; the actual result obtaining submodule is used for obtaining an actual result corresponding to each second numerical value; the comparison result submodule is used for comparing the expected result with the actual result to determine the labeling quality of each second numerical value source; and the weight value determining submodule is used for determining the weight value of the corresponding second numerical value source according to the labeling quality.
According to an embodiment of the present invention, the apparatus 40 further includes: and the history record providing module is used for providing the first numerical value and the history record of the actual result corresponding to the first numerical value for each second numerical value source to revise the second numerical value independently.
According to an embodiment of the present invention, the apparatus 40 further includes: and the second numerical value checking module is used for judging whether the first numerical value exists or not, further judging whether the second numerical value exists or not if the first numerical value does not exist, taking the second numerical value as the first numerical value to execute subsequent operation to obtain a first alarm result if the second numerical value exists, and sending the first alarm result to a second numerical value source corresponding to the second numerical value.
According to a third aspect of embodiments of the present invention, there is provided a computer-readable storage medium, wherein the storage medium includes a set of computer-executable instructions, and when the instructions are executed, the storage medium is configured to perform any one of the information monitoring methods described above.
Here, it should be noted that: the above description of the embodiment of the apparatus for information monitoring and the above description of the embodiment of the computer-readable storage medium are similar to the description of the foregoing method embodiments, and have similar beneficial effects to the foregoing method embodiments, and therefore are not repeated herein. For the technical details that have not been disclosed yet in the description of the embodiment of the information monitoring apparatus and the embodiment of the computer-readable storage medium of the present invention, please refer to the description of the foregoing method embodiment of the present invention for understanding, and therefore, for brevity, will not be described again.
It should be noted that, in this document, the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising an … …" does not exclude the presence of other like elements in a process, method, article, or apparatus that comprises the element.
In the several embodiments provided in the present application, it should be understood that the disclosed apparatus and method may be implemented in other ways. The above-described device embodiments are merely illustrative, for example, the division of a unit is only one logical function division, and there may be other division ways in actual implementation, such as: multiple units or components may be combined, or may be integrated into another device, or some features may be omitted, or not implemented. In addition, the coupling, direct coupling or communication connection between the components shown or discussed may be through some interfaces, and the indirect coupling or communication connection between the devices or units may be electrical, mechanical or other forms.
The units described as separate parts may or may not be physically separate, and parts displayed as units may or may not be physical units; can be located in one place or distributed on a plurality of network units; some or all of the units can be selected according to actual needs to achieve the purpose of the solution of the embodiment.
In addition, all the functional units in the embodiments of the present invention may be integrated into one processing unit, or each unit may be separately regarded as one unit, or two or more units may be integrated into one unit; the integrated unit can be realized in a form of hardware, or in a form of hardware plus a software functional unit.
Those of ordinary skill in the art will understand that: all or part of the steps for realizing the method embodiments can be completed by hardware related to program instructions, the program can be stored in a computer readable storage medium, and the program executes the steps comprising the method embodiments when executed; and the aforementioned storage medium includes: various media capable of storing program codes, such as a removable storage medium, a Read Only Memory (ROM), a magnetic disk, and an optical disk.
Alternatively, the integrated unit of the present invention may be stored in a computer-readable storage medium if it is implemented in the form of a software functional module and sold or used as a separate product. Based on such understanding, the technical solutions of the embodiments of the present invention may be essentially implemented or a part contributing to the prior art may be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for enabling a computer device (which may be a personal computer, a server, or a network device) to execute all or part of the methods of the embodiments of the present invention. And the aforementioned storage medium includes: a removable storage medium, a ROM, a magnetic disk, an optical disk, or the like, which can store the program code.
The above description is only for the specific embodiments of the present invention, but the scope of the present invention is not limited thereto, and any person skilled in the art can easily conceive of the changes or substitutions within the technical scope of the present invention, and the changes or substitutions should be covered within the scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.
Claims (10)
1. An information monitoring method, the method comprising:
acquiring monitoring data;
acquiring a first numerical value for assisting in determining a dynamic threshold according to a dynamic threshold algorithm, wherein the first numerical value is a value obtained by performing centralized processing on a plurality of second numerical values with independent sources and continuously correcting the plurality of second numerical values through an information feedback mechanism;
determining a dynamic threshold value according to the dynamic threshold value algorithm and the first numerical value;
and judging whether the monitoring data is in the range limited by the dynamic threshold value, and if not, alarming.
2. The method of claim 1, the obtaining a first numerical value according to the dynamic threshold algorithm, comprising:
if the dynamic threshold algorithm is a first dynamic threshold algorithm, acquiring a parameter of the first dynamic threshold algorithm as a first numerical value;
accordingly, determining a dynamic threshold value according to the dynamic threshold algorithm and the first value includes:
and calculating by using a first dynamic threshold algorithm and the first numerical value to obtain a dynamic threshold.
3. The method of claim 1, the obtaining a first numerical value according to the dynamic threshold algorithm, comprising:
if the dynamic threshold algorithm is a second dynamic threshold algorithm, acquiring a first dynamic threshold as a first numerical value;
accordingly, determining a first dynamic threshold value according to the dynamic threshold algorithm and the first value comprises:
calculating to obtain a second dynamic threshold according to the second dynamic threshold algorithm;
and determining a dynamic threshold value according to the first numerical value and the second dynamic threshold value.
4. The method of claim 1, the obtaining a first numerical value according to the dynamic threshold algorithm, comprising:
if the dynamic threshold algorithm comprises a third dynamic threshold algorithm and a fourth dynamic threshold algorithm, acquiring a time window value as a first numerical value;
accordingly, determining a first dynamic threshold value according to the dynamic threshold algorithm and the first value comprises:
calculating to obtain a third dynamic threshold according to the third dynamic threshold algorithm;
calculating to obtain a fourth dynamic threshold according to the fourth dynamic threshold algorithm;
and if the time windows of the third dynamic threshold and the fourth dynamic threshold are less than or equal to a first value, determining the third dynamic threshold and the fourth dynamic threshold as valid dynamic thresholds.
5. The method of claim 1, prior to said obtaining a first numerical value for aiding in determining a dynamic threshold in accordance with the dynamic threshold algorithm, the method further comprising:
obtaining a plurality of second values having independent sources;
and calculating the plurality of second values with independent sources to obtain a first value.
6. The method of claim 5, wherein calculating the plurality of second values from independent sources to obtain the first value comprises:
obtaining a weight value for each second value source, wherein the second value sources are independent sources of the second values;
and according to the weight value of each second numerical value source, carrying out weighted calculation on the plurality of second numerical values with independent sources to obtain a first numerical value.
7. The method of claim 6, prior to said obtaining weight values for each second value source, further comprising:
acquiring the labeling quality of each second numerical value source;
and determining the weight value of the corresponding second numerical value source according to the labeling quality.
8. The method of claim 5, prior to obtaining a plurality of second values having independent origins, the method further comprising:
and providing the first numerical value and the historical record of the actual result corresponding to the first numerical value to each second numerical value source so that each second numerical value source can revise the second numerical value independently.
9. The method of claim 5, prior to said obtaining a first numerical value for aiding in determining a dynamic threshold in accordance with the dynamic threshold algorithm, the method further comprising:
and judging whether the first numerical value exists or not, if not, further judging whether a second numerical value exists or not, if so, performing subsequent operation by taking the second numerical value as the first numerical value to obtain a first alarm result, and sending the first alarm result to a second numerical value source corresponding to the second numerical value.
10. An information monitoring apparatus, the apparatus comprising:
the monitoring data acquisition module is used for acquiring monitoring data;
the first numerical value acquisition module is used for acquiring a first numerical value for assisting in determining the dynamic threshold value according to a dynamic threshold value algorithm, wherein the first numerical value is a value obtained by performing centralized processing on a plurality of second numerical values with independent sources and continuously correcting the second numerical values through an information feedback mechanism;
the dynamic threshold value determining module is used for determining a dynamic threshold value according to the dynamic threshold value algorithm and the first numerical value;
and the alarm module is used for judging whether the monitoring data is in the range limited by the dynamic threshold value, and if not, alarming.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202011613414.3A CN112667479A (en) | 2020-12-30 | 2020-12-30 | Information monitoring method and device |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202011613414.3A CN112667479A (en) | 2020-12-30 | 2020-12-30 | Information monitoring method and device |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN112667479A true CN112667479A (en) | 2021-04-16 |
Family
ID=75411180
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202011613414.3A Pending CN112667479A (en) | 2020-12-30 | 2020-12-30 | Information monitoring method and device |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN112667479A (en) |
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN115331440A (en) * | 2022-08-09 | 2022-11-11 | 山东旗帜信息有限公司 | High-adaptation early warning method and system based on monitoring threshold information |
| CN115343976A (en) * | 2022-06-20 | 2022-11-15 | 阳城国际发电有限责任公司 | Remote monitoring system based on power plant energy efficiency analysis |
Citations (8)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN106656583A (en) * | 2016-12-02 | 2017-05-10 | 郑州云海信息技术有限公司 | Dynamic threshold alarming method and device |
| US20170149604A1 (en) * | 2015-11-24 | 2017-05-25 | International Business Machines Corporation | Dynamic thresholds for computer system alerts |
| CN106909487A (en) * | 2017-01-18 | 2017-06-30 | 北京盛世全景科技股份有限公司 | It is applied to the method for early warning and device of information system |
| KR20170084445A (en) * | 2016-01-12 | 2017-07-20 | 삼성에스디에스 주식회사 | Method and apparatus for detecting abnormality using time-series data |
| CN109446017A (en) * | 2018-09-03 | 2019-03-08 | 平安科技（深圳）有限公司 | A kind of alarm algorithm generation method, monitoring system and terminal device |
| CN109815088A (en) * | 2019-01-07 | 2019-05-28 | 珠海天燕科技有限公司 | A kind of monitoring householder method and device |
| US20190362245A1 (en) * | 2018-05-24 | 2019-11-28 | International Business Machines Corporation | Anomaly detection |
| CN110995477A (en) * | 2019-11-20 | 2020-04-10 | 北京宝兰德软件股份有限公司 | Early warning processing method, device and equipment based on dynamic threshold and storage medium |
-
2020
- 2020-12-30 CN CN202011613414.3A patent/CN112667479A/en active Pending
Patent Citations (8)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20170149604A1 (en) * | 2015-11-24 | 2017-05-25 | International Business Machines Corporation | Dynamic thresholds for computer system alerts |
| KR20170084445A (en) * | 2016-01-12 | 2017-07-20 | 삼성에스디에스 주식회사 | Method and apparatus for detecting abnormality using time-series data |
| CN106656583A (en) * | 2016-12-02 | 2017-05-10 | 郑州云海信息技术有限公司 | Dynamic threshold alarming method and device |
| CN106909487A (en) * | 2017-01-18 | 2017-06-30 | 北京盛世全景科技股份有限公司 | It is applied to the method for early warning and device of information system |
| US20190362245A1 (en) * | 2018-05-24 | 2019-11-28 | International Business Machines Corporation | Anomaly detection |
| CN109446017A (en) * | 2018-09-03 | 2019-03-08 | 平安科技（深圳）有限公司 | A kind of alarm algorithm generation method, monitoring system and terminal device |
| CN109815088A (en) * | 2019-01-07 | 2019-05-28 | 珠海天燕科技有限公司 | A kind of monitoring householder method and device |
| CN110995477A (en) * | 2019-11-20 | 2020-04-10 | 北京宝兰德软件股份有限公司 | Early warning processing method, device and equipment based on dynamic threshold and storage medium |
Cited By (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN115343976A (en) * | 2022-06-20 | 2022-11-15 | 阳城国际发电有限责任公司 | Remote monitoring system based on power plant energy efficiency analysis |
| CN115331440A (en) * | 2022-08-09 | 2022-11-11 | 山东旗帜信息有限公司 | High-adaptation early warning method and system based on monitoring threshold information |
| CN115331440B (en) * | 2022-08-09 | 2023-08-18 | 山东旗帜信息有限公司 | High-adaptation early warning method and system based on monitoring threshold information |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN110661659B (en) | Alarm method, device and system and electronic equipment | |
| CN111158977B (en) | Abnormal event root cause positioning method and device | |
| US8832267B2 (en) | System and method for adaptive baseline calculation | |
| US20170371757A1 (en) | System monitoring method and apparatus | |
| US20160217378A1 (en) | Identifying anomalous behavior of a monitored entity | |
| EP2874064B1 (en) | Adaptive metric collection, storage, and alert thresholds | |
| CN112667479A (en) | Information monitoring method and device | |
| CN105071983A (en) | Abnormal load detection method for cloud calculation on-line business | |
| CN111045894B (en) | Database abnormality detection method, database abnormality detection device, computer device and storage medium | |
| AU2019253894B1 (en) | Automated identification of device status and resulting dynamic modification of device operations | |
| CN111459761B (en) | Redis configuration method, device, storage medium and equipment | |
| US20220245010A1 (en) | Time-series anomaly detection using an inverted index | |
| CN111367747B (en) | Index abnormal detection early warning device based on time annotation | |
| CN111104342A (en) | Method, electronic device and computer program product for storage | |
| CN108833372A (en) | A kind of enterprise network security management cloud service platform system | |
| CN112637021A (en) | Dynamic flow monitoring method and device based on linear regression algorithm | |
| US20220138068A1 (en) | Computer readable program code change impact estimations | |
| EP2882139B1 (en) | System and method for IT servers anomaly detection using incident consolidation | |
| CN115016976B (en) | Root cause positioning method, device, equipment and storage medium | |
| CN111258854A (en) | Model training method, alarm method based on prediction model and related device | |
| CN111090571B (en) | Maintenance method, device and computer storage medium for information system | |
| CN112530505A (en) | Hard disk delay detection method and device and computer readable storage medium | |
| CN111095868A (en) | Data traffic management in software defined networks | |
| US20220335347A1 (en) | Time-series anomaly prediction and alert | |
| US20240053739A1 (en) | Remaining useful life prediction for machine components |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination |