CN113079047A - Alarm processing method and device - Google Patents
Alarm processing method and device Download PDFInfo
- Publication number
- CN113079047A CN113079047A CN202110336947.XA CN202110336947A CN113079047A CN 113079047 A CN113079047 A CN 113079047A CN 202110336947 A CN202110336947 A CN 202110336947A CN 113079047 A CN113079047 A CN 113079047A
- Authority
- CN
- China
- Prior art keywords
- alarm
- determining
- weight
- historical
- index
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/06—Management of faults, events, alarms or notifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/06—Management of faults, events, alarms or notifications
- H04L41/0631—Management of faults, events, alarms or notifications using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
Landscapes
- Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Alarm Systems (AREA)
Abstract
The embodiment of the invention provides an alarm processing method and device, wherein the method comprises the following steps: obtaining a multi-dimensional characteristic parameter of a current alarm index; determining the weight of each dimension characteristic according to the discrete degree of each dimension characteristic in the historical alarm indexes, and determining a score threshold corresponding to each alarm grade according to the weight; calculating according to the multi-dimensional characteristic parameters and the weight to obtain an evaluation score of the current alarm index; determining an alarm grade corresponding to the current alarm index according to the evaluation score and the score threshold of the current alarm index; and triggering abnormal alarm according to the alarm level corresponding to the current alarm index. The method and the device have the advantages that the alarm indexes can be evaluated from multiple dimensions, more characteristics of the alarm indexes are mined, the discrimination between different alarm indexes is improved, meanwhile, the grade judgment can be carried out more automatically by assigning the weight in real time and determining the score threshold value corresponding to each alarm grade according to the weight, and the alarm quantity is controlled, so that the alarm effectiveness is improved.
Description
Technical Field
The present invention relates to the field of monitoring technologies, and in particular, to an alarm processing method and an alarm processing apparatus.
Background
Alarms are the most important ring in monitoring services and their effectiveness is crucial. The resource limitations of alarm handling determine the limitations in which alarms can be handled. With the improvement of monitoring capability, the coverage of monitoring service is expanded, and the daily alarm amount also rises day by day.
Under the condition of no service prior knowledge, in the existing alarm system, a uniform grade is often set for the alarm, or different grades are set only aiming at the numerical value of the monitoring index, the judgment mode of the alarm grade is single, so that the service can receive a large amount of alarms of each index in the same grade in a short time.
However, because the discrimination between different alarms is not high, if a large number of homogeneous alarms are triggered in a short time, some important alarms may not be processed in time, so that the alarm effectiveness is greatly reduced.
Disclosure of Invention
The embodiment of the invention aims to provide an alarm processing method and a corresponding alarm processing device, so as to solve the problem that triggering a large number of homogeneous alarms in a short time can cause part of important alarms to be processed in time, so that the alarm effectiveness is greatly reduced. The specific technical scheme is as follows:
in a first aspect of the present invention, an alarm processing method is provided, including:
obtaining a multi-dimensional characteristic parameter of a current alarm index;
determining the weight of each dimension characteristic according to the discrete degree of each dimension characteristic in the historical alarm indexes, and determining a score threshold value corresponding to each alarm grade according to the weight;
calculating to obtain the evaluation score of the current alarm index according to the multi-dimensional characteristic parameters and the weight;
determining the alarm grade corresponding to the current alarm index according to the evaluation score of the current alarm index and the score threshold;
and triggering abnormal alarm according to the alarm level corresponding to the current alarm index.
Optionally, the determining the weight of each dimensional feature according to the discrete degree of each dimensional feature in the historical alarm indicator includes:
and according to a preset period, determining the weight of each dimension characteristic according to the discrete degree of each dimension characteristic in the historical alarm index.
Optionally, the determining the weight of each dimensional feature according to the discrete degree of each dimensional feature in the historical alarm indicator includes:
determining a plurality of historical alarm indexes corresponding to the current alarm index;
obtaining multi-dimensional historical characteristic parameters of the plurality of historical alarm indexes;
and determining the dispersion degree of each dimension characteristic according to the multi-dimension historical characteristic parameters, and determining the weight of each dimension characteristic according to the dispersion degree.
Optionally, the determining the degree of dispersion of each dimensional feature according to the multi-dimensional historical feature parameter, and determining the weight of each dimensional feature according to the degree of dispersion, includes:
carrying out normalization processing on the multi-dimensional historical characteristic parameters to obtain normalized values;
calculating the probability of the multi-dimensional historical characteristic parameters according to the normalized numerical value;
calculating according to the probability to obtain entropy values of all the dimensional characteristics;
and determining the weight of each dimension characteristic according to the entropy value.
Optionally, the determining a score threshold corresponding to each alarm level according to the weight includes:
and determining a score threshold corresponding to each alarm grade according to the weight according to a preset alarm amount.
Optionally, the determining, according to the preset alarm amount and according to the weight, a score threshold corresponding to each alarm level includes:
calculating to obtain the evaluation scores of the plurality of historical alarm indexes according to the weight and the normalization value;
ranking the evaluation scores of the plurality of historical alarm indexes;
and determining a score threshold corresponding to each alarm grade according to the sorted evaluation scores and the preset alarm amount.
Optionally, the method further comprises:
and after the abnormal alarm is triggered, storing the multi-dimensional characteristic parameters of the current alarm index.
In a second aspect of the present invention, there is also provided an alarm processing apparatus, including:
the characteristic acquisition module is used for acquiring multi-dimensional characteristic parameters of the current alarm indexes;
the weight determining module is used for determining the weight of each dimension characteristic according to the discrete degree of each dimension characteristic in the historical alarm indexes and determining a score threshold value corresponding to each alarm grade according to the weight;
the score calculation module is used for calculating and obtaining the evaluation score of the current alarm index according to the multi-dimensional characteristic parameters and the weight;
the grade determining module is used for determining the alarm grade corresponding to the current alarm index according to the evaluation score of the current alarm index and the score threshold;
and the alarm triggering module is used for triggering abnormal alarms according to the alarm level corresponding to the current alarm index.
In yet another aspect of the present invention, there is also provided a computer-readable storage medium having stored therein instructions, which when run on a computer, cause the computer to perform any of the above-described methods of alert processing.
In yet another aspect of the present invention, there is also provided a computer program product containing instructions which, when run on a computer, cause the computer to perform the method of alarm handling as described in any one of the above.
The alarm processing method provided by the embodiment of the invention comprises the steps of obtaining multi-dimensional characteristic parameters of the current alarm index, determining the weight of each dimensional characteristic according to the discrete degree of each dimensional characteristic in the historical alarm index, determining the score threshold value corresponding to each alarm grade according to the weight, calculating to obtain the evaluation score of the current alarm index according to the dimensional characteristic parameters and the weight, determining the alarm grade corresponding to the current alarm index according to the evaluation score and the score threshold value of the current alarm index, and triggering abnormal alarm according to the alarm grade corresponding to the current alarm index. The method and the device have the advantages that the alarm indexes can be evaluated from multiple dimensions, more characteristics of the alarm indexes are mined, the discrimination between different alarm indexes is improved, meanwhile, the grade judgment can be carried out more automatically by assigning the weight in real time and determining the score threshold value corresponding to each alarm grade according to the weight, and the alarm quantity is controlled, so that the alarm effectiveness is improved.
Drawings
In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the embodiments or the prior art will be briefly described below.
FIG. 1 is a flowchart illustrating steps of an embodiment of a method for alarm handling according to the present invention;
FIG. 2 is a flow chart illustrating the steps of an alarm handling method of a monitoring system according to the present invention;
FIG. 3 is a block diagram of an alarm processing apparatus according to an embodiment of the present invention;
fig. 4 is a block diagram of an electronic device according to the present invention.
Detailed Description
The technical solutions in the embodiments of the present invention will be described below with reference to the drawings in the embodiments of the present invention.
Referring to fig. 1, a flowchart illustrating steps of an embodiment of an alarm processing method according to the present invention is shown, where the method specifically includes the following steps:
the alarm index refers to a parameter for measuring whether an abnormal alarm needs to be triggered, such as a second broadcast rate, a fault rate, a stuck-at ratio, and the like. The current alarm index is the alarm index currently being processed. The characteristic parameter refers to characteristic data for describing the condition of the alarm index, for example, an absolute value of the alarm index itself, a variation range of a homocyclic ratio, a distance from an adaptive baseline, a related characteristic of an index associated with the alarm index, a related monitoring granularity characteristic, and the like.
In the embodiment of the invention, in order to improve the discrimination between different alarm indexes, the alarm indexes can be screened and graded definitely from more different dimensions in a self-adaptive manner, and characteristic parameters are respectively acquired from a plurality of dimensions aiming at each alarm index when alarm processing is carried out, so that whether alarm needs to be triggered or not is further determined according to the characteristic parameters.
the feature weight of each dimension can represent the importance degree of the feature of each dimension in the overall evaluation alarm index. The score threshold may comprise: and the evaluation score ranges corresponding to the alarm grades corresponding to the current alarm indexes are used for judging the alarm grades corresponding to the alarm indexes.
In the real-time embodiment of the invention, the weight corresponding to each dimension characteristic is determined according to the discrete degree of each dimension characteristic in the historical alarm index without human participation, namely based on the characteristic self expression of each dimension of the current alarm index. Specifically, an entropy weight method may be used to determine a degree of dispersion of each dimension characteristic in the historical alarm indicator, and further determine a weight of each dimension characteristic according to the degree of dispersion, where the entropy weight method is a weighting method, and a basic idea is to determine an objective weight according to a size of variability of each characteristic. After determining the weight of each dimension characteristic, a score threshold corresponding to each alarm level may be further determined according to the weight, specifically, a certain amount of historical data of the alarm occurring in advance may be obtained, and a score corresponding to each alarm index may be calculated according to the weight and the historical data, so that the score threshold corresponding to each alarm level may be determined according to the scores.
103, calculating to obtain the evaluation score of the current alarm index according to the multi-dimensional characteristic parameters and the weight;
specifically, the feature parameters of each dimension of the current alarm indicator may be multiplied by the weight corresponding to the feature parameter of the dimension to obtain the score corresponding to the feature parameter of each dimension, and then the calculated scores corresponding to the feature parameters of all the dimensions are added to obtain the evaluation score of the current alarm indicator.
104, determining the alarm grade corresponding to the current alarm index according to the evaluation score of the current alarm index and the score threshold;
specifically, the score threshold value in which the evaluation score of the current alarm indicator falls may be determined according to the score threshold value corresponding to each alarm level corresponding to the current alarm indicator, so as to determine that the alarm level corresponding to the score threshold value in which the characteristic parameter falls is the alarm level corresponding to the current alarm indicator.
And 105, triggering an abnormal alarm according to the alarm level corresponding to the current alarm index.
Specifically, if the alarm level corresponding to the current alarm index meets the alarm triggering condition, an abnormal alarm can be triggered for the current alarm index; if the alarm grade corresponding to the current alarm index does not meet the condition for triggering the alarm, the abnormal alarm does not need to be triggered aiming at the current alarm index.
In a preferred embodiment of the present invention, the step 102 may include the following sub-steps:
and according to a preset period, determining the weight of each dimension characteristic according to the discrete degree of each dimension characteristic in the historical alarm index.
In a specific implementation, in order to avoid resource waste caused by frequent determination of the weights corresponding to the dimensional features, the weights of the dimensional features may be periodically determined according to a preset period and a discrete degree of the dimensional features in the historical alarm index. The preset period may be a preset time interval, for example, if the preset period is 24 hours, the weight of each dimensional feature is determined again every 24 hours according to the discrete degree of each dimensional feature in the historical alarm index.
In a preferred embodiment of the present invention, the step 102 may include the following sub-steps:
determining a plurality of historical alarm indexes corresponding to the current alarm index; obtaining multi-dimensional historical characteristic parameters of the plurality of historical alarm indexes; and determining the dispersion degree of each dimension characteristic according to the multi-dimension historical characteristic parameters, and determining the weight of each dimension characteristic according to the dispersion degree.
The historical alarm index may be an index of a previous abnormal alarm triggered corresponding to the current alarm index, for example, if the current alarm index is a second broadcast rate, the second broadcast rate of the previous abnormal alarm triggered may be determined as the historical alarm index.
In a specific implementation, a plurality of historical alarm indexes corresponding to the current alarm index may be determined, and the historical alarm indexes are used to calculate weights corresponding to the dimensional features, for example, all the historical alarm indexes that trigger abnormal alarms within a recent period of time, or a certain number of the historical alarm indexes that trigger abnormal alarms recently may be determined. Furthermore, multi-dimensional historical characteristic parameters corresponding to the historical alarm indexes can be obtained, the dispersion degree of each dimensional characteristic is determined according to the multi-dimensional historical characteristic parameters, and the weight of each dimensional characteristic is determined according to the dispersion degree.
In a preferred embodiment of the present invention, the determining a degree of dispersion of each dimensional feature according to the multi-dimensional historical feature parameter, and determining a weight of each dimensional feature according to the degree of dispersion, includes:
carrying out normalization processing on the multi-dimensional historical characteristic parameters to obtain normalized values; calculating the probability of the multi-dimensional historical characteristic parameters according to the normalized numerical value; calculating according to the probability to obtain entropy values of all the dimensional characteristics; and calculating the weight of each dimension characteristic according to the entropy value.
In the embodiment of the present invention, feature parameters of each dimension may be weighted by an entropy weight method. Specifically, the multidimensional historical characteristic parameters may be normalized to obtain normalized values, the probabilities of the multidimensional historical characteristic parameters may be calculated according to the normalized values, and the entropy values of the dimensional characteristics may be calculated according to the probabilities, where the entropy values are used to represent the discrete degrees of the dimensional characteristics, and after the entropy values of the dimensional characteristics are calculated, the weight used to evaluate the current alarm indicator may be further calculated according to the entropy values.
As an example, if there are n historical alarm indicators with m features, xijIs the value of the jth feature of the ith index. Firstly, in order to ensure that the scales of all dimension characteristics are uniform, the indexes are normalized by using a max-min method, namely, positive characteristics (the larger and the more serious) are converted into current values minus minimum values divided by range differences, and negative characteristics (the smaller and the more serious) are converted into maximum values minus current values divided by range differences. The normalized value satisfies the following formula:
positive direction characteristic
Negative going features
Then, the probability of the multi-dimensional historical characteristic parameter can be obtained through calculation according to the normalized value, the probability represents the specific gravity of the jth characteristic of the ith index, and the following formula is satisfied:
further, entropy values of the dimensional features can be obtained by probability calculation, and the entropy value of the jth feature satisfies the following formula:
finally, the weight of each dimension feature can be calculated according to the entropy value, and then the weight of the jth feature satisfies the following formula:
in a preferred embodiment of the present invention, the step of determining the score threshold corresponding to each alarm level according to the weight may include the following sub-steps:
and determining a score threshold corresponding to each alarm grade according to the weight according to a preset alarm amount.
The preset alarm amount may be the number of abnormal alarms triggered by each preset alarm level, for example, the preset alarm amount is: the P1 and P2 level alarms can not exceed 5 alarms in a week, the P3 level alarms can not exceed 10 alarms in a week, and the P4 level alarms can not exceed 20 alarms in a week, etc. In the embodiment of the invention, the score threshold corresponding to each alarm grade can be determined according to the preset alarm amount and the weight obtained by calculation by the method, so that the number of alarms can be effectively controlled, and the effectiveness of the alarms is improved.
In a preferred embodiment of the present invention, the determining, according to the preset alarm amount and according to the weight, a score threshold corresponding to each alarm level includes:
calculating to obtain the evaluation scores of the plurality of historical alarm indexes according to the weight and the normalization value; ranking the evaluation scores of the plurality of historical alarm indexes; and determining a score threshold corresponding to each alarm grade according to the sorted evaluation scores and the preset alarm amount.
Specifically, the normalized values corresponding to the normalized dimensional features may be multiplied by the weights corresponding to the dimensions to obtain the scores of the dimensional features, and then the calculated scores of all the dimensional features are added to obtain the evaluation score of each historical alarm index. Then, the evaluation scores of the plurality of historical alarm indexes are sorted, and according to the sorted evaluation scores and the preset alarm amount, a score threshold corresponding to each alarm level is determined.
As an example, assuming that the preset alarm amounts corresponding to the P1 and P2 levels are 5, the score threshold corresponding to the P1 level may be determined based on the evaluation scores of the first and fifth historical alarm indexes sorted; and determining a score threshold corresponding to the P2 level based on the evaluation scores of the fifth historical alarm index and the tenth historical alarm index.
In a preferred embodiment of the present invention, the method may further comprise the steps of:
and after the abnormal alarm is triggered, storing the multi-dimensional characteristic parameters of the current alarm index.
Specifically, if the level of the current alarm index meets the alarm condition, an abnormal alarm can be triggered for the current alarm index, and then after the abnormal alarm is triggered, the multidimensional characteristic parameters of the current alarm index are stored, so that the data of the current alarm index can be collected, and the subsequent updating of the weight and the score threshold value is facilitated.
FIG. 2 is a flow chart showing the steps of the alarm processing method of the monitoring system according to the present invention; the method specifically comprises the following steps: s1, triggering an abnormal alarm by the monitoring system; s2, obtaining relevant characteristic parameters, calculating evaluation scores and determining grades; s3, storing historical alarm index data; s4, assigning weights to the dimensional features; s5, sorting determines a score threshold.
In the embodiment of the invention, by acquiring the multi-dimensional characteristic parameters of the current alarm index, the weight of each dimensional characteristic is determined according to the discrete degree of each dimensional characteristic in the historical alarm index, the score threshold corresponding to each alarm grade is determined according to the weight, the evaluation score of the current alarm index is obtained by calculation according to the dimensional characteristic parameters and the weight, the alarm grade corresponding to the current alarm index is determined according to the evaluation score and the score threshold of the current alarm index, and the abnormal alarm is triggered according to the alarm grade corresponding to the current alarm index. The method and the device have the advantages that the alarm indexes can be evaluated from multiple dimensions, more characteristics of the alarm indexes are mined, the discrimination between different alarm indexes is improved, meanwhile, the grade judgment can be carried out more automatically by assigning the weight in real time and determining the score threshold value corresponding to each alarm grade according to the weight, and the alarm quantity is controlled, so that the alarm effectiveness is improved.
It should be noted that, for simplicity of description, the method embodiments are described as a series of acts or combination of acts, but those skilled in the art will recognize that the present invention is not limited by the illustrated order of acts, as some steps may occur in other orders or concurrently in accordance with the embodiments of the present invention. Further, those skilled in the art will appreciate that the embodiments described in the specification are presently preferred and that no particular act is required to implement the invention.
Referring to fig. 3, a block diagram of an embodiment of the apparatus of the present invention is shown, and the apparatus may specifically include the following modules:
the characteristic obtaining module 301 is configured to obtain a multidimensional characteristic parameter of a current alarm indicator;
a weight determining module 302, configured to determine a weight of each dimension characteristic by using an entropy weight method according to a discrete degree of each dimension characteristic in a history alarm indicator, and determine a score threshold corresponding to each alarm level according to the weight;
a score calculation module 303, configured to calculate an evaluation score of the current alarm indicator according to the multidimensional characteristic parameter and the weight;
a grade determining module 304, configured to determine, according to the evaluation score of the current alarm indicator and the score threshold, an alarm grade corresponding to the current alarm indicator;
the alarm triggering module 305 is configured to trigger an abnormal alarm according to the alarm level corresponding to the current alarm indicator.
In a preferred embodiment of the present invention, the weight determining module 302 includes:
and the first weight determining submodule is used for determining the weight of each dimension characteristic by adopting an entropy weight method according to the discrete degree of each dimension characteristic in the historical alarm index according to a preset period.
In a preferred embodiment of the present invention, the weight determining module 302 includes:
a historical index determining submodule for determining a plurality of historical alarm indexes corresponding to the current alarm index;
the historical characteristic obtaining submodule is used for obtaining multi-dimensional historical characteristic parameters of the plurality of historical alarm indexes;
and the second weight determining submodule is used for determining the discrete degree of each dimension characteristic according to the multi-dimension historical characteristic parameters and determining the weight of each dimension characteristic according to the discrete degree.
In a preferred embodiment of the present invention, the second weight determination submodule includes:
the normalization processing unit is used for performing normalization processing on the multi-dimensional historical characteristic parameters to obtain a normalization value;
the probability calculation unit is used for calculating the probability of the multi-dimensional historical characteristic parameters according to the normalized numerical values;
an entropy calculation unit, configured to calculate an entropy of each dimensional feature according to the probability;
and the weight calculation unit is used for determining the weight of each dimension characteristic according to the entropy value.
In a preferred embodiment of the present invention, the weight determining module 302 further includes:
and the threshold calculation submodule is used for determining a score threshold corresponding to each alarm grade according to the preset alarm amount and the weight.
In a preferred embodiment of the present invention, the threshold calculation sub-module includes:
the score calculation unit is used for calculating and obtaining the evaluation scores of the plurality of historical alarm indexes according to the weights and the normalized numerical values;
the sorting unit is used for sorting the evaluation scores of the plurality of historical alarm indexes;
and the threshold determining unit is used for determining a score threshold corresponding to each alarm grade according to the sorted evaluation scores and the preset alarm amount.
In a preferred embodiment of the present invention, the method further comprises:
and the characteristic parameter module is used for storing the multi-dimensional characteristic parameters of the current alarm indexes after the abnormal alarm is triggered.
For the device embodiment, since it is basically similar to the method embodiment, the description is simple, and for the relevant points, refer to the partial description of the method embodiment.
An embodiment of the present invention further provides an electronic device, as shown in fig. 4, including a processor 401, a communication interface 402, a memory 403, and a communication bus 404, where the processor 401, the communication interface 402, and the memory 403 complete mutual communication through the communication bus 404,
a memory 403 for storing a computer program;
the processor 401, when executing the program stored in the memory 403, implements the following steps:
obtaining a multi-dimensional characteristic parameter of a current alarm index;
determining the weight of each dimension characteristic according to the discrete degree of each dimension characteristic in the historical alarm indexes, and determining a score threshold value corresponding to each alarm grade according to the weight;
calculating to obtain the evaluation score of the current alarm index according to the multi-dimensional characteristic parameters and the weight;
determining the alarm grade corresponding to the current alarm index according to the evaluation score of the current alarm index and the score threshold;
and triggering abnormal alarm according to the alarm level corresponding to the current alarm index.
Optionally, the determining the weight of each dimensional feature according to the discrete degree of each dimensional feature in the historical alarm indicator includes:
and according to a preset period, determining the weight of each dimension characteristic according to the discrete degree of each dimension characteristic in the historical alarm index.
Optionally, the determining the weight of each dimensional feature according to the discrete degree of each dimensional feature in the historical alarm indicator includes:
determining a plurality of historical alarm indexes corresponding to the current alarm index;
obtaining multi-dimensional historical characteristic parameters of the plurality of historical alarm indexes;
and determining the dispersion degree of each dimension characteristic according to the multi-dimension historical characteristic parameters, and determining the weight of each dimension characteristic according to the dispersion degree.
Optionally, the determining the degree of dispersion of each dimensional feature according to the multi-dimensional historical feature parameter, and determining the weight of each dimensional feature according to the degree of dispersion, includes:
carrying out normalization processing on the multi-dimensional historical characteristic parameters to obtain normalized values;
calculating the probability of the multi-dimensional historical characteristic parameters according to the normalized numerical value;
calculating according to the probability to obtain entropy values of all the dimensional characteristics;
and determining the weight of each dimension characteristic according to the entropy value.
Optionally, the determining a score threshold corresponding to each alarm level according to the weight includes:
and determining a score threshold corresponding to each alarm grade according to the weight according to a preset alarm amount.
Optionally, the determining, according to the preset alarm amount and according to the weight, a score threshold corresponding to each alarm level includes:
calculating to obtain the evaluation scores of the plurality of historical alarm indexes according to the weight and the normalization value;
ranking the evaluation scores of the plurality of historical alarm indexes;
and determining a score threshold corresponding to each alarm grade according to the sorted evaluation scores and the preset alarm amount.
Optionally, the method further comprises:
and after the abnormal alarm is triggered, storing the multi-dimensional characteristic parameters of the current alarm index.
The communication bus mentioned in the above terminal may be a Peripheral Component Interconnect (PCI) bus, an Extended Industry Standard Architecture (EISA) bus, or the like. The communication bus may be divided into an address bus, a data bus, a control bus, etc. For ease of illustration, only one thick line is shown, but this does not mean that there is only one bus or one type of bus.
The communication interface is used for communication between the terminal and other equipment.
The Memory may include a Random Access Memory (RAM) or a non-volatile Memory (non-volatile Memory), such as at least one disk Memory. Optionally, the memory may also be at least one memory device located remotely from the processor.
The Processor may be a general-purpose Processor, and includes a Central Processing Unit (CPU), a Network Processor (NP), and the like; the Integrated Circuit may also be a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), a Field Programmable Gate Array (FPGA) or other Programmable logic device, a discrete Gate or transistor logic device, or a discrete hardware component.
In yet another embodiment of the present invention, a computer-readable storage medium is further provided, which has instructions stored therein, and when the instructions are executed on a computer, the computer is caused to execute the method for processing an alarm according to any one of the above embodiments.
In yet another embodiment, the present invention further provides a computer program product containing instructions which, when run on a computer, cause the computer to perform the method of alarm handling as described in any of the above embodiments.
In the above embodiments, the implementation may be wholly or partially realized by software, hardware, firmware, or any combination thereof. When implemented in software, may be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When loaded and executed on a computer, cause the processes or functions described in accordance with the embodiments of the invention to occur, in whole or in part. The computer may be a general purpose computer, a special purpose computer, a network of computers, or other programmable device. The computer instructions may be stored in a computer readable storage medium or transmitted from one computer readable storage medium to another, for example, from one website site, computer, server, or data center to another website site, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, Digital Subscriber Line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device, such as a server, a data center, etc., that incorporates one or more of the available media. The usable medium may be a magnetic medium (e.g., floppy Disk, hard Disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., Solid State Disk (SSD)), among others.
It is noted that, herein, relational terms such as first and second, and the like may be used solely to distinguish one entity or action from another entity or action without necessarily requiring or implying any actual such relationship or order between such entities or actions. Also, the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising an … …" does not exclude the presence of other identical elements in a process, method, article, or apparatus that comprises the element.
All the embodiments in the present specification are described in a related manner, and the same and similar parts among the embodiments may be referred to each other, and each embodiment focuses on the differences from the other embodiments. In particular, for the system embodiment, since it is substantially similar to the method embodiment, the description is simple, and for the relevant points, reference may be made to the partial description of the method embodiment.
The above description is only for the preferred embodiment of the present invention, and is not intended to limit the scope of the present invention. Any modification, equivalent replacement, or improvement made within the spirit and principle of the present invention shall fall within the protection scope of the present invention.
Claims (10)
1. An alarm processing method, comprising:
obtaining a multi-dimensional characteristic parameter of a current alarm index;
determining the weight of each dimension characteristic according to the discrete degree of each dimension characteristic in the historical alarm indexes, and determining a score threshold value corresponding to each alarm grade according to the weight;
calculating to obtain the evaluation score of the current alarm index according to the multi-dimensional characteristic parameters and the weight;
determining the alarm grade corresponding to the current alarm index according to the evaluation score of the current alarm index and the score threshold;
and triggering abnormal alarm according to the alarm level corresponding to the current alarm index.
2. The method according to claim 1, wherein the determining the weight of each dimensional feature according to the discrete degree of each dimensional feature in the historical alarm index comprises:
and according to a preset period, determining the weight of each dimension characteristic according to the discrete degree of each dimension characteristic in the historical alarm index.
3. The method according to claim 1 or 2, wherein the determining the weight of each dimension characteristic according to the discrete degree of each dimension characteristic in the historical alarm index comprises:
determining a plurality of historical alarm indexes corresponding to the current alarm index;
obtaining multi-dimensional historical characteristic parameters of the plurality of historical alarm indexes;
and determining the dispersion degree of each dimension characteristic according to the multi-dimension historical characteristic parameters, and determining the weight of each dimension characteristic according to the dispersion degree.
4. The method of claim 3, wherein the determining the degree of dispersion of each dimensional feature according to the multi-dimensional historical feature parameter and the determining the weight of each dimensional feature according to the degree of dispersion comprises:
carrying out normalization processing on the multi-dimensional historical characteristic parameters to obtain normalized values;
calculating the probability of the multi-dimensional historical characteristic parameters according to the normalized numerical value;
calculating according to the probability to obtain entropy values of all the dimensional characteristics;
and determining the weight of each dimension characteristic according to the entropy value.
5. The method of claim 4, wherein determining a score threshold corresponding to each alert level according to the weight comprises:
and determining a score threshold corresponding to each alarm grade according to the weight according to a preset alarm amount.
6. The method according to claim 5, wherein the determining the score threshold corresponding to each alarm level according to the weight according to the preset alarm amount comprises:
calculating to obtain the evaluation scores of the plurality of historical alarm indexes according to the weight and the normalization value;
ranking the evaluation scores of the plurality of historical alarm indexes;
and determining a score threshold corresponding to each alarm grade according to the sorted evaluation scores and the preset alarm amount.
7. The method of claim 1, further comprising:
and after the abnormal alarm is triggered, storing the multi-dimensional characteristic parameters of the current alarm index.
8. An alarm processing apparatus, comprising:
the characteristic acquisition module is used for acquiring multi-dimensional characteristic parameters of the current alarm indexes;
the weight determining module is used for determining the weight of each dimension characteristic according to the discrete degree of each dimension characteristic in the historical alarm indexes and determining a score threshold value corresponding to each alarm grade according to the weight;
the score calculation module is used for calculating and obtaining the evaluation score of the current alarm index according to the multi-dimensional characteristic parameters and the weight;
the grade determining module is used for determining the alarm grade corresponding to the current alarm index according to the evaluation score of the current alarm index and the score threshold;
and the alarm triggering module is used for triggering abnormal alarms according to the alarm level corresponding to the current alarm index.
9. An electronic device is characterized by comprising a processor, a communication interface, a memory and a communication bus, wherein the processor and the communication interface are used for realizing mutual communication by the memory through the communication bus;
a memory for storing a computer program;
a processor for implementing the method of any one of claims 1 to 7 when executing a program stored in the memory.
10. A computer-readable storage medium, on which a computer program is stored which, when being executed by a processor, carries out the method according to any one of claims 1-7.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202110336947.XA CN113079047B (en) | 2021-03-29 | 2021-03-29 | Alarm processing method and device |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202110336947.XA CN113079047B (en) | 2021-03-29 | 2021-03-29 | Alarm processing method and device |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN113079047A true CN113079047A (en) | 2021-07-06 |
| CN113079047B CN113079047B (en) | 2022-10-14 |
Family
ID=76611475
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202110336947.XA Active CN113079047B (en) | 2021-03-29 | 2021-03-29 | Alarm processing method and device |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN113079047B (en) |
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN113949590A (en) * | 2021-12-21 | 2022-01-18 | 济南市康养事业发展中心 | Method, system and terminal for determining safety alarm event level |
Citations (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN103856339A (en) * | 2012-12-04 | 2014-06-11 | 中国移动通信集团广西有限公司 | Method and device for compressing alarm information |
| WO2019080918A1 (en) * | 2017-10-26 | 2019-05-02 | 中兴通讯股份有限公司 | Method for suppressing redundant alarms, and network management device and storage medium |
| CN110855497A (en) * | 2019-11-19 | 2020-02-28 | 杭州安恒信息技术股份有限公司 | Alarm sequencing method and device based on big data environment |
| CN111338915A (en) * | 2020-05-15 | 2020-06-26 | 北京必示科技有限公司 | Dynamic alarm grading method and device, electronic equipment and storage medium |
| CN112347163A (en) * | 2020-11-26 | 2021-02-09 | 上海天旦网络科技发展有限公司 | High-dispersion SQL dynamic baseline warning method and system |
| CN112445685A (en) * | 2020-11-27 | 2021-03-05 | 平安普惠企业管理有限公司 | Method, device and storage medium for dynamically updating alarm threshold |
| CN112564988A (en) * | 2021-02-19 | 2021-03-26 | 腾讯科技（深圳）有限公司 | Alarm processing method and device and electronic equipment |
-
2021
- 2021-03-29 CN CN202110336947.XA patent/CN113079047B/en active Active
Patent Citations (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN103856339A (en) * | 2012-12-04 | 2014-06-11 | 中国移动通信集团广西有限公司 | Method and device for compressing alarm information |
| WO2019080918A1 (en) * | 2017-10-26 | 2019-05-02 | 中兴通讯股份有限公司 | Method for suppressing redundant alarms, and network management device and storage medium |
| CN110855497A (en) * | 2019-11-19 | 2020-02-28 | 杭州安恒信息技术股份有限公司 | Alarm sequencing method and device based on big data environment |
| CN111338915A (en) * | 2020-05-15 | 2020-06-26 | 北京必示科技有限公司 | Dynamic alarm grading method and device, electronic equipment and storage medium |
| CN112347163A (en) * | 2020-11-26 | 2021-02-09 | 上海天旦网络科技发展有限公司 | High-dispersion SQL dynamic baseline warning method and system |
| CN112445685A (en) * | 2020-11-27 | 2021-03-05 | 平安普惠企业管理有限公司 | Method, device and storage medium for dynamically updating alarm threshold |
| CN112564988A (en) * | 2021-02-19 | 2021-03-26 | 腾讯科技（深圳）有限公司 | Alarm processing method and device and electronic equipment |
Non-Patent Citations (1)
| Title |
|---|
| 李莉等: "基于用户偏好的权重搜索及告警选择方法", 《计算机工程》 * |
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN113949590A (en) * | 2021-12-21 | 2022-01-18 | 济南市康养事业发展中心 | Method, system and terminal for determining safety alarm event level |
Also Published As
| Publication number | Publication date |
|---|---|
| CN113079047B (en) | 2022-10-14 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN111143102B (en) | Abnormal data detection method and device, storage medium and electronic equipment | |
| CN110086649A (en) | Detection method, device, computer equipment and the storage medium of abnormal flow | |
| US20180107528A1 (en) | Aggregation based event identification | |
| CN112596990B (en) | Alarm storm processing method and device and terminal equipment | |
| Waidyanatha | Towards a typology of integrated functional early warning systems | |
| CN110830438A (en) | Abnormal log warning method and device and electronic equipment | |
| CN110083475B (en) | Abnormal data detection method and device | |
| CN108535759B (en) | Remote radiation protection monitoring method, device and system for million-kilowatt nuclear power station | |
| CN114444827B (en) | Cluster performance evaluation method and device | |
| CN110728525B (en) | Delimitation processing method and device for network batch user complaints | |
| CN113079047B (en) | Alarm processing method and device | |
| CN115188485A (en) | User demand analysis method and system based on intelligent medical big data | |
| CN112765161A (en) | Alarm rule matching method and device, electronic equipment and storage medium | |
| CN114399321A (en) | Business system stability analysis method, device and equipment | |
| CN112988512A (en) | Method, device and equipment for detecting time sequence data abnormity and storage medium | |
| CN112988521B (en) | Alarm method, device, equipment and storage medium | |
| CN115174233A (en) | Network security analysis method, device, system and medium based on big data | |
| CN115081969A (en) | Abnormal data determination method and related device | |
| CN109976986B (en) | Abnormal equipment detection method and device | |
| CN110414591A (en) | A kind of data processing method and equipment | |
| CN110955581A (en) | Online software abnormity warning method and device, electronic equipment and storage medium | |
| CN112152833A (en) | Network abnormity alarm method and device and electronic equipment | |
| CN111783883A (en) | Abnormal data detection method and device | |
| CN112100037B (en) | Alarm level identification method, device, electronic equipment and storage medium | |
| CN116090902A (en) | Remote farmland monitoring method and system |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |