CN113780597A - Influence propagation relation model construction and alarm influence evaluation method, computer equipment and storage medium - Google Patents
Influence propagation relation model construction and alarm influence evaluation method, computer equipment and storage medium Download PDFInfo
- Publication number
- CN113780597A CN113780597A CN202111086898.5A CN202111086898A CN113780597A CN 113780597 A CN113780597 A CN 113780597A CN 202111086898 A CN202111086898 A CN 202111086898A CN 113780597 A CN113780597 A CN 113780597A
- Authority
- CN
- China
- Prior art keywords
- alarm
- template
- root cause
- alarm template
- node
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q10/00—Administration; Management
- G06Q10/20—Administration of product repair or maintenance
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/30—Monitoring
- G06F11/32—Monitoring with visual or acoustical indication of the functioning of the machine
- G06F11/324—Display of status information
- G06F11/327—Alarm or error message display
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N7/00—Computing arrangements based on specific mathematical models
- G06N7/01—Probabilistic graphical models, e.g. probabilistic networks
Abstract
The application provides an influence propagation relation model construction method, an alarm influence evaluation method, computer equipment and a storage medium, wherein the influence propagation relation model construction method comprises the following steps: determining a root cause alarm template, a secondary root cause alarm template, a tail end alarm template and an independent alarm template according to the alarm work order; constructing a state quantity Q ═ R, M, L and S } according to the root cause alarm template, the secondary root cause alarm template, the tail end alarm template and the independent alarm template; constructing an observation set V, wherein the observation set V comprises a plurality of reference alarm templates; and training the hidden Markov model according to a preset training algorithm based on the observation set V and the state quantity Q. The influence propagation relation model based on training is obtained, and the subsequent influence corresponding to the alarm generated by the equipment can be evaluated to determine the influence degree, so that the operation and maintenance efficiency is effectively improved.
Description
Technical Field
The application relates to the field of equipment operation and maintenance, in particular to an influence propagation relation model construction and alarm influence evaluation method, computer equipment and a storage medium.
Background
In the operation and maintenance process of the equipment, the subsequent influence caused by the alarm generated when the equipment works abnormally needs to be evaluated, at present, the subsequent influence caused by the alarm is evaluated manually, and the problem of low operation and maintenance efficiency is solved by the method.
Disclosure of Invention
An object of the embodiments of the present application is to provide an influence propagation relationship model building and alarm influence evaluation method, a computer device, and a storage medium, which are used to evaluate subsequent influences corresponding to an alarm generated by a device to determine an influence degree, thereby effectively improving operation and maintenance efficiency.
To this end, the present application discloses in a first aspect a method for constructing an influence propagation relationship model, the method including:
acquiring an alarm work order;
determining a root cause alarm template, a secondary root cause alarm template, a tail end alarm template and an independent alarm template according to the alarm work order;
constructing a state quantity Q ═ R, M, L and S } according to the root cause alarm template, the secondary root cause alarm template, the tail end alarm template and the independent alarm template, wherein R represents the root cause alarm template, M represents the secondary root cause alarm template, L represents the tail end alarm template and S represents the independent alarm template;
constructing an observation set V, wherein the observation set V comprises a plurality of reference alarm templates;
training an initial state probability vector pi, a state transition probability matrix A and an observation probability matrix B of the hidden Markov model according to a preset training algorithm based on the observation set V and the state quantity Q, wherein the initial state probability vector pi represents the occurrence probability of the initial time state of the hidden Markov model, the state transition probability matrix A represents the probability that one state in the state quantity Q is converted into another state, and the observation probability matrix B represents the probability that one state in the state quantity Q belongs to the state in the observation set V.
In the embodiment of the application, the alarm information in the alarm work order may be triggered by the same event or belong to the same service system, so that the alarm information in the alarm work order has an incidence relation, that is, according to time sequencing, all the alarm work orders in the alarm work order are in a chain, and the chain can be used as an influence propagation chain for representing an influence propagation path of an alarm, so that the influence propagation path of the hidden markov learning alarm can be trained through the alarm work order, and an initial state probability vector pi, a state transition probability matrix a and an observation probability matrix B are obtained.
On the other hand, because the alarm information in the alarm work order has the incidence relation, the topological structure between the alarms does not need to be separated when the hidden Markov model is trained.
In the first aspect of the present application, as an optional implementation manner, the determining a root cause alarm template, a secondary root cause alarm template, a terminal alarm template, and an independent alarm template according to an alarm work order includes:
determining root cause node warning information, secondary root cause node warning information, tail end node warning information and independent node warning information from the warning information in the warning work order, wherein the root cause node warning information, the secondary root cause node warning information, the tail end node warning information and the independent node warning information are sequenced according to time to form an influence relation chain;
and matching the root cause node alarm information, the secondary root cause node alarm information, the tail end node alarm information and the alarm template of the independent node alarm information in the alarm template library in sequence to obtain the root cause alarm template, the secondary root cause alarm template, the tail end alarm template and the independent alarm template.
In this optional embodiment, a root cause alarm template, a secondary root cause alarm template, a terminal alarm template, and an independent alarm template can be obtained through an alarm template library, where the root cause alarm template, the secondary root cause alarm template, the terminal alarm template, and the independent alarm template organize root cause node alarm information, the secondary root cause node alarm information, the terminal node alarm information, and the independent node alarm information in a template form, so as to facilitate reading of the content of a certain field in the alarm template during calculation.
In the first aspect of the present application, as an optional implementation, the method further includes:
when the template of the root cause node alarm information does not exist in the alarm template library, generating the root cause alarm template according to the root cause node alarm information;
when the template of the secondary root cause node alarm information does not exist in the alarm template library, generating the secondary root cause alarm template according to the secondary root cause node alarm information;
when the template of the terminal node alarm information does not exist in the alarm template library, generating the terminal alarm template according to the terminal node alarm information;
and when the template of the independent node alarm information does not exist in the alarm template library, generating the independent alarm template according to the independent node alarm information.
In the optional embodiment, when the alarm template of root cause node alarm information, secondary root cause node alarm information, end node alarm information and independent node alarm information does not exist in the alarm template library, a new alarm template can be generated so as to be convenient for subsequent multiplexing of the template.
In the first aspect of the present application, as an optional implementation manner, the preset training algorithm is a Viterbi algorithm.
In this alternative embodiment, the initial state probability vector pi, the state transition probability matrix a, and the observation probability matrix B of the hidden markov model can be solved by the Viterbi algorithm.
A second aspect of the present application discloses an alarm impact evaluation method, including:
acquiring target alarm data generated when equipment works abnormally;
and calculating an influence evaluation result of the target alarm data according to the target alarm data and an influence propagation relation model, wherein the influence propagation relation model is constructed according to the method of the first aspect of the application.
According to the method of the second aspect of the application, the influence propagation relation model constructed by the method of the first aspect of the application can evaluate influence which may be caused by the target alarm data aiming at the target alarm data generated when the equipment works abnormally, so that operation and maintenance are facilitated, and the operation and maintenance efficiency is improved. On the other hand, the IP related to each other can be inferred by using the influence propagation relation model, the result can be used as a simple topological structure and a call chain, and therefore, the influence evaluation model based on the IP can also be used for checking whether the business logic or the topological structure is changed.
In the second aspect of the present application, as an optional implementation manner, the calculating an influence evaluation result of the target alarm data according to the target alarm data and the influence propagation relationship model includes:
matching an alarm template of the target alarm data;
and calculating the influence evaluation result of the target alarm data according to the alarm template and the influence propagation relation model of the target alarm data.
In this optional embodiment, the impact evaluation result of the target alarm data may be calculated by using the alarm template of the target alarm data.
A third aspect of the present application discloses an influence propagation relationship model construction apparatus, the apparatus including:
the first acquisition module is used for acquiring an alarm work order;
the determining module is used for determining a root cause alarm template, a secondary root cause alarm template, a tail end alarm template and an independent alarm template according to the alarm work order;
a first constructing module, configured to construct, according to the root cause alarm template, the secondary root cause alarm template, the terminal alarm template, and the independent alarm template, a state quantity Q ═ { R, M, L, S }, where R denotes the root cause alarm template, M denotes the secondary root cause alarm template, L denotes the terminal alarm template, and S denotes the independent alarm template;
the second construction module is used for constructing an observation set V, and the observation set V comprises a plurality of reference alarm templates;
the training module is used for training an initial state probability vector pi, a state transition probability matrix A and an observation probability matrix B of the hidden Markov model according to a preset training algorithm based on the observation set V and the state quantity Q, wherein the initial state probability vector pi represents the occurrence probability of the initial time state of the hidden Markov model, the state transition probability matrix A represents the probability that one state in the state quantity Q is converted into another state, and the observation probability matrix B represents the probability that one state in the state quantity Q belongs to the state in the observation set V.
The device can obtain the influence propagation relation model for influence evaluation by executing the influence propagation relation model construction method.
The fourth aspect of the present application discloses an alarm influence evaluation device, the device comprising:
the second acquisition module is used for acquiring target alarm data generated when the equipment works abnormally;
a calculation module, configured to calculate an impact evaluation result of the target alarm data according to the target alarm data and an impact propagation relationship model, where the impact propagation relationship model is constructed according to the method in claims 1-4.
The device of the application can evaluate which influences may be caused by the target alarm data aiming at the target alarm data generated when the equipment works abnormally, and then is convenient for operation and maintenance, thereby improving the operation and maintenance efficiency. On the other hand, the IP related to each other can be inferred by using the influence propagation relation model, the result can be used as a simple topological structure and a call chain, and therefore, the influence evaluation model based on the IP can also be used for checking whether the business logic or the topological structure is changed.
A fifth aspect of the present application discloses a computer device, comprising:
a processor; and
a memory configured to store machine readable instructions which, when executed by the processor, perform the impact propagation relationship model construction method of the first aspect of the application and the alarm impact assessment method of the second aspect of the application.
The computer equipment can evaluate which influences may be caused by the target alarm data aiming at the target alarm data generated when the equipment works abnormally, and is convenient for operation and maintenance, so that the operation and maintenance efficiency is improved. On the other hand, the IP related to each other can be inferred by using the influence propagation relation model, the result can be used as a simple topological structure and a call chain, and therefore, the influence evaluation model based on the IP can also be used for checking whether the business logic or the topological structure is changed.
A sixth aspect of the present application discloses a storage medium storing a computer program executed by a processor to perform the influence propagation relation model construction method of the first aspect of the present application and the alarm influence evaluation method of the second aspect of the present application.
The storage medium can evaluate which influences may be caused by the target alarm data aiming at the target alarm data generated when the equipment works abnormally, and then operation and maintenance are facilitated, so that the operation and maintenance efficiency is improved. On the other hand, the IP related to each other can be inferred by using the influence propagation relation model, the result can be used as a simple topological structure and a call chain, and therefore, the influence evaluation model based on the IP can also be used for checking whether the business logic or the topological structure is changed.
Drawings
In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings that are required to be used in the embodiments of the present application will be briefly described below, it should be understood that the following drawings only illustrate some embodiments of the present application and therefore should not be considered as limiting the scope, and that those skilled in the art can also obtain other related drawings based on the drawings without inventive efforts.
FIG. 1 is a schematic flow chart diagram illustrating a method for constructing an influence propagation relation model according to an embodiment of the present disclosure;
fig. 2 is a schematic flow chart of an alarm impact evaluation method disclosed in the embodiment of the present application;
fig. 3 is a schematic structural diagram of an impact propagation relation model building apparatus disclosed in an embodiment of the present application;
fig. 4 is a schematic structural diagram of an alarm influence evaluation apparatus disclosed in an embodiment of the present application;
fig. 5 is a schematic structural diagram of a computer device disclosed in an embodiment of the present application.
Detailed Description
The technical solutions in the embodiments of the present application will be described below with reference to the drawings in the embodiments of the present application.
Example one
Referring to fig. 1, fig. 1 is a schematic flowchart illustrating a method for constructing an influence propagation relation model according to an embodiment of the present application. As shown in fig. 1, the method of the embodiment of the present application includes the following steps:
101. acquiring an alarm work order;
102. determining a root cause alarm template, a secondary root cause alarm template, a tail end alarm template and an independent alarm template according to the alarm work order;
103. constructing a state quantity Q (R, M, L, S) according to the root cause alarm template, the secondary root cause alarm template, the tail end alarm template and the independent alarm template, wherein R represents the root cause alarm template, M represents the secondary root cause alarm template, L represents the tail end alarm template and S represents the independent alarm template;
104. constructing an observation set V, wherein the observation set V comprises a plurality of reference alarm templates;
105. based on the observation set V and the state quantity Q, training an initial state probability vector pi, a state transition probability matrix A and an observation probability matrix B of the hidden Markov model according to a preset training algorithm, wherein the initial state probability vector pi represents the occurrence probability of the initial time state of the hidden Markov model, the state transition probability matrix A represents the probability that one state in the state quantity Q is converted into another state, and the observation probability matrix B represents the probability that one state in the state quantity Q belongs to the state in the observation set V.
In the embodiment of the application, the alarm information in the alarm work order may be triggered by the same event or belong to the same service system, so that the alarm information in the alarm work order has an incidence relation, that is, according to time sequencing, all the alarm work orders in the alarm work order are in a chain, and the chain can be used as an influence propagation chain for representing an influence propagation path of an alarm, so that the influence propagation path of the hidden markov learning alarm can be trained through the alarm work order, and an initial state probability vector pi, a state transition probability matrix a and an observation probability matrix B are obtained.
On the other hand, because the alarm information in the alarm work order has the incidence relation, the topological structure between the alarms does not need to be separated when the hidden Markov model is trained.
In this embodiment of the present application, optionally, H alarm templates are shared in the observation set V, where the alarm templates in the observation set V may be obtained from an alarm template library.
In the embodiments of the present application, it is possible, optionally,
in the embodiment of the present application, as an optional implementation manner, step 102: determining a root cause alarm template, a secondary root cause alarm template, a tail end alarm template and an independent alarm template according to the alarm work order, and comprising the following substeps:
determining root cause node warning information, secondary root cause node warning information, tail end node warning information and independent node warning information from the warning information in the warning work order, and sequencing the root cause node warning information, the secondary root cause node warning information, the tail end node warning information and the independent node warning information according to time to form an influence relation chain;
and matching the alarm templates of root cause node alarm information, secondary root cause node alarm information, tail end node alarm information and independent node alarm information in the alarm template library in sequence to obtain a root cause alarm template, a secondary root cause alarm template, a tail end alarm template and an independent alarm template.
In this optional embodiment, the root cause alarm template, the secondary root cause alarm template, the end alarm template, and the independent alarm template can be obtained through the alarm template library, where the root cause alarm template, the secondary root cause alarm template, the end alarm template, and the independent alarm template organize the root cause node alarm information, the secondary root cause node alarm information, the end node alarm information, and the independent node alarm information in the form of templates, so as to facilitate reading the content of a certain field in the alarm template during calculation.
In the embodiment of the present application, as an optional implementation manner, the method of the embodiment of the present application further includes the following steps:
when the template of root cause node alarm information does not exist in the alarm template library, generating a root cause alarm template according to the root cause node alarm information;
when the template of the secondary root cause node alarm information does not exist in the alarm template library, generating a secondary root cause alarm template according to the secondary root cause node alarm information;
when the template of the terminal node alarm information does not exist in the alarm template library, generating a terminal alarm template according to the terminal node alarm information;
and when the template of the independent node alarm information does not exist in the alarm template library, generating an independent alarm template according to the independent node alarm information.
In the optional embodiment, when the alarm template of root cause node alarm information, secondary root cause node alarm information, end node alarm information and independent node alarm information does not exist in the alarm template library, a new alarm template can be generated so as to be convenient for subsequent multiplexing of the template.
In the embodiment of the present application, as an optional implementation manner, the preset training algorithm is a Viterbi algorithm.
In this alternative embodiment, the initial state probability vector pi, the state transition probability matrix a, and the observation probability matrix B of the hidden markov model can be solved by the Viterbi algorithm.
Example two
Referring to fig. 2, fig. 2 is a schematic flow chart illustrating an alarm impact evaluation method according to an embodiment of the present application. As shown in fig. 2, the method of the embodiment of the present application includes the following steps:
201. acquiring target alarm data generated when equipment works abnormally;
202. and calculating an influence evaluation result of the target alarm data according to the target alarm data and the influence propagation relation model, wherein the influence propagation relation model is constructed according to the method in the first embodiment of the application.
According to the method provided by the embodiment of the application, the influence propagation relation model constructed by the method provided by the embodiment of the application can be used for evaluating the influence possibly caused by the target alarm data aiming at the target alarm data generated when the equipment works abnormally, so that the operation and maintenance are facilitated, and the operation and maintenance efficiency is improved. On the other hand, the IP related to each other can be inferred by using the influence propagation relation model, the result can be used as a simple topological structure and a call chain, and therefore, the influence evaluation model based on the IP can also be used for checking whether the business logic or the topological structure is changed.
In the embodiment of the present application, as an optional implementation manner, step 202: calculating the influence evaluation result of the target alarm data according to the target alarm data and the influence propagation relation model, and comprising the following substeps:
matching an alarm template of the target alarm data;
and calculating the influence evaluation result of the target alarm data according to the alarm template and the influence propagation relation model of the target alarm data.
In this optional embodiment, the impact evaluation result of the target alarm data may be calculated by using the alarm template of the target alarm data.
EXAMPLE III
Referring to fig. 3, fig. 3 is a schematic structural diagram of an impact propagation relation model construction device according to an embodiment of the present application. As shown in fig. 3, the apparatus of the embodiment of the present application includes:
a first obtaining module 301, configured to obtain an alarm work order;
a determining module 302, configured to determine a root cause alarm template, a secondary root cause alarm template, a tail end alarm template, and an independent alarm template according to the alarm work order;
a first constructing module 303, configured to construct, according to the root cause alarm template, the secondary root cause alarm template, the terminal alarm template, and the independent alarm template, a state quantity Q ═ R, M, L, S }, where R denotes the root cause alarm template, M denotes the secondary root cause alarm template, L denotes the terminal alarm template, and S denotes the independent alarm template;
a second construction module 304, configured to construct an observation set V, where the observation set V includes a plurality of reference alarm templates;
a training module 305, configured to train an initial state probability vector pi of the hidden markov model, a state transition probability matrix a, and an observation probability matrix B according to a preset training algorithm based on the observation set V and the state quantity Q, where the initial state probability vector pi represents an occurrence probability of an initial time state of the hidden markov model, the state transition probability matrix a represents a probability that one state in the state quantity Q is converted into another state, and the observation probability matrix B represents a probability that one state in the state quantity Q belongs to a state in the observation set V.
The device of the embodiment of the application can obtain the influence propagation relation model which can be used for influence evaluation by executing the influence propagation relation model building method.
Example four
Referring to fig. 4, fig. 4 is a schematic structural diagram of an alarm impact evaluation device disclosed in the embodiment of the present application. As shown in fig. 4, the apparatus of the embodiment of the present application includes:
a second obtaining module 401, configured to obtain target alarm data generated when the device is abnormal in operation;
a calculating module 402, configured to calculate an impact evaluation result of the target alarm data according to the target alarm data and the impact propagation relationship model, where the impact propagation relationship model is constructed according to the method in claims 1-4.
The device of the embodiment of the application can evaluate which influences may be caused by the target alarm data aiming at the target alarm data generated when the equipment works abnormally, and then is convenient for operation and maintenance, thereby improving the operation and maintenance efficiency. On the other hand, the IP related to each other can be inferred by using the influence propagation relation model, the result can be used as a simple topological structure and a call chain, and therefore, the influence evaluation model based on the IP can also be used for checking whether the business logic or the topological structure is changed.
EXAMPLE five
Referring to fig. 5, fig. 5 is a schematic structural diagram of a computer device according to an embodiment of the present disclosure. As shown in fig. 5, the computer device of the embodiment of the present application includes:
a processor 501; and
the memory 502 is configured to store machine 502 readable instructions, and the instructions, when executed by the processor 501, perform the impact propagation relation model construction method according to the first embodiment of the present application and the alarm impact evaluation method according to the second embodiment of the present application.
The computer equipment can evaluate which influences may be caused by the target alarm data aiming at the target alarm data generated when the equipment works abnormally, and is convenient for operation and maintenance, so that the operation and maintenance efficiency is improved. On the other hand, the IP related to each other can be inferred by using the influence propagation relation model, the result can be used as a simple topological structure and a call chain, and therefore, the influence evaluation model based on the IP can also be used for checking whether the business logic or the topological structure is changed.
EXAMPLE six
The embodiment of the application discloses a storage medium, wherein a computer program is stored in the storage medium, and the computer program is executed by a processor to implement the influence propagation relation model construction method of the first embodiment of the application and the alarm influence evaluation method of the second embodiment of the application.
The storage medium of the embodiment of the application can evaluate the influence possibly caused by the target alarm data aiming at the target alarm data generated when the equipment works abnormally, and is convenient for operation and maintenance, so that the operation and maintenance efficiency is improved. On the other hand, the IP related to each other can be inferred by using the influence propagation relation model, the result can be used as a simple topological structure and a call chain, and therefore, the influence evaluation model based on the IP can also be used for checking whether the business logic or the topological structure is changed.
In the embodiments provided in the present application, it should be understood that the disclosed apparatus and method may be implemented in other ways. The above-described embodiments of the apparatus are merely illustrative, and for example, the division of the units is only one logical division, and there may be other divisions when actually implemented, and for example, a plurality of units or components may be combined or integrated into another system, or some features may be omitted, or not executed. In addition, the shown or discussed mutual coupling or direct coupling or communication connection may be an indirect coupling or communication connection of devices or units through some communication interfaces, and may be in an electrical, mechanical or other form.
In addition, units described as separate parts may or may not be physically separate, and parts displayed as units may or may not be physical units, may be located in one place, or may be distributed on a plurality of network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of the embodiment.
Furthermore, the functional modules in the embodiments of the present application may be integrated together to form an independent part, or each module may exist separately, or two or more modules may be integrated to form an independent part.
It should be noted that the functions, if implemented in the form of software functional modules and sold or used as independent products, may be stored in a computer readable storage medium. Based on such understanding, the technical solution of the present application or portions thereof that substantially contribute to the prior art may be embodied in the form of a software product stored in a storage medium and including instructions for causing a computer device (which may be a personal computer, a server, or a network device) to execute all or part of the steps of the method according to the embodiments of the present application. And the aforementioned storage medium includes: various media capable of storing program codes, such as a usb disk, a removable hard disk, a Read-Only Memory (ROM), a Random Access Memory (RAM), a magnetic disk, or an optical disk.
In this document, relational terms such as first and second, and the like may be used solely to distinguish one entity or action from another entity or action without necessarily requiring or implying any actual such relationship or order between such entities or actions.
The above description is only an example of the present application and is not intended to limit the scope of the present application, and various modifications and changes may be made by those skilled in the art. Any modification, equivalent replacement, improvement and the like made within the spirit and principle of the present application shall be included in the protection scope of the present application.
Claims (10)
1. A method for constructing an influence propagation relationship model, the method comprising:
acquiring an alarm work order;
determining a root cause alarm template, a secondary root cause alarm template, a tail end alarm template and an independent alarm template according to the alarm work order;
constructing a state quantity Q ═ R, M, L and S } according to the root cause alarm template, the secondary root cause alarm template, the tail end alarm template and the independent alarm template, wherein R represents the root cause alarm template, M represents the secondary root cause alarm template, L represents the tail end alarm template and S represents the independent alarm template;
constructing an observation set V, wherein the observation set V comprises a plurality of reference alarm templates;
training an initial state probability vector pi, a state transition probability matrix A and an observation probability matrix B of the hidden Markov model according to a preset training algorithm based on the observation set V and the state quantity Q, wherein the initial state probability vector pi represents the occurrence probability of the initial time state of the hidden Markov model, the state transition probability matrix A represents the probability that one state in the state quantity Q is converted into another state, and the observation probability matrix B represents the probability that one state in the state quantity Q belongs to the state in the observation set V.
2. The method of claim 1, wherein said determining a root cause alarm template, a secondary root cause alarm template, a terminal alarm template, an independent alarm template from an alarm work order comprises:
determining root cause node warning information, secondary root cause node warning information, tail end node warning information and independent node warning information from the warning information in the warning work order, wherein the root cause node warning information, the secondary root cause node warning information, the tail end node warning information and the independent node warning information are sequenced according to time to form an influence relation chain;
and matching the root cause node alarm information, the secondary root cause node alarm information, the tail end node alarm information and the alarm template of the independent node alarm information in the alarm template library in sequence to obtain the root cause alarm template, the secondary root cause alarm template, the tail end alarm template and the independent alarm template.
3. The method of claim 2, wherein the method further comprises:
when the template of the root cause node alarm information does not exist in the alarm template library, generating the root cause alarm template according to the root cause node alarm information;
when the template of the secondary root cause node alarm information does not exist in the alarm template library, generating the secondary root cause alarm template according to the secondary root cause node alarm information;
when the template of the terminal node alarm information does not exist in the alarm template library, generating the terminal alarm template according to the terminal node alarm information;
and when the template of the independent node alarm information does not exist in the alarm template library, generating the independent alarm template according to the independent node alarm information.
4. The method of claim 2, wherein the predetermined training algorithm is a Viterbi algorithm.
5. An alarm impact evaluation method, the method comprising:
acquiring target alarm data generated when equipment works abnormally;
calculating an impact evaluation result of the target alarm data according to the target alarm data and an impact propagation relation model, wherein the impact propagation relation model is constructed according to the method of claims 1-4.
6. The method of claim 5, wherein said calculating an impact evaluation result for said target alarm data based on said target alarm data and an impact propagation relationship model comprises:
matching an alarm template of the target alarm data;
and calculating the influence evaluation result of the target alarm data according to the alarm template and the influence propagation relation model of the target alarm data.
7. An influence propagation relationship model construction apparatus, characterized in that the apparatus comprises:
the first acquisition module is used for acquiring an alarm work order;
the determining module is used for determining a root cause alarm template, a secondary root cause alarm template, a tail end alarm template and an independent alarm template according to the alarm work order;
a first constructing module, configured to construct, according to the root cause alarm template, the secondary root cause alarm template, the terminal alarm template, and the independent alarm template, a state quantity Q ═ { R, M, L, S }, where R denotes the root cause alarm template, M denotes the secondary root cause alarm template, L denotes the terminal alarm template, and S denotes the independent alarm template;
the second construction module is used for constructing an observation set V, and the observation set V comprises a plurality of reference alarm templates;
the training module is used for training an initial state probability vector pi, a state transition probability matrix A and an observation probability matrix B of the hidden Markov model according to a preset training algorithm based on the observation set V and the state quantity Q, wherein the initial state probability vector pi represents the occurrence probability of the initial time state of the hidden Markov model, the state transition probability matrix A represents the probability that one state in the state quantity Q is converted into another state, and the observation probability matrix B represents the probability that one state in the state quantity Q belongs to the state in the observation set V.
8. An alarm impact evaluation apparatus, characterized in that the apparatus comprises:
the second acquisition module is used for acquiring target alarm data generated when the equipment works abnormally;
a calculation module, configured to calculate an impact evaluation result of the target alarm data according to the target alarm data and an impact propagation relationship model, where the impact propagation relationship model is constructed according to the method in claims 1-4.
9. A computer device, comprising:
a processor; and
a memory configured to store machine readable instructions which, when executed by the processor, perform the impact propagation relationship model building method of any one of claims 1-4 and the alarm impact assessment method of any one of claims 5-6.
10. A storage medium, characterized in that the storage medium stores a computer program which is executed by a processor to execute the influence propagation relation model construction method according to any one of claims 1 to 4 and the alarm influence evaluation method according to any one of claims 5 to 6.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202111086898.5A CN113780597B (en) | 2021-09-16 | 2021-09-16 | Influence propagation relation model construction and alarm influence evaluation method, computer equipment and storage medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202111086898.5A CN113780597B (en) | 2021-09-16 | 2021-09-16 | Influence propagation relation model construction and alarm influence evaluation method, computer equipment and storage medium |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN113780597A true CN113780597A (en) | 2021-12-10 |
| CN113780597B CN113780597B (en) | 2023-04-07 |
Family
ID=78851572
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202111086898.5A Active CN113780597B (en) | 2021-09-16 | 2021-09-16 | Influence propagation relation model construction and alarm influence evaluation method, computer equipment and storage medium |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN113780597B (en) |
Citations (8)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN108880915A (en) * | 2018-08-20 | 2018-11-23 | 全球能源互联网研究院有限公司 | A kind of information network security of power system warning information wrong report determination method and system |
| CN110351118A (en) * | 2019-05-28 | 2019-10-18 | 华为技术有限公司 | Root is because of alarm decision networks construction method, device and storage medium |
| CN111124840A (en) * | 2019-12-02 | 2020-05-08 | 北京天元创新科技有限公司 | Method and device for predicting alarm in business operation and maintenance and electronic equipment |
| CN111726248A (en) * | 2020-05-29 | 2020-09-29 | 北京宝兰德软件股份有限公司 | Alarm root cause positioning method and device |
| WO2020215894A1 (en) * | 2019-04-25 | 2020-10-29 | 深圳前海微众银行股份有限公司 | Alarm method, device and system |
| CN111897673A (en) * | 2020-07-31 | 2020-11-06 | 平安科技（深圳）有限公司 | Operation and maintenance fault root cause identification method and device, computer equipment and storage medium |
| CN112003718A (en) * | 2020-09-25 | 2020-11-27 | 南京邮电大学 | Network alarm positioning method based on deep learning |
| CN112087334A (en) * | 2020-09-09 | 2020-12-15 | 中移（杭州）信息技术有限公司 | Alarm root cause analysis method, electronic device and storage medium |
-
2021
- 2021-09-16 CN CN202111086898.5A patent/CN113780597B/en active Active
Patent Citations (8)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN108880915A (en) * | 2018-08-20 | 2018-11-23 | 全球能源互联网研究院有限公司 | A kind of information network security of power system warning information wrong report determination method and system |
| WO2020215894A1 (en) * | 2019-04-25 | 2020-10-29 | 深圳前海微众银行股份有限公司 | Alarm method, device and system |
| CN110351118A (en) * | 2019-05-28 | 2019-10-18 | 华为技术有限公司 | Root is because of alarm decision networks construction method, device and storage medium |
| CN111124840A (en) * | 2019-12-02 | 2020-05-08 | 北京天元创新科技有限公司 | Method and device for predicting alarm in business operation and maintenance and electronic equipment |
| CN111726248A (en) * | 2020-05-29 | 2020-09-29 | 北京宝兰德软件股份有限公司 | Alarm root cause positioning method and device |
| CN111897673A (en) * | 2020-07-31 | 2020-11-06 | 平安科技（深圳）有限公司 | Operation and maintenance fault root cause identification method and device, computer equipment and storage medium |
| CN112087334A (en) * | 2020-09-09 | 2020-12-15 | 中移（杭州）信息技术有限公司 | Alarm root cause analysis method, electronic device and storage medium |
| CN112003718A (en) * | 2020-09-25 | 2020-11-27 | 南京邮电大学 | Network alarm positioning method based on deep learning |
Non-Patent Citations (1)
| Title |
|---|
| 丁宏 等: "《基于机器学习的通信网告警关联分析综述》", 《东方电气评论》 * |
Also Published As
| Publication number | Publication date |
|---|---|
| CN113780597B (en) | 2023-04-07 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN106951925B (en) | Data processing method, device, server and system | |
| CN112152852B (en) | Root cause analysis method, device, equipment and computer storage medium | |
| JP6780655B2 (en) | Log analysis system, method and program | |
| CN112258303A (en) | Surrounding string mark early warning analysis method and device, electronic equipment and storage medium | |
| CN111913824A (en) | Method for determining data link fault reason and related equipment | |
| CN109711849B (en) | Ether house address portrait generation method and device, electronic equipment and storage medium | |
| CN116629988A (en) | Bid data processing method and device based on blockchain | |
| CN110704699A (en) | Data image construction method and device, computer equipment and storage medium | |
| CN112036185B (en) | Method and device for constructing named entity recognition model based on industrial enterprise | |
| CN112613176A (en) | Slow SQL statement prediction method and system | |
| CN113780597B (en) | Influence propagation relation model construction and alarm influence evaluation method, computer equipment and storage medium | |
| CN108073464A (en) | A kind of time series data abnormal point detecting method and device based on speed and acceleration | |
| CN112612810A (en) | Slow SQL statement identification method and system | |
| CN112598226B (en) | Equipment checking method, device, equipment and storage medium | |
| CN109815109B (en) | Data mode change detection method, device, equipment and readable storage medium | |
| CN113705201A (en) | Text-based event probability prediction evaluation algorithm, electronic device and storage medium | |
| CN113535458A (en) | Abnormal false alarm processing method and device, storage medium and terminal | |
| CN115174276B (en) | Competitive industrial control system vulnerability mining method and system | |
| CN114756401B (en) | Abnormal node detection method, device, equipment and medium based on log | |
| CN115758135B (en) | Track traffic signal system function demand tracing method and device and electronic equipment | |
| CN113190623B (en) | Data processing method, device, server and storage medium | |
| CN116823164A (en) | Business approval method, device, equipment and storage medium | |
| JP2010282416A (en) | Section data-recommending method, program, and device | |
| CN116974801A (en) | Transaction link abnormality analysis method and device, storage medium and computer equipment | |
| CN117151479A (en) | Engineering audit risk tracing method, device and medium based on fault tree model |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |