CN114238013A - Alarm aggregation method, device, equipment and storage medium - Google Patents
Alarm aggregation method, device, equipment and storage medium Download PDFInfo
- Publication number
- CN114238013A CN114238013A CN202111467483.2A CN202111467483A CN114238013A CN 114238013 A CN114238013 A CN 114238013A CN 202111467483 A CN202111467483 A CN 202111467483A CN 114238013 A CN114238013 A CN 114238013A
- Authority
- CN
- China
- Prior art keywords
- alarm
- event
- alarm event
- time sequence
- accompanying
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/30—Monitoring
- G06F11/3065—Monitoring arrangements determined by the means or processing involved in reporting the monitored data
- G06F11/3072—Monitoring arrangements determined by the means or processing involved in reporting the monitored data where the reporting involves data filtering, e.g. pattern matching, time or event triggered, adaptive or policy-based reporting
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/24—Classification techniques
- G06F18/243—Classification techniques relating to the number of classes
- G06F18/2433—Single-class perspective, e.g. one-against-all classification; Novelty detection; Outlier detection
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Physics & Mathematics (AREA)
- Computer Vision & Pattern Recognition (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Data Mining & Analysis (AREA)
- Artificial Intelligence (AREA)
- Bioinformatics & Cheminformatics (AREA)
- Bioinformatics & Computational Biology (AREA)
- Evolutionary Biology (AREA)
- Evolutionary Computation (AREA)
- Life Sciences & Earth Sciences (AREA)
- Quality & Reliability (AREA)
- Alarm Systems (AREA)
Abstract
The application provides an alarm aggregation method, device, equipment and storage medium. The method comprises the following steps: intercepting an alarm time sequence sub-graph in each alarm accompanying time period in which the alarm event is positioned from a formed alarm time sequence graph aiming at each alarm event, wherein the alarm time sequence graph is formed by distributing the alarm events according to time sequence; for each alarm event, determining an alarm association relation under the alarm event according to an accompanying alarm hotspot superposed by alarm time sequence subgraphs in each alarm accompanying time period in which the alarm event is positioned; and performing alarm aggregation on each alarm event according to the alarm association relation under each alarm event. The method and the device determine the alarm incidence relation under each alarm event from the perspective of overall accompanying alarm, realize comprehensive detection of the alarm incidence relation, ensure the comprehensiveness of alarm event aggregation, further reduce the alarm times in a service system and avoid alarm storm.
Description
Technical Field
The embodiment of the application relates to the technical field of alarm processing, in particular to an alarm aggregation method, device, equipment and storage medium.
Background
With the rapid development of internet technology, the scale and complexity of various service systems are gradually increased, so that the requirement for detecting alarm events in the service systems is higher and higher. In order to fully detect alarm events within a detection business system, a variety of alarm detection conditions are typically defined to detect the presence of alarm events from multiple dimensions. However, an abnormal point in the service system may trigger generation of an alarm event in multiple dimensions, which may generate an alarm storm, resulting in a problem of a fact failure of the alarm event. Therefore, in order to avoid the alarm storm generated in the service system, it is necessary to aggregate alarms for a plurality of alarm events caused by one abnormal point to reduce the number of alarms in the service system.
At present, various causal reasoning models or pattern recognition algorithms based on probability are usually adopted to analyze the incidence relation between every two alarm events of a business system, then the multivariate incidence relation between the overall alarm events is uniformly analyzed based on the binary incidence relation between every two alarm events, and then the alarm events are aggregated and alarmed according to the overall multivariate incidence relation.
However, for the multivariate incidence relation actually existing among a plurality of alarm events in the service system, it cannot be constructed by a plurality of binary incidence relations, for example, the alarm event E represents "primary service unavailable", the alarm event C represents "duplicate service unavailable", and the alarm event D represents "service dropped", it can be known that E and C can jointly derive D, which indicates that E, C, D has a ternary incidence relation, but E or C alone cannot derive D, which indicates that E and D or C and D do not have a binary incidence relation, so that E, C, D cannot be constructed by the existing method. Moreover, the phenomenon that the actual multivariate incidence relation between alarm events in the service system cannot be constructed by the corresponding binary incidence relation is ubiquitous, so that the conventional aggregation alarm cannot realize the comprehensive aggregation of the alarm events in the service system, and the problem of excessive alarm times still exists.
Disclosure of Invention
The application provides an alarm aggregation method, device, equipment and storage medium, which analyze the alarm association relationship under each alarm event from the perspective of global accompanying alarm, ensure the comprehensiveness of the alarm association relationship, realize the comprehensive aggregation of the alarm events, further greatly reduce the alarm times in a service system and avoid the generation of alarm storms.
In a first aspect, an embodiment of the present application provides an alarm aggregation method, where the method includes:
intercepting an alarm time sequence sub-graph in each alarm accompanying time period in which the alarm event is positioned from a formed alarm time sequence graph aiming at each alarm event, wherein the alarm time sequence graph is formed by distributing the alarm events according to time sequence;
for each alarm event, determining an alarm association relation under the alarm event according to an accompanying alarm hotspot superposed by alarm time sequence subgraphs in each alarm accompanying time period in which the alarm event is positioned;
and performing alarm aggregation on each alarm event according to the alarm association relation under each alarm event.
Further, the determining, for each alarm event, an alarm association relationship under the alarm event according to an accompanying alarm hotspot where an alarm time sequence subgraph is superimposed in each alarm accompanying time period where the alarm event is located includes:
for each alarm event, overlapping the alarm time sequence subgraphs in the alarm accompanying time periods in which the alarm event is positioned to determine the accompanying alarm frequency of each alarm event along with the alarm event;
according to the accompanying alarm frequency of each alarm event along with the occurrence of the alarm event, calculating the alarm association degree between each alarm event and the alarm event so as to determine an accompanying alarm hot spot under the alarm event;
and generating alarm association relation under the alarm event among the pointed alarm events accompanied with the alarm hot spots.
Further, the overlaying of the alarm timing diagram in each alarm accompanying time period in which the alarm event is located to determine an accompanying alarm frequency of each alarm event occurring along with the alarm event includes:
and determining the accompanied alarm frequency of each alarm event along with the alarm event according to the accumulated occurrence frequency of each alarm event after the alarm time sequence subgraphs are overlapped.
Further, the calculating the alarm association degree between each alarm event and the alarm event according to the accompanied alarm frequency of each alarm event accompanied with the alarm event includes:
calculating the time sequence concentration degree of each alarm event along with the alarm event according to the time sequence distribution distance between each alarm event in each alarm time sequence subgraph and the alarm event;
and calculating the alarm association degree between each alarm event and each alarm event based on the accompanying alarm frequency and the time sequence concentration degree of each alarm event accompanying the alarm event.
Further, the determining the accompanied alarm hotspot under the alarm event includes:
screening out corresponding outlier alarm events according to the alarm association degree between each alarm event and the alarm event;
and combining the rest alarm events except the outlier alarm event to obtain an accompanying alarm hotspot under the alarm event.
Further, the intercepting, for each alarm event, an alarm timing subgraph in each alarm accompanying time period in which the alarm event is located from the formed alarm timing graph includes:
and regarding each alarm event, taking each alarm time point of the alarm event in the alarm time sequence diagram as a starting point, and respectively intercepting the alarm time sequence diagram according to preset alarm accompanying time length to obtain an alarm time sequence subgraph in each alarm accompanying time period of the alarm event.
Further, the alarm aggregation for each alarm event according to the alarm association relationship under each alarm event includes:
merging and de-duplicating the alarm association relation under each alarm event to obtain an alarm association set;
and carrying out alarm aggregation on the alarm events which accord with any alarm association relation in the alarm association set.
Further, before intercepting an alarm time sequence subgraph in each alarm accompanying time period in which the alarm event is located from the formed alarm time sequence graph for each alarm event, the method further comprises the following steps:
and forming the alarm time sequence scene according to the alarm distribution of each alarm event along with the change of time.
In a second aspect, an embodiment of the present application provides an alarm aggregation device, where the device includes:
the alarm sub-graph intercepting module is used for intercepting an alarm time sequence sub-graph in each alarm accompanying time period in which the alarm event is positioned from a formed alarm time sequence graph aiming at each alarm event, wherein the alarm time sequence graph is formed by distributing the alarm events according to time sequence;
the incidence relation determining module is used for determining the alarm incidence relation under each alarm event according to the accompanying alarm hot spot after the alarm time sequence subgraph is superposed in each alarm accompanying time period in which the alarm event is positioned;
and the alarm aggregation module is used for carrying out alarm aggregation on each alarm event according to the alarm association relation under each alarm event.
In a third aspect, an embodiment of the present application provides an electronic device, including:
a processor and a memory, the memory being configured to store a computer program, and the processor being configured to call and run the computer program stored in the memory to perform the alarm aggregation method provided in the first aspect of the present application.
In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium for storing a computer program, where the computer program enables a computer to execute the alarm aggregation method provided in the first aspect of the present application.
In a fifth aspect, the present application provides a computer program product, which includes computer programs/instructions, and is characterized in that when executed by a processor, the computer programs/instructions implement the alarm aggregation method as provided in the first aspect of the present application.
According to the alarm aggregation method, the alarm aggregation device, the alarm aggregation equipment and the storage medium, an alarm time sequence diagram is formed by alarm events according to time sequence distribution in advance, then, for each alarm event, an alarm time sequence subgraph in each alarm accompanying time period where the alarm event is located is respectively intercepted from the alarm time sequence diagram, then, accompanying alarm hot spots after superposition of the alarm time sequence subgraphs are analyzed, the alarm association relation under the alarm event is determined from the perspective of overall accompanying alarm, and the alarm association relation under each alarm event can be obtained through the method, so that the overall detection of the alarm association relation is realized, the comprehensiveness of alarm event aggregation is ensured, the alarm times in a service system are further reduced, and the generation of alarm storms is avoided.
Drawings
In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings needed to be used in the description of the embodiments will be briefly introduced below, and it is obvious that the drawings in the following description are only some embodiments of the present invention, and it is obvious for those skilled in the art to obtain other drawings based on these drawings without creative efforts.
Fig. 1 is a flowchart illustrating an alarm aggregation method according to an embodiment of the present application;
FIG. 2 is a diagram of an alarm timing diagram according to an embodiment of the present application;
FIG. 3 is a schematic diagram illustrating a principle of interception and superposition of an alarm timing diagram according to an embodiment of the present application;
fig. 4 is a flowchart illustrating another alarm aggregation method according to an embodiment of the present application;
FIG. 5 is a schematic block diagram of an alarm aggregation apparatus according to an embodiment of the present disclosure;
fig. 6 is a schematic block diagram of an electronic device provided in an embodiment of the present application.
Detailed Description
The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the drawings in the embodiments of the present invention, and it is obvious that the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. All other embodiments, which can be obtained by a person skilled in the art without any inventive step based on the embodiments of the present invention, are within the scope of the present invention.
It should be noted that the terms "first," "second," and the like in the description and claims of the present invention and in the drawings described above are used for distinguishing between similar elements and not necessarily for describing a particular sequential or chronological order. It is to be understood that the data so used is interchangeable under appropriate circumstances such that the embodiments of the invention described herein are capable of operation in sequences other than those illustrated or described herein. Furthermore, the terms "comprises," "comprising," and "having," and any variations thereof, are intended to cover a non-exclusive inclusion, such that a process, method, system, article, or server that comprises a list of steps or elements is not necessarily limited to those steps or elements expressly listed, but may include other steps or elements not expressly listed or inherent to such process, method, article, or apparatus.
Considering the problem that the binary association relationship between every two alarm events in the service system cannot be comprehensively constructed to cause incapability of realizing comprehensive aggregation of the alarm events, the embodiment of the application designs a method for mining various alarm association relationships actually existing between the alarm events in the service system from the perspective of global accompanying alarm.
Fig. 1 is a flowchart of an alarm aggregation method according to an embodiment of the present application. Referring to fig. 1, the method may specifically include the following steps:
s110, for each alarm event, intercepting an alarm time sequence subgraph in each alarm accompanying time period in which the alarm event is positioned from the formed alarm time sequence graph.
In particular, for any alarm event within a business system, multiple alarms may be initiated at different points in time. Therefore, in order to comprehensively analyze the multivariate association relationship actually existing between the alarm events in the service system, the time point of each alarm event initiating an alarm in the service system each time needs to be analyzed to determine the time sequence distribution condition of each alarm event, and further determine whether the association relationship exists in the time sequence distribution of each alarm event.
As an optional implementation scheme in the embodiment of the present application, in order to visually and completely describe the time sequence distribution condition of each alarm event in the service system, an alarm time sequence scene may be formed by distributing each alarm event according to a time sequence in the present application.
For example, for the forming process of the alarm time sequence diagram, the alarm time sequence diagram may be formed mainly according to the alarm distribution of each alarm event changing with time. That is, for each alarm event, first, the alarm event initiates an alarm in the service system at each time point, then the alarm distribution situation of the alarm event changing with time is analyzed, and the alarm distribution situation of each alarm event changing with time can be determined according to the above steps. Further, as shown in fig. 2, the alarm events are respectively plotted at different time points by using the time sequence change as the abscissa and each alarm event as the ordinate, so as to obtain the alarm time sequence diagram.
It should be understood that, the alarm events in the currently formed alarm timing diagram are independently distributed along with the time change, and the association relationship between the alarm events cannot be described visually. However, for other alarm events having a certain association with an alarm event, each time the alarm event initiates an alarm, the other alarm events will also initiate a corresponding alarm along with the alarm event in most cases, and the other alarm events having no association with the alarm event will not initiate an alarm along with the alarm event. Therefore, when any alarm event initiates an alarm each time, whether each other alarm event initiates a corresponding alarm along with the alarm event each time is analyzed, so that the alarm frequency of each other alarm event along with the alarm event can be determined, and other alarm events which have an association relation with the alarm event can be obtained.
In the application, in order to visually analyze whether each other alarm event also initiates a corresponding alarm when any alarm event initiates an alarm each time, firstly, for each alarm event, a current alarm accompanying time period is set when the alarm event initiates an alarm each time. Then, the scene segment in each alarm accompanying time interval in which the alarm event is located can be respectively intercepted from the formed alarm time sequence scene, and the alarm time sequence subgraph in each alarm accompanying time interval in which the alarm event is located can be obtained. Each alarm time sequence subgraph can visually describe other alarm events which also initiate corresponding alarms in the current alarm accompanying time period after the alarm event initiates the alarm, and the alarm frequency of other alarm events which also initiate corresponding alarms in each alarm accompanying time period along with the alarm event is analyzed subsequently by overlapping each alarm time sequence subgraph of the alarm event, so that whether each other alarm event initiates corresponding alarms along with the alarm event or randomly initiates the alarm can be judged.
As an optional implementation scheme in the embodiment of the present application, since the alarm time sequence subgraph in each alarm accompanying time period in which an alarm event is located is mainly used to analyze the alarm frequency of each other alarm event occurring along with the alarm event after the alarm event initiates an alarm each time, for each alarm event, the alarm accompanying time period set when the alarm event initiates an alarm each time may be a time period in which a preset alarm accompanying time duration passes from each alarm time point in which the alarm event is located in an alarm time sequence diagram as a starting point, where the alarm accompanying time duration is an empirical value set by analyzing the alarm frequency of each alarm event in a service system.
At this time, for each alarm event, regarding the interception of the alarm time sequence subgraph in each alarm accompanying time period in which the alarm event is located, taking each alarm time point of the alarm event in the alarm time sequence graph as a starting point, respectively intercepting the alarm time sequence graph according to the preset alarm accompanying time length to obtain the alarm time sequence subgraph in each alarm accompanying time period in which the alarm event is located. That is, as shown in fig. 3, each alarm accompanying time period of the alarm event is determined according to a preset alarm accompanying duration with each alarm time point of the alarm event in the alarm time sequence diagram as a starting point, and then the diagram segments of the alarm event in each alarm accompanying time period are respectively captured from the alarm time sequence diagram to obtain an alarm time sequence subgraph in each alarm accompanying time period of the alarm event.
And S120, aiming at each alarm event, determining an alarm association relation under the alarm event according to an accompanying alarm hotspot superposed by alarm time sequence subgraphs in each alarm accompanying time period in which the alarm event is positioned.
Specifically, after an alarm time sequence subgraph in each alarm accompanying time period in which the alarm event is located is intercepted for each alarm event, because other alarm events which also initiate corresponding alarms at different time points in the current alarm accompanying time period exist in each alarm time sequence subgraph after the alarm event initiates the alarm at this time, it cannot be judged whether other alarm events initiate alarms along with the alarm event or randomly initiate alarms.
Therefore, in order to accurately judge whether each other alarm event existing in each alarm time sequence subgraph is an alarm initiated along with the alarm event or an alarm initiated randomly, according to each alarm event, the alarm time sequence subgraphs in each alarm accompanying time period in which the alarm event is located are overlapped, as shown in fig. 3, so that the times of the alarm events on the same relative alarm time point in each alarm time sequence subgraph are accumulated, the alarm frequency of each alarm event existing in each alarm time sequence subgraph along with the alarm event is analyzed, and an accompanying alarm hotspot formed by overlapping each alarm time sequence subgraph is obtained, wherein the accompanying alarm hotspot is composed of the alarm event and each other alarm event with higher alarm frequency. At this time, the other alarm events represented by the associated alarm hotspot can be used as the alarm event which initiates the corresponding alarm along with the alarm event, and a certain alarm association relationship exists between the alarm events, so that the alarm association relationship under the alarm event is determined.
It should be noted that, for each alarm event, the alarm association relationship under each alarm event can be obtained by performing the same steps in S110 and S120, so that the alarm association relationship between each alarm event in the service system is integrally analyzed from the perspective of global accompanying alarms, and comprehensive association detection between alarm events is realized.
S130, alarm aggregation is carried out on each alarm event according to the alarm association relation under each alarm event.
When the alarm association relationship under each alarm event is obtained, the alarm association relationships under each alarm event are unified and combined to construct a multi-element association relationship representing the whole body among the alarm events in the service system, so that the multi-element association relationship representing the whole body is adopted to carry out alarm aggregation on each alarm event in the service system, and only one alarm operation is carried out after the multiple alarm events are aggregated, thereby ensuring the comprehensiveness of the aggregation of the alarm events, further reducing the alarm times in the service system and avoiding the generation of alarm storms.
Exemplarily, considering that when alarm association exists between alarm events, the alarm association relationship under each alarm event may be repeated, so as to aggregate alarms of the alarm events, merging and removing duplicate alarm association relationships under each alarm event may be mainly performed to obtain an alarm association set; and carrying out alarm aggregation on the alarm events which accord with any alarm association relation in the alarm association set. That is, the combined and deduplicated alarm association set is used as a multivariate association relation representing the whole in the business system, and by analyzing whether the execution time sequence between each alarm event in the business system conforms to any alarm association relation in the alarm association set, if so, the alarm events are aggregated, and an alarm operation is executed once.
According to the technical scheme provided by the embodiment of the application, an alarm time sequence diagram is formed by alarm events according to time sequence distribution in advance, then alarm time sequence subgraphs in each alarm accompanying time period where the alarm event is located are respectively intercepted from the alarm time sequence diagram aiming at each alarm event, then accompanying alarm hot spots formed by overlapping the alarm time sequence subgraphs are analyzed, the alarm association relation under the alarm event is determined from the angle of overall accompanying alarm, and the alarm association relation under each alarm event can be obtained through the method, so that the overall detection of the alarm association relation is realized, the comprehensiveness of alarm event aggregation is ensured, the alarm times in a service system are further reduced, and the generation of alarm storms is avoided.
As an optional implementation scheme in the embodiment of the present application, the present application will take one of the alarm events in the service system as an example to exemplarily describe in detail the specific step of determining the alarm association relationship under each alarm event.
Fig. 4 is a flowchart of another alarm aggregation method according to an embodiment of the present application. As shown in fig. 4, the method may specifically include the following steps:
s410, for each alarm event, intercepting an alarm time sequence sub-graph in each alarm accompanying time period in which the alarm event is positioned from the formed alarm time sequence graph, wherein the alarm time sequence graph is formed by the alarm events according to time sequence distribution.
And S420, aiming at each alarm event, overlapping the alarm time sequence subgraphs in each alarm accompanying time period in which the alarm event is positioned so as to determine the accompanying alarm frequency of each alarm event along with the occurrence of the alarm event.
Optionally, regarding each alarm event in the service system, considering that each other alarm event initiating an alarm in each alarm accompanying time period exists in the alarm timing diagram in each alarm accompanying time period in which the alarm event is located, it is necessary to analyze the association between each other alarm event and the alarm event by determining whether the other alarm event in each alarm accompanying time period is an alarm initiating along with the alarm event or an alarm initiating randomly.
Specifically, it is considered that for other alarm events with higher relevance to the alarm event, when the alarm event initiates an alarm, the other alarm events may also initiate an alarm along with the alarm event in multiple situations, and an alarm timing diagram of the alarm event in each alarm accompanying time period may indicate an alarm condition of each other alarm event after the alarm event initiates an alarm. Therefore, the alarm time sequence subgraphs in each alarm accompanying time interval in which the alarm event is positioned are superposed, so that the alarm conditions of other alarm events can be analyzed in each alarm time interval after the alarm event initiates the alarm, and the accompanying alarm frequency of each alarm event along with the alarm event can be obtained.
It should be understood that, when the alarm time sequence subgraphs in each alarm accompanying time period in which the alarm event is located are superimposed, the alarm times of the alarm events existing in each alarm time sequence subgraph at each alarm interval time point after the alarm event initiates the alarm are superimposed, and the cumulative occurrence times of each alarm event after the superimposition of each alarm time sequence subgraph can be calculated. And then, according to the accumulated occurrence frequency of each alarm event after the alarm time sequence subgraphs are overlapped, determining the accompanied alarm frequency of each alarm event accompanying the alarm event.
Each alarm time sequence subgraph starts intercepting by taking the alarm time point when the alarm event initiates the alarm each time as a starting point, so the accumulated occurrence frequency of the alarm event is the total number of each alarm time sequence subgraph where the alarm event is located.
Illustratively, use is made of { X1，X2，…，XnWhen representing each alarm event in the service system, aiming at each alarm event XiThe alarm event X may be setiThe alarm time sequence subgraph in each alarm accompanying time interval is represented as Wj＝[xj1，xj2，xj3，…，xjn]Wherein x isj1，xj2，xj3，…，xjnRespectively representing each alarm event X1，X2，…，XnIn alarm timing diagram WjThe alarm time point of the internal location and the alarm event XiIn alarm timing diagram WjBetween alarm time points of inner positionsA time interval.
Wherein the alarm event XiIn alarm timing diagram WjThe alarm time point of the internal position is an alarm time sequence subgraph WjThe starting point of (2). Also, consider that there may be an alarm event at the alarm event XiAlarm timing diagram WjIf no condition occurs, then the alarm timing diagram Wj＝[xj1，xj2，xj3，…，xjn]A specific space or "-1" may be used to identify the sub-graph W at the alarm timing sequencejAlarm event not existing in the memory and the alarm event XiThe alarm time interval in between. Alternatively, there may be an alarm event in the alarm timing graph WjIn the case of multiple alarms occurring at different time intervals, the alarm timing diagram Wj＝[xj1，xj2，xj3，…，xjn]Can adopt the alarm event XiIs indicated by the last alert time interval.
Thus, the alarm event X may be obtainediEach alarm timing diagram { W }1，W2，…，Wj…, to describe each alarm event with the alarm event XiThe method can realize the association and time sequence alarm relationship between the alarm time sequences, and can realize the alarm time sequence subgraphs { W }1，W2，…，Wj…, transposing and merging to obtain the alarm event XiHistorical event matrix of
The historical event matrix MjiEach row in (a) represents a respective alarm event X1，X2，…，XnAt the alarm event XiThe time interval within each alarm timing graph.
At this time, Count is adoptedi[j]＝Mj[Xi]The number of elements of which the alarm event represented by each row is not empty is calculated and is used as the accumulated occurrence frequency of each alarm event after the alarm time sequence subgraphs are overlapped, and then each alarm event can be analyzedThe frequency with which an alarm event occurs is accompanied by the number of alarms associated with the alarm event.
S430, according to the accompanied alarm frequency of each alarm event accompanying the alarm event, calculating the alarm association degree between each alarm event and the alarm event so as to determine an accompanied alarm hotspot under the alarm event.
After the accompanying alarm frequency of each alarm event along with the alarm event is calculated, whether each alarm event occurs along with the alarm event after the alarm event is initiated or occurs randomly can be analyzed according to the accompanying alarm frequency, and therefore the alarm association degree between each alarm event and the alarm event is calculated by utilizing the proportion of the accompanying alarm frequency of each alarm event along with the alarm event in the total number of alarm time sequence subgraphs of the alarm event. For example, the higher the frequency of the alarms accompanied by a certain alarm event along with the alarm event, the higher the alarm association degree of the two.
For example, it is considered that the time intervals for initiating alarms in the same alarm timing sub-graph are different from each alarm event to the alarm event, wherein if a certain alarm event is more related to the alarm event, the time intervals for the alarms in the same alarm timing sub-graph are closer. Therefore, in order to ensure the accuracy of the alarm association degree among the alarm events, when the alarm association degree between each alarm event and the alarm event is calculated according to the accompanied alarm frequency of each alarm event accompanied with the alarm event, the method mainly comprises the steps of calculating the time sequence concentration degree of each alarm event accompanied with the alarm event according to the time sequence distribution distance between each alarm event and the alarm event in each alarm time sequence subgraph; and calculating the alarm association degree between each alarm event and each alarm event based on the accompanying alarm frequency and the time sequence concentration degree of each alarm event accompanying the alarm event.
The time sequence distribution distance between each alarm event in each alarm time sequence subgraph and the alarm event is the time interval between the alarm time point of each alarm event in each alarm time sequence subgraph and the alarm time point of the alarm event, and the time sequence distribution distances between the same alarm event in different alarm time sequence subgraphs and the alarm event are different. Therefore, in order to accurately analyze the correlation influence of each alarm event on the alarm event, it is first required to determine the time sequence average distribution distance between each alarm event and the alarm event according to the time sequence distribution distance between each alarm event and the alarm event in each alarm time sequence subgraph, which is used as the time sequence concentration of each alarm event along with the occurrence of the alarm event.
For example, a standard quartile range may be used in the present application to calculate the time-series concentration of each alarm event occurring along with the alarm event. And for each other alarm event, sequencing the time sequence distribution distances of the other alarm events in each alarm time sequence subgraph, and then respectively determining the time sequence distribution distances of the other alarm events under the first quartile and the third quartile, thereby calculating the quartile distance of the other alarm events as the time sequence concentration of the other alarm events along with the alarm event. The adopted standard quartile range is disclosed as follows:
Norm-IORi[j]＝(Mj[Xi].getPercentile(75)-Mj[Xi].getPercentile(25))*0.7413。
wherein, Norm-IORi[j]Represents each alarm event { X }1，X2，…，XnAccompanied by the alarm event XiTime sequence concentration of occurrence, Mj[Xi]Getfacenteile (75) represents each alarm event { X }1，X2，…，XnThe time sequence distribution distance, M, at the third quartilej[Xi]Getfacenteile (25) indicates each alarm event { X }1，X2，…，XnThe distance of the time sequence distribution under the first quartile.
Then, after the time sequence concentration of each alarm event along with the occurrence of the alarm event is calculated, the closer the time sequence distribution distance between each alarm event and the alarm event is, the higher the relevance between the alarm event and the alarm event is, and the higher the accompanying alarm frequency of each alarm event along with the occurrence of the alarm event is, the higher the relevance between the alarm event and the alarm event is. Therefore, the alarm association degree between each alarm event and each alarm event can be uniformly calculated by adopting the forward influence of the alarm frequency of each alarm event along with the occurrence of the alarm event on the alarm association degree and the reverse influence of the time sequence concentration degree of each alarm event along with the occurrence of the alarm event on the alarm association degree, so that the alarm association degree between each alarm event and each alarm event can be further analyzed by additionally referring to the time sequence distribution distance of each alarm event along with the occurrence of the alarm event, and the accuracy of the alarm association degree between each alarm event can be ensured.
For example, the calculation formula of the alarm association degree between each alarm event and the alarm event may be:
in addition, after the alarm association degree between each alarm event and the alarm event is calculated, in order to determine the accompanying alarm hot spot existing under the alarm event, the corresponding outlier alarm event can be screened out according to the alarm association degree between each alarm event and the alarm event; and combining the rest alarm events except the outlier alarm event to obtain an accompanying alarm hotspot under the alarm event.
That is, according to the alarm association degree between each alarm event and the alarm event, the alarm events can be sorted, and then other alarm events with the alarm association degree lower than the preset threshold value are screened out as outlier alarm events in the application. At this time, the other alarm events except the outlier alarm event can be considered to have corresponding association with the alarm event, and the accompanying alarm hotspot under the alarm event can be obtained by combining the other alarm events except the outlier alarm event.
For example, a Local Outlier Factor (LOF) algorithm based on density may be used in the present application to calculate coeffient for the alarm eventi[j]Processing the mixture to screen the Coefficienti[j]The outliers in (1) are reported as outliers in the present applicationAn alarm event.
S440, generating alarm association relation under the alarm event among the alarm events pointed by the accompanying alarm hot spots.
The accompanying alarm hotspot in the application is obtained by combining all the other alarm events except the outlier alarm event, which shows that corresponding association relations exist among all the alarm events pointed in the accompanying alarm hotspot, so that the alarm association relations under the alarm events can be generated according to the alarm time sequence distribution relations of all the alarm events pointed in the accompanying alarm hotspot and the alarm events.
S450, alarm aggregation is carried out on each alarm event according to the alarm association relation under each alarm event.
The technical scheme provided by the embodiment of the application comprises the steps of forming an alarm time sequence diagram by alarm events according to time sequence distribution in advance, respectively intercepting an alarm time sequence subgraph in each alarm accompanying time period in which the alarm event is positioned from the alarm time sequence diagram aiming at each alarm event, comprehensively analyzing the alarm association degree between each alarm event and the alarm event from the two aspects of the accompanying alarm frequency and the time sequence concentration degree of each alarm event accompanying the alarm event, ensuring the accuracy of the alarm association degree, determining the accompanying alarm hot points existing under the alarm event, determining the alarm association relation under the alarm event from the angle of global accompanying alarm, and obtaining the alarm association relation under each alarm event by the mode so as to realize the comprehensive detection of the alarm association relation and ensure the comprehensiveness of alarm event aggregation, further reducing the alarm times in the service system and avoiding the generation of alarm storms.
Fig. 5 is a schematic block diagram of an alarm aggregation device according to an embodiment of the present application. As shown in fig. 5, the apparatus 500 may include:
an alarm sub-graph intercepting module 510, configured to intercept, for each alarm event, an alarm sub-graph of each alarm accompanying time period in which the alarm event is located from a formed alarm time sequence graph, where the alarm time sequence graph is formed by time-sequentially distributing the alarm events;
an association relation determining module 520, configured to determine, for each alarm event, an alarm association relation under the alarm event according to an accompanying alarm hotspot where alarm time sequence subgraphs within each alarm accompanying time period of the alarm event are superimposed;
and the alarm aggregation module 530 is configured to perform alarm aggregation on each alarm event according to the alarm association relationship under each alarm event.
Further, the association determining module 520 may specifically include:
the alarm frequency determining unit is used for superposing an alarm time sequence subgraph in each alarm accompanying time period in which the alarm event is positioned aiming at each alarm event so as to determine the accompanying alarm frequency of each alarm event along with the occurrence of the alarm event;
the alarm hot spot determining unit is used for calculating the alarm association degree between each alarm event and the alarm event according to the accompanied alarm frequency of each alarm event accompanied with the alarm event so as to determine the accompanied alarm hot spot under the alarm event;
and the incidence relation generating unit is used for generating the alarm incidence relation under the alarm event among the alarm events pointed by the accompanying alarm hot spots.
Further, the alarm frequency determining unit may be specifically configured to:
and determining the accompanied alarm frequency of each alarm event along with the alarm event according to the accumulated occurrence frequency of each alarm event after the alarm time sequence subgraphs are overlapped.
Further, the alarm hotspot determining unit may be specifically configured to:
calculating the time sequence concentration degree of each alarm event along with the alarm event according to the time sequence distribution distance between each alarm event in each alarm time sequence subgraph and the alarm event;
and calculating the alarm association degree between each alarm event and each alarm event based on the accompanying alarm frequency and the time sequence concentration degree of each alarm event accompanying the alarm event.
Further, the alarm hotspot determining unit may be further specifically configured to:
screening out corresponding outlier alarm events according to the alarm association degree between each alarm event and the alarm event;
and combining the rest alarm events except the outlier alarm event to obtain an accompanying alarm hotspot under the alarm event.
Further, the alarm subgraph interception module 510 may be specifically configured to:
and regarding each alarm event, taking each alarm time point of the alarm event in the alarm time sequence diagram as a starting point, and respectively intercepting the alarm time sequence diagram according to preset alarm accompanying time length to obtain an alarm time sequence subgraph in each alarm accompanying time period of the alarm event.
Further, the alarm aggregation module 530 may be specifically configured to:
merging and de-duplicating the alarm association relation under each alarm event to obtain an alarm association set;
and carrying out alarm aggregation on the alarm events which accord with any alarm association relation in the alarm association set.
Further, the alarm aggregation apparatus 500 may further include:
and the time sequence scene forming module is used for forming the alarm time sequence scene according to the alarm distribution of each alarm event along with the change of time.
In the embodiment of the application, an alarm time sequence diagram is formed by alarm events according to time sequence distribution in advance, then, aiming at each alarm event, alarm time sequence sub-diagrams in each alarm accompanying time period where the alarm event is located are respectively intercepted from the alarm time sequence diagram, then, accompanying alarm hot spots after superposition of the alarm time sequence sub-diagrams are analyzed, so that the alarm association relationship under the alarm event is determined from the angle of global accompanying alarm, and the alarm association relationship under each alarm event can be obtained through the method, so that the comprehensive detection of the alarm association relationship is realized, the comprehensiveness of alarm event aggregation is ensured, the alarm times in a service system are further reduced, and the alarm storm is avoided.
It is to be understood that apparatus embodiments and method embodiments may correspond to one another and that similar descriptions may refer to method embodiments. To avoid repetition, further description is omitted here. Specifically, the apparatus 500 shown in fig. 5 may perform any method embodiment provided in the present application, and the foregoing and other operations and/or functions of each module in the apparatus 500 are respectively for implementing corresponding processes in each method of the embodiment of the present application, and are not described herein again for brevity.
The apparatus 500 of the embodiments of the present application is described above in connection with the drawings from the perspective of functional modules. It should be understood that the functional modules may be implemented by hardware, by instructions in software, or by a combination of hardware and software modules. Specifically, the steps of the method embodiments in the present application may be implemented by integrated logic circuits of hardware in a processor and/or instructions in the form of software, and the steps of the method disclosed in conjunction with the embodiments in the present application may be directly implemented by a hardware decoding processor, or implemented by a combination of hardware and software modules in the decoding processor. Alternatively, the software modules may be located in random access memory, flash memory, read only memory, programmable read only memory, electrically erasable programmable memory, registers, and the like, as is well known in the art. The storage medium is located in a memory, and a processor reads information in the memory and completes the steps in the above method embodiments in combination with hardware thereof.
Fig. 6 is a schematic block diagram of an electronic device 600 provided in an embodiment of the present application.
As shown in fig. 6, the electronic device 600 may include:
a memory 610 and a processor 620, the memory 610 being configured to store a computer program and to transfer the program code to the processor 620. In other words, the processor 620 may call and execute a computer program from the memory 610 to implement the method in the embodiment of the present application.
For example, the processor 620 may be configured to perform the above-described method embodiments according to instructions in the computer program.
In some embodiments of the present application, the processor 620 may include, but is not limited to:
general purpose processors, Digital Signal Processors (DSPs), Application Specific Integrated Circuits (ASICs), Field Programmable Gate Arrays (FPGAs) or other Programmable logic devices, discrete Gate or transistor logic devices, discrete hardware components, and the like.
In some embodiments of the present application, the memory 610 includes, but is not limited to:
volatile memory and/or non-volatile memory. The non-volatile Memory may be a Read-Only Memory (ROM), a Programmable ROM (PROM), an Erasable PROM (EPROM), an Electrically Erasable PROM (EEPROM), or a flash Memory. Volatile Memory can be Random Access Memory (RAM), which acts as external cache Memory. By way of example, but not limitation, many forms of RAM are available, such as Static random access memory (Static RAM, SRAM), Dynamic Random Access Memory (DRAM), Synchronous Dynamic random access memory (Synchronous DRAM, SDRAM), Double Data Rate Synchronous Dynamic random access memory (DDR SDRAM), Enhanced Synchronous SDRAM (ESDRAM), Synchronous Link DRAM (SLDRAM), and Direct Rambus RAM (DR RAM).
In some embodiments of the present application, the computer program may be partitioned into one or more modules, which are stored in the memory 610 and executed by the processor 620 to perform the methods provided herein. The one or more modules may be a series of computer program instruction segments capable of performing certain functions, the instruction segments describing the execution of the computer program in the electronic device.
As shown in fig. 6, the electronic device may further include:
a transceiver 630, the transceiver 630 may be connected to the processor 620 or the memory 610.
The processor 620 may control the transceiver 630 to communicate with other devices, and specifically, may transmit information or data to the other devices or receive information or data transmitted by the other devices. The transceiver 630 may include a transmitter and a receiver. The transceiver 630 may further include one or more antennas.
It should be understood that the various components in the electronic device are connected by a bus system that includes a power bus, a control bus, and a status signal bus in addition to a data bus.
Embodiments of the present application also provide a computer storage medium having a computer program stored thereon, where the computer program, when executed by a computer, enables the computer to execute the method of the above method embodiments. In other words, the present application also provides a computer program product containing instructions, which when executed by a computer, cause the computer to execute the method of the above method embodiments.
When implemented in software, may be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. The procedures or functions described in accordance with the embodiments of the present application occur, in whole or in part, when the computer program instructions are loaded and executed on a computer. The computer may be a general purpose computer, a special purpose computer, a network of computers, or other programmable device. The computer instructions may be stored on a computer readable storage medium or transmitted from one computer readable storage medium to another, for example, from one website, computer, server, or data center to another website, computer, server, or data center via wire (e.g., coaxial cable, fiber optic, Digital Subscriber Line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device, such as a server, a data center, etc., that includes one or more of the available media. The usable medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a magnetic tape), an optical medium (e.g., a Digital Video Disk (DVD)), or a semiconductor medium (e.g., a Solid State Disk (SSD)), among others.
Those of ordinary skill in the art will appreciate that the various illustrative modules and algorithm steps described in connection with the embodiments disclosed herein may be implemented as electronic hardware or combinations of computer software and electronic hardware. Whether such functionality is implemented as hardware or software depends upon the particular application and design constraints imposed on the implementation. Skilled artisans may implement the described functionality in varying ways for each particular application, but such implementation decisions should not be interpreted as causing a departure from the scope of the present application.
In the several embodiments provided in the present application, it should be understood that the disclosed system, apparatus and method may be implemented in other ways. For example, the above-described apparatus embodiments are merely illustrative, and for example, the division of the module is merely a logical division, and other divisions may be realized in practice, for example, a plurality of modules or components may be combined or integrated into another system, or some features may be omitted, or not executed. In addition, the shown or discussed mutual coupling or direct coupling or communication connection may be an indirect coupling or communication connection through some interfaces, devices or modules, and may be in an electrical, mechanical or other form.
Modules described as separate parts may or may not be physically separate, and parts displayed as modules may or may not be physical modules, may be located in one place, or may be distributed on a plurality of network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of the present embodiment. For example, functional modules in the embodiments of the present application may be integrated into one processing module, or each of the modules may exist alone physically, or two or more modules are integrated into one module.
The above description is only for the specific embodiments of the present application, but the scope of the present application is not limited thereto, and any person skilled in the art can easily conceive of the changes or substitutions within the technical scope of the present application, and shall be covered by the scope of the present application. Therefore, the protection scope of the present application shall be subject to the protection scope of the claims.
Claims (12)
1. An alarm aggregation method, comprising:
intercepting an alarm time sequence sub-graph in each alarm accompanying time period in which the alarm event is positioned from a formed alarm time sequence graph aiming at each alarm event, wherein the alarm time sequence graph is formed by distributing the alarm events according to time sequence;
for each alarm event, determining an alarm association relation under the alarm event according to an accompanying alarm hotspot superposed by alarm time sequence subgraphs in each alarm accompanying time period in which the alarm event is positioned;
and performing alarm aggregation on each alarm event according to the alarm association relation under each alarm event.
2. The method according to claim 1, wherein the determining, for each alarm event, an alarm association relationship under the alarm event according to an accompanying alarm hotspot where an alarm time sequence subgraph is superimposed in each alarm accompanying time period in which the alarm event is located comprises:
for each alarm event, overlapping the alarm time sequence subgraphs in the alarm accompanying time periods in which the alarm event is positioned to determine the accompanying alarm frequency of each alarm event along with the alarm event;
according to the accompanying alarm frequency of each alarm event along with the occurrence of the alarm event, calculating the alarm association degree between each alarm event and the alarm event so as to determine an accompanying alarm hot spot under the alarm event;
and generating alarm association relation under the alarm event among the alarm events pointed by the accompanying alarm hot spots.
3. The method of claim 2, wherein said overlaying an alarm timing graph within each of said alarm associated time periods within which the alarm event is located to determine the associated alarm frequency with which each alarm event occurs along with the alarm event comprises:
and determining the accompanied alarm frequency of each alarm event along with the alarm event according to the accumulated occurrence frequency of each alarm event after the alarm time sequence subgraphs are overlapped.
4. The method of claim 2, wherein calculating the alarm relevance between each alarm event and the alarm event according to the accompanied alarm frequency of each alarm event accompanied with the alarm event comprises:
calculating the time sequence concentration degree of each alarm event along with the alarm event according to the time sequence distribution distance between each alarm event in each alarm time sequence subgraph and the alarm event;
and calculating the alarm association degree between each alarm event and each alarm event based on the accompanying alarm frequency and the time sequence concentration degree of each alarm event accompanying the alarm event.
5. The method of claim 2, wherein determining the attendant alarm hotspot under the alarm event comprises:
screening out corresponding outlier alarm events according to the alarm association degree between each alarm event and the alarm event;
and combining the rest alarm events except the outlier alarm event to obtain an accompanying alarm hotspot under the alarm event.
6. The method of claim 1, wherein intercepting, for each alarm event, an alarm timing sub-graph within each alarm accompanying time period in which the alarm event is located from the formed alarm timing graph comprises:
and regarding each alarm event, taking each alarm time point of the alarm event in the alarm time sequence diagram as a starting point, and respectively intercepting the alarm time sequence diagram according to preset alarm accompanying time length to obtain an alarm time sequence subgraph in each alarm accompanying time period of the alarm event.
7. The method of claim 1, wherein the alarm aggregation for each alarm event according to the alarm association relationship under each alarm event comprises:
merging and de-duplicating the alarm association relation under each alarm event to obtain an alarm association set;
and carrying out alarm aggregation on the alarm events which accord with any alarm association relation in the alarm association set.
8. The method of claim 1, wherein before intercepting, for each alarm event, from the formed alarm timing graph, the alarm timing subgraph in each alarm companion period in which the alarm event is located, further comprising:
and forming the alarm time sequence scene according to the alarm distribution of each alarm event along with the change of time.
9. An alarm aggregation device, comprising:
the alarm sub-graph intercepting module is used for intercepting an alarm time sequence sub-graph in each alarm accompanying time period in which the alarm event is positioned from a formed alarm time sequence graph aiming at each alarm event, wherein the alarm time sequence graph is formed by distributing the alarm events according to time sequence;
the incidence relation determining module is used for determining the alarm incidence relation under each alarm event according to the accompanying alarm hot spot after the alarm time sequence subgraph is superposed in each alarm accompanying time period in which the alarm event is positioned;
and the alarm aggregation module is used for carrying out alarm aggregation on each alarm event according to the alarm association relation under each alarm event.
10. An electronic device, comprising:
a processor and a memory for storing a computer program, the processor for invoking and executing the computer program stored in the memory to perform the alarm aggregation method of any of claims 1-8.
11. A computer-readable storage medium for storing a computer program, the computer program causing a computer to perform the alarm aggregation method according to any one of claims 1-8.
12. A computer program product comprising computer programs/instructions, characterized in that the computer programs/instructions, when executed by a processor, implement the alarm aggregation method according to any of claims 1-8.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202111467483.2A CN114238013A (en) | 2021-12-03 | 2021-12-03 | Alarm aggregation method, device, equipment and storage medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202111467483.2A CN114238013A (en) | 2021-12-03 | 2021-12-03 | Alarm aggregation method, device, equipment and storage medium |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN114238013A true CN114238013A (en) | 2022-03-25 |
Family
ID=80753096
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202111467483.2A Pending CN114238013A (en) | 2021-12-03 | 2021-12-03 | Alarm aggregation method, device, equipment and storage medium |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN114238013A (en) |
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN115296849A (en) * | 2022-07-05 | 2022-11-04 | 中国电信股份有限公司 | Associated alarm method and system, storage medium and electronic equipment |
-
2021
- 2021-12-03 CN CN202111467483.2A patent/CN114238013A/en active Pending
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN115296849A (en) * | 2022-07-05 | 2022-11-04 | 中国电信股份有限公司 | Associated alarm method and system, storage medium and electronic equipment |
| CN115296849B (en) * | 2022-07-05 | 2024-03-19 | 中国电信股份有限公司 | Associated alarm method and system, storage medium and electronic equipment |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CA3024960C (en) | Method,apparatus,and computer-readable medium for detecting anomalous user behavior | |
| EP3373516B1 (en) | Method and device for processing service calling information | |
| CN106716972B (en) | Semi-automatic failover | |
| US10587555B2 (en) | Event log analyzer | |
| AU2016201425B2 (en) | Systems and methods for predictive reliability mining | |
| US10438124B2 (en) | Machine discovery of aberrant operating states | |
| WO2017113677A1 (en) | User behavior data processing method and system | |
| CN110400005B (en) | Time sequence prediction method, device and equipment for business index | |
| WO2020062702A1 (en) | Method and device for sending text messages, computer device and storage medium | |
| US11593676B2 (en) | Natural language processing and machine learning assisted cataloging and recommendation engine | |
| US10868741B2 (en) | Anchor shortening across streaming nodes | |
| Marchetti et al. | Identification of correlated network intrusion alerts | |
| CN114238013A (en) | Alarm aggregation method, device, equipment and storage medium | |
| US11575695B2 (en) | Systems and methods for intelligently constructing a backbone network graph and identifying and mitigating digital threats based thereon in a machine learning task-oriented digital threat mitigation platform | |
| US20170187730A1 (en) | Security indicator linkage determination | |
| US20210377098A1 (en) | Network performance metrics anomaly detection | |
| CN112182295A (en) | Business processing method and device based on behavior prediction and electronic equipment | |
| CN110837529B (en) | Big data analysis monitoring method and device, server and readable storage medium | |
| CN113282453A (en) | Financial business processing method based on block chain | |
| CN115309515B (en) | Cross-chain transaction processing method, device and equipment based on block chain | |
| US11641371B2 (en) | Systems, methods and computer-readable media for monitoring a computer network for threats using OLAP cubes | |
| CN114549193A (en) | List screening method, apparatus, device, storage medium and program product | |
| US20160164714A1 (en) | Alert management system for enterprises | |
| CN113326064A (en) | Method for dividing business logic module, electronic equipment and storage medium | |
| CN114301768A (en) | Anomaly detection method and device for Network Function Virtualization (NFV) equipment |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination |