CN114282603A

CN114282603A - Alarm information clustering method and device and storage medium

Info

Publication number: CN114282603A
Application number: CN202111485791.8A
Authority: CN
Inventors: 韩赛; 李奥; 王光全
Original assignee: China United Network Communications Group Co Ltd
Current assignee: China United Network Communications Group Co Ltd
Priority date: 2021-12-07
Filing date: 2021-12-07
Publication date: 2022-04-05

Abstract

The embodiment of the application provides an alarm information clustering method, an alarm information clustering device and a storage medium, relates to the technical field of communication, and solves the technical problem that alarm information in historical data cannot be reasonably classified at present. The alarm information clustering method comprises the following steps: acquiring alarm information and characteristic information of the alarm information; the alarm information comprises a network element generating the alarm information and the time of generating the alarm information; determining characteristic information to be clustered according to the alarm information; the feature information to be clustered includes: the network element proportion characteristic information or the time difference characteristic information; the network element proportion characteristic information is used for representing the proportion of the network element generating the alarm information in a preset network element set; the time difference characteristic information is used for representing the time difference between the time of generating the alarm information and the preset time; and clustering the characteristic information to be clustered and the characteristic information of the alarm information based on a clustering algorithm to obtain a clustering result of the alarm information.

Description

Alarm information clustering method and device and storage medium

Technical Field

The present invention relates to the field of communications technologies, and in particular, to a method and an apparatus for clustering alarm information, and a storage medium.

Background

In the network operation and maintenance process, network equipment inevitably breaks down and generates massive alarm information.

However, most of the alarm information has only one source alarm. A large amount of derivative alarms are generated by one root alarm, so that an artificial intelligence algorithm is used for mining alarm association relations from massive alarm information to respectively find out the root alarm and the derivative alarms, so as to help fault location.

The basis for the use of artificial intelligence algorithms is a large amount of historical data. The historical data is generally derived from a network management storage server, and is usually a data volume of several months. More than one fault information is usually contained in the historical data, and often the alarm information in one fault information has relevance to be analyzed.

Therefore, how to reasonably classify the alarm information in the historical data is a technical problem which needs to be solved urgently at present.

Disclosure of Invention

The embodiment of the application provides an alarm information clustering method, an alarm information clustering device and a storage medium, and solves the technical problem that alarm information in historical data cannot be reasonably classified at present.

In order to achieve the above purpose, the embodiment of the present application adopts the following technical solutions:

in a first aspect, a method for clustering alarm information is provided, including:

acquiring alarm information and characteristic information of the alarm information; the alarm information comprises a network element generating the alarm information and the time of generating the alarm information;

determining characteristic information to be clustered according to the alarm information; the feature information to be clustered includes: the network element proportion characteristic information or the time difference characteristic information; the network element proportion characteristic information is used for representing the proportion of the network element generating the alarm information in a preset network element set; the time difference characteristic information is used for representing the time difference between the time of generating the alarm information and the preset time;

and clustering the characteristic information to be clustered and the characteristic information of the alarm information based on a clustering algorithm to obtain a clustering result of the alarm information.

Optionally, when the feature information to be clustered includes the network element proportion feature information, determining the feature information to be clustered according to the alarm information, including:

dividing the alarm information into a plurality of sets according to a preset time period according to the sequence of the time for generating the alarm information; one set includes at least one alert message;

for each set, the following operations are performed to obtain the network element proportion characteristic information:

and acquiring the proportion of each network element in the plurality of network elements generating at least one alarm message in a set, and performing characteristic engineering processing on the proportion to obtain the network element proportion characteristic information of each network element.

Optionally, when a set includes an alarm message; the alarm information clustering method further comprises the following steps:

judging whether the network element generating the alarm information is consistent with the network element generating the target alarm information; the target alarm information is adjacent alarm information with one alarm information;

and if the set is consistent with the set to which the target alarm information belongs, merging the set and the set to which the target alarm information belongs into the same set.

Optionally, when the feature information to be clustered includes the time difference feature information, determining the feature information to be clustered according to the alarm information, including:

and acquiring the time difference between the time of generating the alarm information and the preset time, and executing characteristic engineering processing on the time difference to obtain time difference characteristic information.

Optionally, the alarm information clustering method further includes:

and when the alarm information comprises power failure alarm information, determining the power failure alarm information as a clustering result corresponding to the power failure alarm information.

Optionally, the alarm information clustering method further includes:

performing a first sequencing operation on the initial label value of each result in the clustering results of the alarm information to obtain a first label value of each result;

the first sequencing operation includes:

for a first result in the clustering results of the alarm information, determining a first label value L 'of the first result'₁＝1；

For the ith result in the clustering results of the alarm information, when the initial label value L of the ith result_iInitial tag value L equal to the i-1 st result_i-1When the ith result is determinedOf'_iFirst tag value L 'equal to i-1 results'_i-1(ii) a i is an integer greater than 1;

when the initial label value L of the ith result_iInitial tag value L not equal to the i-1 st result_i-1And there is an initial tag value L for the jth result_jEqual to the initial tag value L of the ith result_iThen, a first tag value L 'of the ith result is determined'_iFirst tag value L 'equal to jth result'_j(ii) a j is an integer greater than 1 and less than i;

when the initial label value L of the ith result_iInitial tag value L not equal to the i-1 st result_i-1And there is no initial tag value L for the jth result_jEqual to the initial tag value L of the ith result_iThen, a first tag value L 'of the ith result is determined'_i＝max{L′_j,j＜i}+1。

Optionally, after performing a first sorting operation on the initial tag value of each result in the clustering results of the alarm information to obtain the first tag value of each result, the method further includes:

performing a second sorting operation on the first tag value of each result to obtain a second tag value of each result;

the second sort operation includes:

when the first label value of the ith result is greater than or equal to the first label value of the (i-1) th result, determining the first label value of the ith result as a second label value of the ith result;

when the first label value of the ith result is smaller than the first label value of the (i-1) th result, determining a second label value L' of the ith result_i＝min(L′_i-1+1, CLUSTERS) and determining a second tag value L "of the result that is the same as the first tag value of the ith result_p＝min(L′_i-1+1, CLUSTERS; p is an integer greater than i; CLUSTERS is the category number of the clustering result of the alarm information.

In a second aspect, an alarm information clustering apparatus is provided, which includes: an acquisition unit and a processing unit;

the acquiring unit is used for acquiring the alarm information and the characteristic information of the alarm information; the alarm information comprises a network element generating the alarm information and the time of generating the alarm information;

the processing unit is used for determining the characteristic information to be clustered according to the alarm information; the feature information to be clustered includes: the network element proportion characteristic information or the time difference characteristic information; the network element proportion characteristic information is used for representing the proportion of the network element generating the alarm information in a preset network element set; the time difference characteristic information is used for representing the time difference between the time of generating the alarm information and the preset time;

and the processing unit is also used for clustering the characteristic information to be clustered and the characteristic information of the alarm information based on a clustering algorithm so as to obtain a clustering result of the alarm information.

Optionally, when the feature information to be clustered includes the network element proportion feature information, the processing unit is specifically configured to:

Optionally, when a set includes an alarm message; the processing unit is further configured to:

Optionally, when the feature information to be clustered includes the time difference feature information, the processing unit is specifically configured to:

Optionally, the processing unit is further configured to determine the power outage warning information as a clustering result corresponding to the power outage warning information when the warning information includes the power outage warning information.

Optionally, the processing unit is further configured to perform a first sorting operation on the initial tag value of each result in the clustering results of the alarm information to obtain a first tag value of each result;

the first sequencing operation includes:

For the ith result in the clustering results of the alarm information, when the initial label value L of the ith result_iInitial tag value L equal to the i-1 st result_i-1Then, a first tag value L 'of the ith result is determined'_iFirst tag value L 'equal to i-1 results'_i-1(ii) a i is an integer greater than 1;

Optionally, the processing unit is further configured to perform a second sorting operation on the first tag value of each result to obtain a second tag value of each result;

the second sort operation includes:

In a third aspect, an alarm information clustering device is provided, which includes a memory and a processor. The memory is used for storing computer execution instructions, and the processor is connected with the memory through a bus. When the alarm information clustering device runs, the processor executes computer execution instructions stored in the memory so as to enable the alarm information clustering device to execute the alarm information clustering method in the first aspect.

The alarm information clustering device may be a network device, or may be a part of a device in a network device, such as a chip system in a network device. The chip system is configured to support the network device to implement the functions related to the first aspect and any one of the possible implementations thereof, for example, to receive, determine, and shunt data and/or information related to the alarm information clustering method. The chip system includes a chip and may also include other discrete devices or circuit structures.

In a fourth aspect, a computer-readable storage medium is provided, where the computer-readable storage medium includes computer-executable instructions, and when the computer-executable instructions are executed on a computer, the computer is caused to execute the alarm information clustering method according to the first aspect.

In a fifth aspect, a computer program product is provided, which, when running on a computer, causes the computer to execute the alarm information clustering method according to the first aspect and any one of its possible designs.

It should be noted that all or part of the computer instructions may be stored on the first computer storage medium. The first computer storage medium may be packaged together with the processor of the alarm information clustering device, or may be packaged separately from the processor of the alarm information clustering device, which is not limited in this embodiment of the present application.

For the description of the second, third, fourth and fifth aspects of the present invention, reference may be made to the detailed description of the first aspect; in addition, for the beneficial effects of the second aspect, the third aspect, the fourth aspect and the fifth aspect, reference may be made to the beneficial effect analysis of the first aspect, and details are not repeated here.

In the embodiment of the present application, names of the above alarm information clustering apparatuses do not limit the devices or the function modules themselves, and in an actual implementation, the devices or the function modules may appear by other names. Insofar as the functions of the respective devices or functional blocks are similar to those of the present invention, they are within the scope of the claims of the present invention and their equivalents.

These and other aspects of the invention will be more readily apparent from the following description.

The technical scheme provided by the application at least brings the following beneficial effects:

in the application, the alarm information clustering device can acquire the alarm information and the characteristic information of the alarm information and determine the characteristic information to be clustered according to the alarm information. Subsequently, the alarm information clustering device clusters the characteristic information to be clustered and the characteristic information of the alarm information based on a clustering algorithm to obtain a clustering result of the alarm information. In the method, the clustering result is determined based on the characteristic information to be clustered including the network element proportion characteristic information (used for indicating the proportion of the network element generating the alarm information in the preset network element set) or the time difference characteristic information (used for indicating the time difference between the moment generating the alarm information and the preset moment), so that the accuracy of clustering the alarm information is improved.

Drawings

Fig. 1 is a schematic diagram of a hardware structure of an alarm information clustering device according to an embodiment of the present application;

fig. 2 is a schematic diagram of a hardware structure of another alarm information clustering device provided in the embodiment of the present application;

fig. 3 is a schematic flow chart of a training alarm information clustering model according to an embodiment of the present application;

fig. 4 is a schematic structural diagram of an alarm information clustering device according to an embodiment of the present application.

Detailed Description

The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application, and it is obvious that the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present invention.

It should be noted that in the embodiments of the present application, words such as "exemplary" or "for example" are used to indicate examples, illustrations or explanations. Any embodiment or design described herein as "exemplary" or "e.g.," is not necessarily to be construed as preferred or advantageous over other embodiments or designs. Rather, use of the word "exemplary" or "such as" is intended to present concepts related in a concrete fashion.

For the convenience of clearly describing the technical solutions of the embodiments of the present application, in the embodiments of the present application, the terms "first" and "second" are used to distinguish the same items or similar items with basically the same functions and actions, and those skilled in the art can understand that the terms "first" and "second" are not used to limit the quantity and execution order.

As described in the background, the basis for the use of artificial intelligence algorithms is a vast amount of historical data. The historical data is generally derived from a network management storage server, and is usually a data volume of several months. More than one fault information is usually contained in the historical data, and often the alarm information in one fault information has relevance to be analyzed.

In view of the above problems, an embodiment of the present application provides an alarm information clustering method, where an alarm information clustering device may obtain alarm information and feature information of the alarm information, and determine feature information to be clustered according to the alarm information. Subsequently, the alarm information clustering device clusters the characteristic information to be clustered and the characteristic information of the alarm information based on a clustering algorithm to obtain a clustering result of the alarm information. In the method, the clustering result is determined based on the characteristic information to be clustered including the network element proportion characteristic information (used for indicating the proportion of the network element generating the alarm information in the preset network element set) or the time difference characteristic information (used for indicating the time difference between the moment generating the alarm information and the preset moment), so that the accuracy of clustering the alarm information is improved.

The alarm information clustering device may be a device for predicting the performance of a device and a line corresponding to a target port, a chip in the device, or a system on chip in the device.

Optionally, the device may be a physical machine, for example: desktop computers, also called desktop computers (desktop computers), mobile phones, tablet computers, notebook computers, ultra-mobile personal computers (UMPCs), netbooks, Personal Digital Assistants (PDAs), and other terminal devices.

Optionally, the alarm information clustering device may also implement a function to be implemented by the alarm information clustering device through a Virtual Machine (VM) deployed on a physical machine.

For convenience of understanding, the following describes the structure of the alarm information clustering device in the embodiment of the present application.

Fig. 1 shows a hardware structure diagram of an alarm information clustering device according to an embodiment of the present application. As shown in fig. 1, the alarm information clustering device includes a processor 11, a memory 12, a communication interface 13, and a bus 14. The processor 11, the memory 12 and the communication interface 13 may be connected by a bus 14.

The processor 11 is a control center of the alarm information clustering device, and may be a single processor or a collective name of a plurality of processing elements. For example, the processor 11 may be a general-purpose Central Processing Unit (CPU), or may be another general-purpose processor. Wherein a general purpose processor may be a microprocessor or any conventional processor or the like.

For one embodiment, processor 11 may include one or more CPUs, such as CPU 0 and CPU 1 shown in FIG. 1.

The memory 12 may be, but is not limited to, a read-only memory (ROM) or other type of static storage device that may store static information and instructions, a Random Access Memory (RAM) or other type of dynamic storage device that may store information and instructions, an electrically erasable programmable read-only memory (EEPROM), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and that can be accessed by a computer.

In a possible implementation, the memory 12 may be present separately from the processor 11, and the memory 12 may be connected to the processor 11 via a bus 14 for storing instructions or program code. When the processor 11 calls and executes the instructions or program codes stored in the memory 12, the alarm information clustering method provided by the embodiment of the invention can be realized.

In another possible implementation, the memory 12 may also be integrated with the processor 11.

And a communication interface 13 for connecting with other devices through a communication network. The communication network may be an ethernet network, a radio access network, a Wireless Local Area Network (WLAN), or the like. The communication interface 13 may comprise a receiving unit for receiving data and a transmitting unit for transmitting data.

The bus 14 may be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, an Extended ISA (EISA) bus, or the like. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of illustration, only one thick line is shown in FIG. 1, but it is not intended that there be only one bus or one type of bus.

It is to be noted that the structure shown in fig. 1 does not constitute a limitation of the alarm information clustering means. In addition to the components shown in fig. 1, the alarm information clustering means may include more or fewer components than those shown, or combine some of the components, or a different arrangement of components.

Fig. 2 shows another hardware structure of the alarm information clustering device in the embodiment of the present application. As shown in fig. 2, the communication device may include a processor 21 and a communication interface 22. The processor 21 is coupled to a communication interface 22.

The function of the processor 21 may refer to the description of the processor 11 above. The processor 21 also has a memory function, and the function of the memory 12 can be referred to.

The communication interface 22 is used to provide data to the processor 21. The communication interface 22 may be an internal interface of the communication device, or may be an external interface (corresponding to the communication interface 13) of the alarm information clustering device.

It is noted that the structure shown in fig. 1 (or fig. 2) does not constitute a limitation of the alarm information clustering means, and the alarm information clustering means may include more or less components than those shown in fig. 1 (or fig. 2), or combine some components, or a different arrangement of components, in addition to the components shown in fig. 1 (or fig. 2).

The following describes in detail an alarm information clustering method provided in an embodiment of the present application with reference to the accompanying drawings.

As shown in fig. 3, the alarm information clustering method provided in the embodiment of the present application specifically includes:

s301, the alarm information clustering device obtains the alarm information and the characteristic information of the alarm information.

Specifically, the alarm information clustering device may obtain the alarm information from a database in which the alarm information is stored or a network element that generates the alarm information.

Wherein the alarm information comprises a network element generating the alarm information and the time of generating the alarm information.

The alarm information clustering device can also obtain the characteristic information of the alarm information.

Optionally, the warning information clustering device may perform feature engineering processing on the warning information after obtaining the warning information, so as to obtain the feature information of the warning information.

The feature engineering is a process of converting original data into training data of a model, and aims to obtain better training data features so that a machine learning model approaches the upper limit.

The characteristic engineering can improve the performance of the model, and sometimes, a good effect can be obtained even on a simple model. The feature engineering plays a very important role in machine learning, and generally includes three parts, namely feature construction, feature extraction and feature selection.

Feature extraction and feature selection are both to find the most efficient features from the original features. The difference between them is that feature extraction emphasizes a set of features with obvious physical or statistical significance by means of feature transformation.

And feature selection is to select a set of feature subsets with obvious physical or statistical significance from the feature set. Both can help to reduce the dimension and data redundancy of the features, sometimes more meaningful feature attributes can be found by feature extraction, and the importance of each feature to the model construction can often be represented by the process of feature selection.

S302, the alarm information clustering device determines characteristic information to be clustered according to the alarm information.

Specifically, after the alarm information is obtained, the alarm information clustering device may determine the feature information to be clustered according to the alarm information.

Wherein, waiting to cluster the characteristic information includes: the network element proportion characteristic information or the time difference characteristic information; the network element proportion characteristic information is used for representing the proportion of the network element generating the alarm information in a preset network element set; the time difference characteristic information is used for representing the time difference between the time of generating the alarm information and the preset time.

Optionally, when the feature information to be clustered is the network element proportion feature information, the method for determining the feature information to be clustered by the warning information clustering device according to the warning information specifically includes:

the alarm information clustering device divides the alarm information into a plurality of sets according to the sequence of the time for generating the alarm information and the preset time period.

Wherein one set comprises at least one alarm information.

The alarm information clustering device executes the following operations aiming at each set to obtain the network element proportion characteristic information:

For example, the alarm information clustering device may pre-group the acquired alarm information according to the sequence of the times of generating the alarm information, and the occurrence time is one group within two minutes.

For example, the time interval between the generation time and the grouping is adjusted through continuous experimental results. It should be noted that the time interval of the pre-grouping is selected such that the number of groups formed after the grouping is greater than or equal to the number of alarm groups.

Wherein each set of alarm information may be represented by a vector (a, b, c, d, e, …, t). a, b, c, d, e and … are different numbers of network elements, the length of the vector is the total number of network elements, and t represents the generation time of the first alarm message in the group.

Then, the alarm information clustering device counts the proportion of each network element in each group in the group.

For example, in a group of 10 pieces of alarm information, a vector (0, 0.5, 0.2, 0, 0.3, t) indicates that a network element appears 0 times, b network element appears 5 times, c network element appears 2 times, d network element appears 0 times, and e network element appears 3 times. The sum of all network element occupation ratios should be 1.

Optionally, when one set includes one alarm message, the alarm message clustering device determines whether the network element generating one alarm message is consistent with the network element generating the target alarm message.

Wherein, the target alarm information is the alarm information adjacent to one alarm information (i.e. the last alarm information of the previous group or the first alarm information of the next group).

If the set is consistent with the set to which the target alarm information belongs, the alarm information clustering device merges one set and the set to which the target alarm information belongs into the same set.

If the alarm information is inconsistent with the preset alarm information, the alarm information clustering device takes the set as a single group.

Optionally, when the feature information to be clustered includes the time difference feature information, the method for determining the feature information to be clustered by the alarm information clustering device according to the alarm information specifically includes:

the alarm information clustering device acquires the time difference between the time of generating the alarm information and the preset time, and executes characteristic engineering processing on the time difference to obtain time difference characteristic information.

For example, the alarm information clustering device may sort the acquired alarm information according to the sequence of the times when the alarm information is generated, and mark the sequence s of each alarm information.

Then, the alarm information clustering means calculates a time difference for generating each alarm information. The time difference of the first piece of alarm information is set to be 0, and then the time difference (which is converted into seconds as a measurement unit) between each piece of alarm information and the last piece of alarm information is calculated and recorded as t.

In this case, the alarm information clustering means may perform the feature engineering process on the time difference to obtain the time difference feature information. Each piece of alarm information may be represented by a vector (a, b, c, d, e, …, t, s), where a, b, c, d, e, … are different network element numbers. The length of the vector is the total number of the network elements.

S303, clustering the characteristic information to be clustered and the characteristic information of the alarm information by the alarm information clustering device based on a clustering algorithm to obtain a clustering result of the alarm information.

Specifically, after determining the feature information to be clustered according to the alarm information, the alarm information clustering device may cluster the feature information to be clustered and the feature information of the alarm information based on a clustering algorithm to obtain a clustering result of the alarm information.

Optionally, the clustering algorithm may also be a k-means-random algorithm, a k-means + + algorithm, or other clustering algorithms.

Optionally, when the feature information to be clustered is the network element proportion feature information, the alarm information clustering device may perform clustering on the alarm information whose occurrence time is within the same day by using a k-means clustering algorithm based on the network element proportion feature information, and details are not described here.

When the feature information to be clustered is the network element proportion feature information, clustering comprises two features: the network element proportion characteristic information and the characteristic information of the alarm information, and the data representation difference between the network element proportion characteristic information and the characteristic information of the alarm information is large (for example, the network element proportion characteristic information may be 0 to 1, and the time characteristic information in the characteristic information of the alarm information may be thousands of seconds by conversion).

In this case, in order to eliminate the difference, the alarm information clustering device needs to map different feature intervals to the same interval in a unified manner. Namely, the data is normalized and scaled to fall into the interval of [0,1 ].

In addition, in the clustering, for each element waiting for clustering, a feature vector is used as a measurement of the position of the feature vector. The core of the clustering algorithm is classification according to the distance between different elements. For data not on the same day, the distance needs to be multiplied by a larger anomaly coefficient to ensure that the data not on the same day is not grouped.

Optionally, when the feature information to be clustered is the time difference feature information, the alarm information clustering device may perform clustering on the alarm information whose occurrence time is within the same day by using a k-means clustering algorithm based on the time difference feature information, and details are not repeated here.

When the feature information to be clustered is time difference feature information, clustering comprises three features: the time difference characteristic information, the network element characteristic information in the characteristic information of the alarm information, and the sequence characteristic information, and the data representation difference between the three characteristics is relatively large (for example, 20 network elements may account for the ratio characteristic information from 1 to 20, the time characteristic information in the characteristic information of the alarm information may be converted into seconds to thousands, and the sequence characteristic information may be hundreds).

In addition, in the clustering, for each element waiting for clustering, a feature vector is used as a measurement of the position of the feature vector. The core of the clustering algorithm is classification according to the distance between different elements. For the alarm information which is not in the same day, the distance needs to be multiplied by a larger abnormal coefficient so as to ensure that the alarm information which is not in the same day is not grouped when the characteristic information to be clustered is determined.

Optionally, the alarm information clustering method further includes: when the alarm information includes power outage alarm information, the alarm information clustering means determines the power outage alarm information as a clustering result corresponding to the power outage alarm information.

Specifically, for the POWER failure alarm information, such as the alarm information with the alarm name POWER _ FAIL, the POWER failure alarm information is divided into one type because the POWER failure alarm needs to be reported separately.

For example, assuming that the alarm information needs to be divided into 18 groups in total, but one power-off alarm information occurs, the other data should be divided into 17 groups.

S304, the alarm information clustering device executes a first sequencing operation on the initial label value of each result in the clustering results of the alarm information to obtain a first label value of each result.

Wherein the first sequencing operation comprises:

when the initial label value L of the ith result_iInitial tag value L not equal to the i-1 st result_i-1And there is an initial tag value L for the jth result_iEqual to the initial tag value L of the ith result_iThen, a first tag value L 'of the ith result is determined'_iFirst tag value L 'equal to jth result'_j(ii) a j is an integer greater than 1 and less than i;

when the initial label value L of the ith result_iInitial tag value L not equal to the i-1 st result_i-1And there is no initial tag value L for the jth result_jEqual to the initial tag value L of the ith result_iThen, a first tag value L 'of the ith result is determined'_j＝max{L′_j,j＜i}+1。

Illustratively, the initial label value of the clustering result of the alarm information is (1, 3, 2, 3, 3, 4, 5).

For the initial tag value 1 of the 1 st result, the first tag value of the 1 st result is directly determined to be 1.

Initial tag value 3 for 2 nd result. The initial tag value of 3 for the 2 nd result is not equal to the initial tag value of 1 for the 1 st result, and the 2 nd result is not preceded by the same tag value as the initial tag value of 3 for the 2 nd result. In this case, the first tag value of the 2 nd result is determined to be the largest first tag value 1 preceding the 2 nd result plus 1 equals 2.

Initial tag value 2 for the 3 rd result. The initial tag value of 2 of the 3 rd result is not equal to the initial tag value of 3 of the 2 nd result, and the 3 rd result is not preceded by the same tag value as the initial tag value of 2 of the 3 rd result. In this case, the first tag value of the 3 rd result is determined to be the largest first tag value 2 preceding the 3 rd result plus 1 equals 3.

Initial tag value 3 for the 4 th result. The initial tag value of 3 for the 4 th result is not equal to the initial tag value of 2 for the 3 rd result, and the 4 th result is preceded by the initial tag value of 3 for a second result that is the same as the initial tag value of 3 for the 4 th result. In this case, the first tag value of the 4 th result is determined to be the first tag value of the second result, 2.

Initial tag value 3 for the 5 th result. The initial tag value of 3 for the 5 th result is equal to the initial tag value of 3 for the 4 th result. In this case, the first tag value of the 5 th result is determined to be the first tag value 2 of the 4 th result.

Initial tag value 4 for the 6 th result. The initial tag value of 4 for the 6 th result is not equal to the initial tag value of 3 for the 5 th result, and the 6 th result is not preceded by the same tag value as the initial tag value of 4 for the 6 th result. In this case, the first tag value of the 6 th result is determined to be the largest first tag value 3 preceding the 6 th result plus 1 equals 4.

Initial tag value 5 for the 7 th result. The initial tag value of 5 for the 7 th result is not equal to the initial tag value of 4 for the 6 th result, and the 7 th result is not preceded by the same tag value as the initial tag value of 5 for the 7 th result. In this case, the first tag value of the 7 th result is determined to be the largest first tag value 4 preceding the 7 th result plus 1 equals 5.

Namely, after the initial label value (1, 3, 2, 3, 3, 4, 5) of each result in the clustering results of the alarm information is subjected to the first sorting operation, the first label value of each result is obtained as: (1,2,3,2,2,4,5).

S305, the alarm information clustering device executes a second sorting operation on the first label value of each result to obtain a second label value of each result.

Wherein the second sort operation comprises:

when the first label value of the ith result is smaller than the first label value of the (i-1) th result, determining a second label value L' of the ith result_i＝min(L′_i-1+1, CLUSTERS) and determining a second tag value L "of the result that is the same as the first tag value of the ith result_p＝min(L′_i-1+1, CLUSTERS); p is an integer greater than i; CLUSTERS is the category number of the clustering result of the alarm information.

In connection with the above example, for the first tag value 1 of the 1 st result, the second tag value of the 1 st result is directly determined to be 1.

The first tag value for the 2 nd result is 2. When the first tag value 2 of the 2 nd result is greater than the first tag value 1 of the 1 st result, the first tag value 2 of the 2 nd result is determined as the second tag value 2 of the 2 nd result.

The first tag value for the 3 rd result is 3. When the first tag value 3 of the 3 rd result is greater than the first tag value 2 of the 2 nd result, the first tag value 3 of the 3 rd result is determined as the second tag value 3 of the 3 rd result.

The first tag value for the 4 th result is 2. If the first tag value 2 of the 4 th result is less than the first tag value 3 of the 3 rd result, then the second tag value of the 4 th result is determined to be the first tag value 3 of the 3 rd result plus 1 equal to 4.

The first tag value for the 5 th result is 2. When the first tag value 2 of the 5 th result is equal to the first tag value 2 of the 4 th result, the second tag value 4 of the 4 th result is determined as the second tag value 4 of the 5 th result.

The first tag value for the 6 th result is 4. If the first tag value 4 of the 6 th result is greater than the first tag value 2 of the 5 th result, then the second tag value of the 6 th result is determined to be the first tag value 4 of the 6 th result plus 1 equal to 5.

The first tag value for the 7 th result is 5. If the first tag value 5 of the 7 th result is greater than the first tag value 4 of the 6 th result, then the second tag value of the 7 th result is determined to be the first tag value 5 of the 7 th result plus 1 equal to 6.

That is, after the second sorting operation is performed on the first tag values (1, 2, 3, 2, 2, 4, 5), the second tag value of each result is: (1,2,3,4,4,5,6).

In summary, the alarm information clustering device may obtain the alarm information and the characteristic information of the alarm information, and determine the characteristic information to be clustered according to the alarm information. Subsequently, the alarm information clustering device clusters the characteristic information to be clustered and the characteristic information of the alarm information based on a clustering algorithm to obtain a clustering result of the alarm information. In the method, the clustering result is determined based on the characteristic information to be clustered including the network element proportion characteristic information (used for indicating the proportion of the network element generating the alarm information in the preset network element set) or the time difference characteristic information (used for indicating the time difference between the moment generating the alarm information and the preset moment), so that the accuracy of clustering the alarm information is improved.

Exemplarily, the alarm information clustering provided by the present application specifically includes:

the alarm information clustering device processes the power failure alarm information, namely, the power failure alarm information is divided into a group separately, and other alarm information except the power failure alarm information is grouped.

And then, the alarm information clustering device carries out characteristic engineering processing on the grouped alarm information to obtain a characteristic vector of the alarm information group.

Then, the alarm information clustering device performs normalization processing on the feature vectors of the alarm information groups.

Then, the alarm information clustering means calculates the distance between the alarm information groups after the normalization processing. Namely, the alarm information clustering device adopts a weight correction mode to the alarm information which is not in the same day, namely, the normalized information is multiplied by an abnormal coefficient, so as to ensure that the alarm information which is not in the same day is not grouped together.

And then, the alarm information clustering device clusters the information according to a clustering algorithm to obtain a clustering result.

And finally, the alarm information clustering device rearranges the clustering results to obtain sequentially ordered clustering results.

The scheme provided by the embodiment of the application is mainly introduced from the perspective of a method. To implement the above functions, it includes hardware structures and/or software modules for performing the respective functions. Those of skill in the art will readily appreciate that the various illustrative elements and algorithm steps described in connection with the embodiments disclosed herein may be implemented as hardware or combinations of hardware and computer software. Whether a function is performed as hardware or computer software drives hardware depends upon the particular application and design constraints imposed on the solution. Skilled artisans may implement the described functionality in varying ways for each particular application, but such implementation decisions should not be interpreted as causing a departure from the scope of the present invention.

In the embodiment of the present application, the alarm information clustering device may be divided into the functional modules according to the above method, for example, each functional module may be divided corresponding to each function, or two or more functions may be integrated into one processing module. The integrated module can be realized in a hardware mode, and can also be realized in a software functional module mode. Optionally, the division of the modules in the embodiment of the present application is schematic, and is only a logic function division, and there may be another division manner in actual implementation.

Fig. 4 is a schematic structural diagram of an alarm information clustering device according to an embodiment of the present application. The alarm information clustering device includes: an acquisition unit 401 and a processing unit 402;

an obtaining unit 401, configured to obtain alarm information and feature information of the alarm information; the alarm information comprises a network element generating the alarm information and the time of generating the alarm information;

the processing unit 402 is configured to determine feature information to be clustered according to the alarm information; the feature information to be clustered includes: the network element proportion characteristic information or the time difference characteristic information; the network element proportion characteristic information is used for representing the proportion of the network element generating the alarm information in a preset network element set; the time difference characteristic information is used for representing the time difference between the time of generating the alarm information and the preset time;

the processing unit 402 is further configured to cluster the feature information to be clustered and the feature information of the alarm information based on a clustering algorithm, so as to obtain a clustering result of the alarm information.

Optionally, when the feature information to be clustered includes the network element proportion feature information, the processing unit 402 is specifically configured to:

Optionally, when a set includes an alarm message; the processing unit 402 is further configured to:

Optionally, when the feature information to be clustered includes the time difference feature information, the processing unit 402 is specifically configured to:

Optionally, the processing unit 402 is further configured to determine the power outage warning information as a clustering result corresponding to the power outage warning information when the warning information includes the power outage warning information.

Optionally, the processing unit 402 is further configured to perform a first sorting operation on the initial tag value of each result in the clustering results of the alarm information to obtain a first tag value of each result;

the first sequencing operation includes:

Optionally, the processing unit 402 is further configured to perform a second sorting operation on the first tag value of each result to obtain a second tag value of each result;

the second sort operation includes:

Embodiments of the present application also provide a computer-readable storage medium, which includes computer-executable instructions. When the computer executes the instructions to run on the computer, the computer is enabled to execute the steps executed by the alarm information clustering device in the alarm information clustering method provided by the embodiment.

The embodiments of the present application further provide a computer program product, where the computer program product may be directly loaded into a memory and contains a software code, and after the computer program product is loaded and executed by a computer, the computer program product can implement each step executed by the alarm information clustering device in the alarm information clustering method provided in the foregoing embodiments.

In the above embodiments, the implementation may be wholly or partially realized by software, hardware, firmware, or any combination thereof. When implemented using a software program, may be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. The processes or functions according to the embodiments of the present application are generated in whole or in part when the computer-executable instructions are loaded and executed on a computer. The computer may be a general purpose computer, a special purpose computer, a network of computers, or other programmable device. The computer instructions may be stored on a computer readable storage medium or transmitted from one computer readable storage medium to another computer readable storage medium, for example, the computer instructions may be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wire (e.g., coaxial cable, fiber optic, Digital Subscriber Line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.). Computer-readable storage media can be any available media that can be accessed by a computer or can comprise one or more data storage devices, such as servers, data centers, and the like, that can be integrated with the media. The usable medium may be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., Solid State Disk (SSD)), among others.

Through the above description of the embodiments, it is clear to those skilled in the art that, for convenience and simplicity of description, the foregoing division of the functional modules is merely used as an example, and in practical applications, the above function distribution may be completed by different functional modules according to needs, that is, the internal structure of the device may be divided into different functional modules to complete all or part of the above described functions.

In the embodiments provided in the present invention, it should be understood that the disclosed apparatus and method may be implemented in other ways. For example, the above-described apparatus embodiments are merely illustrative, and for example, the division of the modules or units is only one logical function division, and there may be other division ways in actual implementation. For example, various elements or components may be combined or may be integrated into another device, or some features may be omitted, or not implemented. In addition, the shown or discussed mutual coupling or direct coupling or communication connection may be an indirect coupling or communication connection through some interfaces, devices or units, and may be in an electrical, mechanical or other form. Units described as separate parts may or may not be physically separate, and parts displayed as units may be one physical unit or a plurality of physical units, may be located in one place, or may be distributed to a plurality of different places. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of the embodiment.

In addition, functional units in the embodiments of the present invention may be integrated into one processing unit, or each unit may exist alone physically, or two or more units are integrated into one unit. The integrated unit can be realized in a form of hardware, and can also be realized in a form of a software functional unit. The integrated unit, if implemented in the form of a software functional unit and sold or used as a stand-alone product, may be stored in a readable storage medium. Based on such understanding, the technical solutions of the embodiments of the present application may be essentially or partially contributed to by the prior art, or all or part of the technical solutions may be embodied in the form of a software product, where the software product is stored in a storage medium and includes several instructions to enable a device (which may be a single chip, a chip, or the like) or a processor (processor) to execute all or part of the steps of the method according to the embodiments of the present invention. And the aforementioned storage medium includes: various media capable of storing program codes, such as a U disk, a removable hard disk, a ROM, a RAM, a magnetic disk, or an optical disk.

The above description is only for the specific embodiment of the present invention, but the scope of the present invention is not limited thereto, and any changes or substitutions that can be easily conceived by those skilled in the art within the technical scope of the present invention are included in the scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.

Claims

1. A method for clustering alarm information is characterized by comprising the following steps:

determining characteristic information to be clustered according to the alarm information; the feature information to be clustered includes: the network element proportion characteristic information or the time difference characteristic information; the network element proportion characteristic information is used for representing the proportion of the network element generating the alarm information in a preset network element set; the time difference characteristic information is used for representing the time difference between the time of generating the alarm information and a preset time;

2. The method for clustering alarm information according to claim 1, wherein when the feature information to be clustered includes the network element proportion feature information, the determining the feature information to be clustered according to the alarm information includes:

for each set, performing the following operations to obtain the network element occupation feature information:

and acquiring the proportion of each network element in the set in a plurality of network elements generating the at least one alarm message, and performing feature engineering processing on the proportion to obtain the network element proportion feature information of each network element.

3. The alarm information clustering method according to claim 2, wherein when the one set includes one alarm information; the alarm information clustering method further comprises the following steps:

judging whether the network element generating the alarm information is consistent with the network element generating the target alarm information; the target alarm information is adjacent to the alarm information;

4. The alarm information clustering method according to claim 1, wherein when the feature information to be clustered includes the time difference feature information, the determining the feature information to be clustered according to the alarm information includes:

and acquiring the time difference between the time of generating the alarm information and a preset time, and executing characteristic engineering processing on the time difference to obtain the time difference characteristic information.

5. The alarm information clustering method according to claim 1, further comprising:

6. The alarm information clustering method according to claim 1, further comprising:

the first sequencing operation comprises:

determining a first label value L 'of a first result in the clustering results of the alarm information'₁＝1；

For the ith result in the clustering results of the alarm information, when the initial label value L of the ith result_iInitial tag value L equal to the i-1 st result_i-1Then, determining a first tag value L 'of the ith result'_iA first tag value L 'equal to the i-1 results'_i-1(ii) a i is an integer greater than 1;

when the initial label value L of the ith result_iInitial tag value L not equal to the i-1 th result_i-1And there is an initial tag value L for the jth result_jAn initial tag value L equal to the ith result_iThen, determining a first tag value L 'of the ith result'_iA first tag value L 'equal to the jth result'_j(ii) a j is an integer greater than 1 and less than i;

when the initial label value L of the ith result_iInitial tag value L not equal to the i-1 th result_i-1And there is no initial tag value L for the jth result_jAn initial tag value L equal to the ith result_iThen, determining the ithThe first tag value of result L'_i＝max{L′_j,j＜i}+1。

7. The method for clustering alarm information according to claim 6, wherein the performing a first sorting operation on the initial tag value of each result in the clustered results of alarm information to obtain the first tag value of each result further comprises:

the second sort operation comprises:

determining the first tag value of the ith result as a second tag value of the ith result when the first tag value of the ith result is greater than or equal to the first tag value of the (i-1) th result;

determining a second tag value L "of the ith result when the first tag value of the ith result is less than the first tag value of the (i-1) th result_i＝min(L′_i-1+1, CLUSTERS) and determining a second tag value L "of the result that is the same as the first tag value of the ith result_p＝min(L′_i-1+1, CLUSTERS); p is an integer greater than i; CLUSTERS is the category number of the clustering result of the alarm information.

8. An alarm information clustering apparatus, comprising: an acquisition unit and a processing unit;

the acquiring unit is used for acquiring alarm information and characteristic information of the alarm information; the alarm information comprises a network element generating the alarm information and the time of generating the alarm information;

the processing unit is used for determining the characteristic information to be clustered according to the alarm information; the feature information to be clustered includes: the network element proportion characteristic information or the time difference characteristic information; the network element proportion characteristic information is used for representing the proportion of the network element generating the alarm information in a preset network element set; the time difference characteristic information is used for representing the time difference between the time of generating the alarm information and a preset time;

the processing unit is further configured to cluster the feature information to be clustered and the feature information of the alarm information based on a clustering algorithm, so as to obtain a clustering result of the alarm information.

9. The apparatus for clustering alarm information according to claim 8, wherein when the feature information to be clustered includes the network element proportion feature information, the processing unit is specifically configured to:

10. The alarm information clustering device according to claim 9, wherein when the one set includes one alarm information; the processing unit is further to:

11. The alarm information clustering device according to claim 8, wherein when the feature information to be clustered includes the time difference feature information, the processing unit is specifically configured to:

12. The apparatus according to claim 8, wherein the processing unit is further configured to determine the power outage warning information as a clustering result corresponding to the power outage warning information when the warning information includes the power outage warning information.

13. The alarm information clustering device according to claim 8, wherein the processing unit is further configured to perform a first sorting operation on an initial tag value of each result in the clustering results of the alarm information to obtain a first tag value of each result;

the first sequencing operation comprises:

when the initial label value L of the ith result_iInitial tag value L not equal to the i-1 th result_i-1And there is no initial tag value L for the jth result_jAn initial tag value L equal to the ith result_iThen, determining a first tag value L 'of the ith result'_i＝max{L′_j,j＜i}+1。

14. The alarm information clustering device according to claim 13, wherein the processing unit is further configured to perform a second sorting operation on the first tag value of each result to obtain a second tag value of each result;

the second sort operation comprises:

determining a second tag value L "of the ith result when the first tag value of the ith result is less than the first tag value of the (i-1) th result_i＝min(L′_i-1+1, CLUSTERS) and determining a second tag value L "of the result that is the same as the first tag value of the ith result_p＝min(L′_i-1+1, CLUSTERS; p is an integer greater than i; CLUSTERS is the category number of the clustering result of the alarm information.

15. The alarm information clustering device is characterized by comprising a memory and a processor; the memory is used for storing computer execution instructions, and the processor is connected with the memory through a bus;

when the alarm information clustering device is operated, the processor executes the computer-executable instructions stored in the memory to cause the alarm information clustering device to perform the alarm information clustering method according to any one of claims 1 to 7.

16. A computer-readable storage medium, comprising computer-executable instructions that, when executed on a computer, cause the computer to perform the alarm information clustering method according to any one of claims 1 to 7.