CN114416500A

CN114416500A - Alarm information identification method, device and equipment based on information system

Info

Publication number: CN114416500A
Application number: CN202111592587.6A
Authority: CN
Inventors: 徐龙; 高文宏; 郭靖
Original assignee: Agricultural Bank of China
Current assignee: Agricultural Bank of China
Priority date: 2021-12-23
Filing date: 2021-12-23
Publication date: 2022-04-29

Abstract

The application provides an alarm information identification method, device and equipment based on an information system. The method comprises the following steps: acquiring alarm information to be identified; matching the alarm information to be identified with the alarm feature set to obtain a corresponding matching result; the alarm feature set comprises a plurality of alarm features, and the alarm feature set is determined based on keywords and result categories of historical alarm information; the result type is used for indicating whether the historical alarm information represents that the information system has a fault; the matching result represents whether the alarm information to be identified is matched with the alarm characteristics in the alarm characteristic set or not; and if the matching result represents that the alarm information to be identified is matched with the alarm characteristics in the alarm characteristic set, determining the alarm information to be identified as effective alarm information. The method can identify effective alarm information quickly and accurately, improve the screening efficiency of the alarm information, help relevant workers to find and process corresponding faults in time, and improve the fault processing efficiency of an information system.

Description

Alarm information identification method, device and equipment based on information system

Technical Field

The present application relates to the field of computer technologies, and in particular, to a method, an apparatus, and a device for identifying alarm information based on an information system.

Background

With the development of computer and network technologies, information systems are more and more widely used, and when a node in the information system fails, normal work of the whole system may be affected, so that the information system needs to be monitored, and when the system is detected to fail, alarm information is sent to remind relevant workers of corresponding failure processing.

At present, each line in an information system is monitored through a monitoring system, various monitoring indexes can be defined by users, and flexible and mobile monitoring can be carried out. With the increasingly powerful functions and the increasingly complex architecture of the information system, the monitoring system has more and more monitoring ranges, time points, states and indexes, more and more alarm information and more complicated contents.

However, a large amount of invalid alarm information may exist in the alarm information generated by the current monitoring system, so that the valid alarm information is submerged, and thus, the relevant staff needs to spend a lot of time to screen important and urgent alarm information from the alarm information with a large amount and a complex content, and the screening efficiency of the alarm information is low, thereby affecting the fault processing efficiency of the information system.

Disclosure of Invention

The application provides an alarm information identification method, device and equipment based on an information system, which are used for solving the problem of low alarm information screening efficiency.

In a first aspect, the present application provides an alarm information identification method based on an information system, including:

acquiring alarm information to be identified;

matching the alarm information to be identified with a preset alarm feature set to obtain a corresponding matching result; the alarm feature set comprises a plurality of alarm features, and the alarm feature set is determined based on keywords and result categories of historical alarm information; the result type is used for indicating whether the historical alarm information represents that the information system has a fault; the matching result represents whether the alarm information to be identified is matched with the alarm characteristics in the alarm characteristic set or not;

and if the matching result represents that the alarm information to be identified is matched with the alarm characteristics in the alarm characteristic set, determining that the alarm information to be identified is effective alarm information.

In a second aspect, the present application provides an alarm information recognition apparatus based on an information system, including:

the acquisition module is used for acquiring alarm information to be identified;

the matching module is used for matching the alarm information to be identified with a preset alarm feature set to obtain a corresponding matching result; the alarm feature set comprises a plurality of alarm features, and the alarm feature set is determined based on keywords and result categories of historical alarm information; the result type is used for indicating whether the historical alarm information represents that the information system has a fault; the matching result represents whether the alarm information to be identified is matched with the alarm characteristics in the alarm characteristic set or not;

and the determining module is used for determining that the alarm information to be identified is effective alarm information if the matching result represents that the alarm information to be identified is matched with the alarm characteristics in the alarm characteristic set.

In a third aspect, the present application provides a computer device comprising: a processor and a memory communicatively coupled to the processor; the memory stores computer-executable instructions; the processor executes computer-executable instructions stored by the memory to implement the method as described in the first aspect above.

In a fourth aspect, the present application provides a computer-readable storage medium having stored thereon computer-executable instructions for implementing the method according to the first aspect when executed by a processor.

In a fifth aspect, the present application provides a computer program product comprising a computer program which, when executed by a processor, implements the method as described in the first aspect above.

According to the alarm information identification method, device and equipment based on the information system, alarm information to be identified is obtained; matching the alarm information to be identified with the alarm feature set to obtain a corresponding matching result; the alarm feature set comprises a plurality of alarm features, and the alarm feature set is determined based on keywords and result categories of historical alarm information; the result type is used for indicating whether the historical alarm information represents that the information system has a fault; the matching result represents whether the alarm information to be identified is matched with the alarm characteristics in the alarm characteristic set or not; and if the matching result represents that the alarm information to be identified is matched with the alarm characteristics in the alarm characteristic set, determining the alarm information to be identified as effective alarm information. The alarm feature set objectively embodies the features of possible high fault risk, can be used as a basis for evaluating the effectiveness and importance degree of the alarm information, and can quickly and accurately identify the effective alarm information through the matching result of the alarm information and the alarm feature set, so that the alarm information screening efficiency is improved, related workers can find and process corresponding faults in time, and the fault processing efficiency of an information system is improved.

Drawings

The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and together with the description, serve to explain the principles of the application.

FIG. 1 is a flow chart illustrating an information system-based method for identifying alarm information in one embodiment;

FIG. 2 is a flowchart illustrating a method for obtaining a first set of alert features according to an embodiment;

FIG. 3 is a flowchart illustrating a step of extracting keywords based on all historical alert information to obtain a first keyword set of all historical alert information in one embodiment;

FIG. 4 is a flowchart illustrating a step of obtaining a first set of alert features according to keywords and their weights in first feature vectors according to an embodiment;

FIG. 5 is a flowchart illustrating a method for obtaining a second set of alert features according to an embodiment;

FIG. 6 is a flowchart illustrating a step of extracting keywords based on all the first type of historical warning information to obtain a second keyword set of all the first type of historical warning information in one embodiment;

FIG. 7 is a flowchart illustrating an information system-based alert information identification method according to an embodiment;

FIG. 8 is a diagram illustrating an exemplary configuration of an alert information recognition apparatus based on an information system;

FIG. 9 is a diagram illustrating an exemplary configuration of an alert information recognition apparatus based on an information system;

FIG. 10 is a schematic diagram showing a configuration of a computer device according to an embodiment;

FIG. 11 is a block diagram of a computer device in one embodiment.

With the above figures, there are shown specific embodiments of the present application, which will be described in more detail below. These drawings and written description are not intended to limit the scope of the inventive concepts in any manner, but rather to illustrate the inventive concepts to those skilled in the art by reference to specific embodiments.

Detailed Description

Reference will now be made in detail to the exemplary embodiments, examples of which are illustrated in the accompanying drawings. When the following description refers to the accompanying drawings, like numbers in different drawings represent the same or similar elements unless otherwise indicated. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present application. Rather, they are merely examples of apparatus and methods consistent with certain aspects of the present application, as detailed in the appended claims.

The terms referred to in this application are explained first:

and (3) warning information: the method comprises the steps that after a monitoring unit detects that an information system has a fault, fault related information is sent out through an appointed signal;

effective alarm information: the alarm information refers to alarm information that after receiving a fault signal sent by a monitoring unit, relevant workers need to execute certain operation to solve the fault;

and (3) weighting: the importance degree of a certain factor or index relative to a certain event is represented by the percentage of the certain factor or index, and the relative importance degree of certain factor or index is emphasized, and the contribution degree or importance is more biased.

The specific application scenario of the application is a monitoring alarm system for monitoring and alarming a bank information system, wherein the monitoring alarm system monitors each line (such as a science and technology line, a business line and the like) in the bank information system, and when a fault (including a hardware fault and a software fault) of the bank information system is detected, corresponding alarm information is sent out to remind related staff of carrying out corresponding fault processing.

Along with the functions of the bank information system becoming more and more powerful and the architecture becoming more and more complex, the monitoring alarm system becomes more and more in required monitoring range, time point, state and index, the generated alarm information becomes more and more complex. However, a large amount of invalid alarm information may exist in the alarm information generated by the monitoring alarm system, so that the valid alarm information is submerged, and the existing monitoring alarm system lacks a method for identifying the validity and importance of the alarm information, so that the relevant staff needs to spend more time to screen out important and urgent alarm information from the alarm information with huge number and complex content, the screening efficiency of the alarm information is low, and the fault processing efficiency of the information system is affected.

The application provides an alarm information identification method, device and equipment based on an information system, and aims to solve the technical problems in the prior art.

The following describes the technical solutions of the present application and how to solve the above technical problems with specific embodiments. The following several specific embodiments may be combined with each other, and details of the same or similar concepts or processes may not be repeated in some embodiments. Embodiments of the present application will be described below with reference to the accompanying drawings.

In one embodiment, as shown in fig. 1, a flowchart of an alarm information identification method based on an information system is provided, and the method includes the following steps S101 to S103.

And S101, acquiring alarm information to be identified.

The execution subject of this embodiment may be a server, a terminal, or a system including a server and a terminal, which is not limited in this respect. In this embodiment, an execution subject is described as a server where the monitoring alarm system is located.

The server acquires the alarm information to be identified from the alarm information generated by the monitoring alarm system, wherein the alarm information to be identified can be understood as each piece of alarm information generated by the monitoring alarm system.

In one example, the server periodically identifies the alarm information generated by the monitoring alarm system, and screens out effective alarm information from the alarm information and feeds the effective alarm information back to relevant staff for processing. For example, the server acquires all the alarm information generated by the monitoring alarm system in the previous day at nine am every day, and identifies whether the alarm information is valid alarm information by taking each piece of alarm information as the alarm information to be identified.

S102, matching the alarm information to be identified with a preset alarm feature set to obtain a corresponding matching result; the alarm feature set comprises a plurality of alarm features, and the alarm feature set is determined based on keywords and result categories of historical alarm information; the result type is used for indicating whether the historical alarm information represents that the information system has a fault; the matching result represents whether the alarm information to be identified is matched with the alarm characteristics in the alarm characteristic set.

The historical alarm information refers to alarm information generated by a monitoring alarm system in the past, and the result category of the historical alarm information is known. The result types of the historical alarm information comprise two types, wherein the first type represents that the information system has a fault, and the second type does not represent that the information system has a fault.

For example, the first type of history alarm information may be alarm information including information such as a hardware fault, a web page error, a payment error, or an index abnormality, which means that the system actually has a fault and needs to be fed back to a relevant worker for corresponding processing.

For example, the second type of historical alarm information may include, but is not limited to, alarm information for testing (alarm information for testing generated by a monitoring alarm system when the monitoring alarm system is accessed for the first time by the system to be monitored), alarm information lacking key content (such as system name, module name, specific fault description, and the like), which is not fault information, or is uncertain whether fault information is fault information or not, or has no practical significance for fault resolution, and may not be fed back to the relevant staff.

In an example, the result category of the historical alarm information may be identified by a fault flag. For example, if the relevant staff determines that a certain alarm information representation information system has a fault or performs corresponding fault processing on a certain alarm information, a fault flag is added to the alarm information, and the fault flag is used for indicating that the alarm information representation information system has a fault. Therefore, when a certain historical alarm information is identified to carry a fault mark, the result category of the historical alarm information is determined to be the first category.

The keywords of the historical alarm information can be understood as words having significance in distinguishing the result categories. For example, if one or more keywords that are more biased toward the first-class result are included in one alarm message, the alarm message is more likely to indicate that the information system has a fault, i.e., the alarm message may be considered as an effective alarm message that needs to be fed back to the relevant staff for corresponding processing.

The alarm characteristic set is determined based on the keywords of the historical alarm information and the result category, each alarm characteristic in the alarm characteristic set can be a keyword screened from the keywords of the historical alarm information or a keyword combination consisting of a plurality of keywords screened from the keywords of the historical alarm information, the characteristic of high fault risk can be objectively reflected, and the alarm characteristic set can be used as a basis for evaluating the effectiveness and the importance degree of the alarm information.

In one example, the alarm information to be identified is matched with the alarm feature set, including matching the alarm information to be identified with each alarm feature in the alarm feature set, and determining whether the alarm information to be identified is matched with the alarm feature according to whether the alarm information to be identified contains the alarm feature. If the alarm information to be identified contains a certain alarm characteristic, the alarm information to be identified is considered to be matched with the alarm characteristic; and if the alarm information to be identified does not contain a certain alarm characteristic, the alarm information to be identified is considered not to be matched with the alarm characteristic.

S103, if the matching result represents that the alarm information to be identified is matched with the alarm characteristics in the alarm characteristic set, the alarm information to be identified is determined to be effective alarm information.

In one example, when the alarm information to be identified is matched with at least one alarm feature in the alarm feature set, the alarm information to be identified is determined to be valid alarm information. Namely, as long as the alarm information to be identified is matched with one alarm characteristic, the alarm information to be identified is considered as effective alarm information, so that the effective alarm information can be screened out more comprehensively.

In one example, when the alarm information to be identified is matched with at least a preset proportion of alarm features in the alarm feature set, the alarm information to be identified is determined to be effective alarm information. For example, if the number of the alarm features in the alarm feature set is 10 and the preset proportion is 50%, when the alarm information to be identified is matched with at least 5 alarm features in the alarm feature set, the alarm information to be identified is determined to be effective alarm information, which is beneficial to more accurately screening out the effective alarm information.

In the embodiment, alarm information to be identified is obtained; matching the alarm information to be identified with the alarm feature set to obtain a corresponding matching result; the alarm feature set comprises a plurality of alarm features, and the alarm feature set is determined based on keywords and result categories of historical alarm information; the result type is used for indicating whether the historical alarm information represents that the information system has a fault; the matching result represents whether the alarm information to be identified is matched with the alarm characteristics in the alarm characteristic set or not; and if the matching result represents that the alarm information to be identified is matched with the alarm characteristics in the alarm characteristic set, determining the alarm information to be identified as effective alarm information. The alarm feature set objectively embodies the features of possible high fault risk, can be used as a basis for evaluating the effectiveness and importance degree of the alarm information, and can quickly and accurately identify the effective alarm information through the matching result of the alarm information and the alarm feature set, so that the alarm information screening efficiency is improved, related workers can find and process corresponding faults in time, and the fault processing efficiency of an information system is improved.

In one embodiment, the set of alert features includes a first set of alert features and/or a second set of alert features; the alarm characteristics in the first alarm characteristic set comprise alarm characteristics obtained based on all historical alarm information in a preset historical time period; the alarm features in the second alarm feature set include alarm features obtained based on first-class historical alarm information in a preset historical time period, and the first-class historical alarm information is historical alarm information representing that the information system has a fault.

The preset historical period may be set according to actual needs, for example, three months in the past, six months in the past, one year in the past, and the like, which is not limited thereto.

All historical alarm information in a preset historical period refers to all historical alarm information generated by a monitoring alarm system in the preset historical period, and the historical alarm information includes first type historical alarm information representing that an information system has a fault and second type historical alarm information not representing that the information system has the fault. The first type of historical alarm information and the second type of historical alarm information are fused, so that the information is richer and more comprehensive, and the second type of historical alarm information possibly contains fault information with potential fault risks although the fault of the information system is not clearly represented, so that the method has a certain auxiliary effect on the identification of the effectiveness and the importance degree of the alarm information.

In an example, the set of alert characteristics may include only the first set of alert characteristics. The first alarm characteristic set obtained by comprehensively considering the first type of historical alarm information and the second type of historical alarm information can comprehensively represent the characteristics possibly with high fault risk, so that the effective alarm information can be accurately identified through the matching result of the alarm information and the first alarm characteristic set.

The first type of historical alarm information in the preset historical period refers to the historical alarm information representing that the information system has a fault in all the historical alarm information generated by the monitoring alarm system in the preset historical period, and does not include the historical alarm information not representing that the information system has a fault.

In an example, the set of alert characteristics may include only the second set of alert characteristics. The second alarm characteristic set obtained by only considering the first type of historical alarm information can more specifically reflect the characteristics possibly with high fault risk, and the obvious effective alarm information can be more accurately identified through the matching result of the alarm information and the second alarm characteristic set.

In an example, the set of alert features may also include both the first set of alert features and the second set of alert features. The first alarm characteristic set and the second alarm characteristic set may have the same elements or different elements, the alarm characteristic set is a union of the first alarm characteristic set and the second alarm characteristic set, and effective alarm information can be comprehensively and accurately identified according to a matching result of the alarm information and the union.

It should be noted that the alarm feature set of the embodiment is predetermined by the server, and when the server identifies the newly generated alarm information, the server may directly obtain the predetermined alarm feature set and match the alarm information with the predetermined alarm feature set, without generating the alarm feature set in real time. In one example, the server updates the set of alert features on a periodic basis, such as once a quarter of a year.

In one embodiment, as shown in fig. 2, a flowchart of a method for acquiring a first set of alert features is provided, and the method includes the following steps S201 to S206.

S201, all historical alarm information in a preset historical time period is obtained, wherein all the historical alarm information comprises first type historical alarm information representing that an information system has faults and second type historical alarm information not representing that the information system has faults.

For the detailed description of this step, reference may be made to the foregoing embodiments, which are not described herein again.

S202, extracting keywords based on all historical alarm information to obtain a first keyword set of all historical alarm information.

The existing keyword extraction algorithm (for example, TextRank algorithm) or a keyword extraction algorithm which may appear in the future can be adopted to extract keywords in all the historical alarm information, and the first keyword set is obtained based on the extracted keywords.

In an example, as shown in fig. 3, the step of extracting keywords based on all historical alert information to obtain a first keyword set of all historical alert information may specifically include the following steps S301 to S304.

S301, all historical warning information is divided into a plurality of sentences, word segmentation and part-of-speech tagging processing are carried out on each sentence, and words with specified parts-of-speech are determined as first candidate keywords.

Taking all the historical alarm information as a text T, and segmenting the text T according to complete sentences to obtain a plurality of sentences, namely:

T＝[S₁,S₂,S₃...,S_M]

S_irepresenting the divided sentence, i is more than or equal to 1 and less than or equal to M, and matching the sentence S_iPerforming word segmentation and part-of-speech tagging, and only keeping words with specified parts-of-speech (such as nouns, verbs and adjectives) as candidate keywords, namely:

S_i＝[t_i1,t_i2,t_i3...t_in]

t_ijrepresenting a sentence S_iJ is more than or equal to 1 and less than or equal to n. Therefore, the candidate keywords of each sentence can be obtained, and all sentences can be obtainedThe candidate keyword is used as a first candidate keyword.

S302, calculating the weight of each first candidate keyword according to the co-occurrence relation of different first candidate keywords in a preset word length window.

The co-occurrence relationship of the different first candidate keywords in the preset vocabulary length window refers to whether the different first candidate keywords appear in the preset vocabulary length window of the text T at the same time. The preset vocabulary length refers to the number of words, for example, the preset vocabulary length is set to K, i.e., the window size is K, and at most K words co-occur.

Constructing a first candidate keyword graph G ═ (V, E), wherein V represents a node, namely each first candidate keyword; and E represents the nodes and the edges between the nodes, and is constructed by using the co-occurrence relation of different first candidate keywords in a preset word length window. When the vocabularies corresponding to the two nodes are shared in the preset vocabulary length window, an edge exists between the two nodes. According to the following formula:

and iteratively propagating the weight of each node until convergence, and obtaining the weight of each first candidate keyword. Wherein WS (V)_i) Represents a node V_iThe weight of (c); WS (V)_j) Represents a node V_jThe weight of (c); in (V)_i) Indicating a pointing node V_iA set of (a); out (V)_i) Represents a node V_iA set of pointed points; omega_jiRepresents a node V_iAnd node V_jThe weight of the edges between the nodes, the edges between different nodes are connected with different importance degrees; d represents a damping coefficient, and the value range is 0-1.

The weight of the first candidate keyword is used for representing the importance of the first candidate keyword in the historical alarm information, and the larger the weight of the first candidate keyword is, the more important the first candidate keyword is in the historical alarm information, and correspondingly, the more important the first candidate keyword is for identifying effective alarm information.

S303, sorting the weights of the first candidate keywords from big to small, taking the first candidate keywords with the preset number and the top weight sorting as the first keywords, and if a plurality of first keywords form adjacent phrases in the historical alarm information, combining the first keywords into a second keyword.

And ranking the weight of each first candidate keyword from large to small, wherein the more the weight ranking of the first candidate keyword is, the more important the first candidate keyword is. The first candidate keywords with the preset number (represented by N) and the weight ranking at the top are taken as the first keywords, namely the most important N first candidate keywords are kept as the first keywords, and the identification accuracy of effective alarm information is improved. The specific value of N may be set according to actual requirements, and is not limited herein.

And if a plurality of first keywords form an adjacent phrase in the historical alarm information, combining the plurality of first keywords into a second keyword. For example, "pay" and "fail" are two first keywords, and the two first keywords form an adjacent phrase "pay fail" in the historical alert information, and the two first keywords "pay" and "fail" are combined into a second keyword "pay fail", and it is understood that the second keyword is a keyword combination.

S304, forming a first keyword set of all historical alarm information according to the first keyword and the second keyword.

And combining the first keyword and the second keyword to obtain a first keyword set of all historical alarm information, wherein the keywords in the first keyword set comprise the first keyword and the second keyword.

S203, converting each first type of historical alarm information into a corresponding first characteristic vector, and converting each second type of historical alarm information into a corresponding second characteristic vector; the first feature vector comprises keywords which are matched with the corresponding first type of historical alarm information in the first keyword set, and the second feature vector comprises keywords which are matched with the corresponding second type of historical alarm information in the first keyword set.

And for each piece of first-class historical alarm information, matching the first-class historical alarm information with each keyword in a first keyword set, and forming a first feature vector corresponding to the first-class historical alarm information based on the matched keyword. And for each piece of second-class historical alarm information, matching the second-class historical alarm information with each keyword in the first keyword set, and forming a second feature vector corresponding to the second-class historical alarm information based on the matched keyword. Accordingly, a certain historical alarm information T_iCan be converted into a feature vector S consisting of n keywords_iAs follows:

T_i--＞S_i＝[S_i1,S_i2,S_i3...,S_in]

defining the result category of the historical alarm information as S_R，S_RWhen 1, it represents the first type of history alarm information, S_RWhen the alarm is-1, the second type of historical alarm information is represented, and S is set_RAdded to the feature vector S_iIn the method, an alarm vector S containing keywords and results is obtained_inew：

S_inew＝[S_i1,S_i2,S_i3...,S_in,S_R]

S204, randomly selecting one feature vector from the first feature vector and the second feature vector, determining the similar neighbor feature vector according to the Euclidean distance between the feature vector and the similar feature vector, and determining the dissimilar neighbor feature vector according to the Euclidean distance between the feature vector and the dissimilar feature vector.

The similar characteristic vector refers to the characteristic vector of each piece of historical alarm information with the same category as the historical alarm information corresponding to the selected characteristic vector, and the similar characteristic vector refers to the characteristic vector of each piece of historical alarm information with different category from the historical alarm information corresponding to the selected characteristic vector.

For example, if the selected feature vector is a first feature vector corresponding to the first type of historical alarm information, the similar feature vector includes first feature vectors of all other first type of historical alarm information, and the heterogeneous feature vector includes second feature vectors of all second type of historical alarm information.

And calculating Euclidean distances between the selected feature vectors and the similar feature vectors, and taking the similar feature vectors with the nearest k Euclidean distances as similar neighbor feature vectors. And calculating Euclidean distances between the selected feature vectors and the different feature vectors, and taking the k different feature vectors with the nearest Euclidean distances as the different neighbor feature vectors. k is a positive integer, and the specific value can be set according to actual requirements, which is not limited here.

S205, obtaining the weight of each keyword in the first keyword set according to the distribution difference of each keyword in the same-class neighboring feature vectors and the distribution difference of each keyword in different-class neighboring feature vectors.

If a keyword is associated with a classification, the distribution of the keyword in the same class of neighboring feature vectors should be similar, and the distribution in different classes of neighboring feature vectors should be dissimilar. Based on the above, the weight of each keyword in the first keyword set can be calculated according to the distribution difference of each keyword in the first keyword set in the similar neighbor feature vectors and the distribution difference of each keyword in the different neighbor feature vectors, where the weight is used for representing the classification capability of the keyword, and the larger the weight of the keyword is, the higher the contribution degree of the keyword to the classification is, that is, the stronger the classification capability of the keyword is, so that the more important the identification of the effective alarm information is.

The weights of the keywords in the first keyword set may be calculated by using an existing feature extraction algorithm (e.g., the ReliefF algorithm) or a feature extraction algorithm that may appear in the future.

In one example, the weights (W) of the keywords in the first keyword set_init) Calculated by the following formula:

wherein, diff (A, R, H)_j) Representing a feature vector R and a nearest neighbor feature vector of the same kind H_jIn the feature AIf the feature A is present in both R and H_jIn (1), diff (A, R, H)_j) If feature a is not present in both R and H ═ 0_jIn (1), diff (A, R, H)_j)＝1；diff(A,R,M_j(c) Means feature vector R and heterogeneous neighbor feature vector M_j(c) The difference in characteristic A if characteristic A is present in both R and M_j(c) In (1), diff (A, R, M)_j(c) 0 if feature a is not present in both R and H_jIn (1), diff (A, R, M)_j(c) 1); m represents the total number of the feature vectors; p (c) is the proportion of the class different from the randomly selected feature vector class, and P (class (R)) is the proportion of the randomly selected feature vector class.

S206, obtaining a first alarm characteristic set according to each keyword in each first characteristic vector and the weight thereof.

And filtering out keywords with lower weights in the first feature vectors according to the weights of the keywords in the first feature vectors, reserving the keywords with higher weights in the first feature vectors, and obtaining a first alarm feature set based on all reserved keywords.

In an example, as shown in fig. 4, the step of obtaining the first warning feature set according to each keyword in each first feature vector and the weight thereof may specifically include the following steps S401 to S403.

S401, respectively calculating the median and the average of the weights of all the keywords in each first feature vector, and taking the maximum value of the median and the average as the weight threshold corresponding to each first feature vector.

In particular, for the first feature vector S_iWherein the keyword is S_i1,S_i2,S_i3,…,S_inThe weight corresponding to each keyword is W_i1,W_i2,W_i3,…,W_inAnd n represents the number of keywords in the first feature vector. The first feature vector S_iMedian (W) of the weights of all keywords_mid) The calculation formula of (a) is as follows:

the first feature vector S_iAverage value of weights (W) of all keywords in_aver) By the first feature vector S_iThe sum of the weights of all the keywords in (A) is divided by the first feature vector S_iThe number of keywords in (2) is calculated. Median (W)_mid) And average value (W)_aver) Is taken as the first feature vector S_iCorresponding weight threshold (W)_hold) Namely:

W_hold＝max(W_mid,W_aver)

s402, filtering the keywords with weights lower than the corresponding weight threshold value in each first characteristic vector to obtain first alarm characteristics of each first-class historical alarm information.

In particular, for the first feature vector S_iThe weight of each keyword is compared with a weight threshold value (W)_hold) Comparing, if the weight of the keyword is lower than the weight threshold (W)_hold) Then the keyword is selected from the first feature vector S_iMiddle deletion, final first feature vector S_iThe retained keywords constitute the first feature vector S_iThe corresponding first alarm characteristic, i.e. the first characteristic vector S_iAnd the first alarm characteristic of the corresponding first-class historical alarm information. It is to be appreciated that one or more keywords are included in the first alert characteristic.

S403, obtaining a first alarm feature set according to the first alarm features of all the first-class historical alarm information.

After the first alarm characteristic of each first-class historical alarm information is obtained, the first alarm characteristics of all the first-class historical alarm information are combined to obtain a first alarm characteristic set.

In the embodiment, the keywords are extracted from all historical alarm information through the keyword extraction algorithm to obtain the first keyword set, and then the keywords with high weights are screened from the keywords matched with the first type of historical alarm information in the first keyword set through the feature selection algorithm to form the first alarm feature set capable of comprehensively representing the features possibly with high fault risks, so that effective alarm information can be accurately identified through the matching result of the alarm information to be identified and the first alarm feature set. In addition, the maximum value of the median and the average value of the weight of the keyword is used as the weight threshold value for filtering the keyword in the feature selection algorithm, so that the influence of the extreme distribution condition of the weight of the keyword on the filtering effect can be prevented, and the filtered keyword can more accurately represent the feature possibly having high fault risk, thereby being beneficial to further improving the identification accuracy rate of effective alarm information.

In an embodiment, as shown in fig. 5, a flowchart of a method for acquiring a second set of alarm features is provided, and the method includes the following steps S501 to S504.

S501, first-class historical warning information in a preset historical time period is obtained.

S502, extracting keywords based on all the first-class historical alarm information to obtain a second keyword set of all the first-class historical alarm information.

The existing keyword extraction algorithm (for example, TextRank algorithm) or a keyword extraction algorithm which may appear in the future can be adopted to extract keywords in all the first-class history alarm information, and a second keyword set is obtained based on the extracted keywords.

In an example, as shown in fig. 6, the step of extracting keywords based on all the first-class historical alert information to obtain the second keyword sets of all the first-class historical alert information may specifically include the following steps S601 to S604.

S601, dividing all the first-class history alarm information into a plurality of sentences, performing word segmentation and part-of-speech tagging on each sentence, and determining words with specified parts-of-speech as second candidate keywords.

Taking all the first-class historical alarm information as a text T, and segmenting the text T according to complete sentences to obtain a plurality of sentences, namely:

T＝[S₁,S₂,S₃...,S_M]

S_i＝[t_i1,t_i2,t_i3...t_in]

t_ijrepresenting a sentence S_iJ is more than or equal to 1 and less than or equal to n. Therefore, the candidate keywords of each sentence can be obtained, and the candidate keywords of all sentences are used as second candidate keywords.

S602, calculating the weight of each second candidate keyword according to the co-occurrence relation of different second candidate keywords in the preset word length window.

The co-occurrence relationship of the different second candidate keywords in the preset vocabulary length window refers to whether the different second candidate keywords appear in the preset vocabulary length window of the text T at the same time. The preset vocabulary length refers to the number of words, for example, the preset vocabulary length is set to K, i.e., the window size is K, and at most K words co-occur.

Constructing a second candidate keyword graph G ═ (V, E), wherein V represents a node, namely each second candidate keyword; and E represents the nodes and the edges between the nodes, and is constructed by using the co-occurrence relation of different second candidate keywords in a preset word length window. When the vocabularies corresponding to the two nodes are shared in the preset vocabulary length window, an edge exists between the two nodes. According to the following formula:

and iteratively propagating the weight of each node until convergence, and obtaining the weight of each second candidate keyword. Wherein WS (V)_i) Represents a node V_iThe weight of (c); WS (V)_j) Represents a node V_jThe weight of (c); in (V)_i) Indicating a pointing node V_iA set of (a); out (V)_i) Represents a node V_iA set of pointed points; omega_jiRepresents a node V_iAnd node V_jThe weight of the edges between the nodes, the edges between different nodes are connected with different importance degrees; d represents a damping coefficient, and the value range is 0-1.

The weight of the second candidate keyword is used for representing the importance of the second candidate keyword in the first type of historical warning information, and the larger the weight of the second candidate keyword is, the more important the second candidate keyword is in the first type of historical warning information, and correspondingly the more important the second candidate keyword is for the identification of effective warning information.

S603, the weights of the second candidate keywords are ranked from large to small, a preset number of second candidate keywords with the weights ranked in the front are taken as third keywords, and if a plurality of third keywords form adjacent phrases in the first type of historical warning information, the third keywords are combined into a fourth keyword.

And ranking the weights of the second candidate keywords from large to small, wherein the more the weights of the second candidate keywords are ranked, the more important the second candidate keywords are. And the second candidate keywords with the preset number (represented by N) and the weight ranked at the top are taken as third keywords, namely the most important N second candidate keywords are kept as the third keywords, so that the identification accuracy of effective alarm information is improved. The specific value of N may be set according to actual requirements, and is not limited herein.

And if a plurality of third key words form adjacent word groups in the first type of historical alarm information, combining the plurality of third key words into a fourth key word. For example, "pay" and "failure" are two third keywords, and the two third keywords form an adjacent phrase "pay failure" in the first type of historical alert information, and then the two third keywords of "pay" and "failure" are combined into a fourth keyword "pay failure", and it can be understood that the fourth keyword refers to a keyword combination.

S604, forming a second keyword set of all the first-class historical alarm information according to the third keyword and the fourth keyword.

And combining the third key word and the fourth key word to obtain a second key word set of all the first-class historical alarm information, namely, the key words in the second key word set comprise the third key word and the fourth key word.

S503, converting each first-class historical alarm information into a corresponding third feature vector as a second alarm feature corresponding to each first-class historical alarm information, wherein the third feature vector comprises keywords matched with the corresponding first-class historical alarm information in a second keyword set.

And for each piece of first-class historical alarm information, matching the first-class historical alarm information with each keyword in a second keyword set, forming a third feature vector corresponding to the first-class historical alarm information based on the matched keyword, and taking the third feature vector corresponding to the first-class historical alarm information as a second alarm feature of the first-class historical alarm information. It is to be appreciated that one or more keywords are included in the second alert characteristic.

S504, a second alarm feature set is obtained according to second alarm features of all the first-class historical alarm information.

After the second alarm characteristic of each first-class historical alarm information is obtained, the second alarm characteristics of all the first-class historical alarm information are combined to obtain a second alarm characteristic set.

In the embodiment, the keywords are extracted from all the first-class historical alarm information through the keyword extraction algorithm to obtain the second keyword set, and the second alarm feature set capable of showing the features possibly with high fault risks in a targeted manner is formed on the basis of the keywords matched in the second keyword set by the first-class historical alarm information, so that obvious effective alarm information can be accurately identified through the matching result of the alarm information to be identified and the second alarm feature set.

In one embodiment, as shown in fig. 7, a flowchart of an alert information identification method based on an information system is provided, and the method includes the following steps S701 to S706.

S701, all historical alarm information in a preset historical time period is obtained, and a first alarm feature set is obtained based on all historical alarm information in the preset historical time period.

S702, first-class historical alarm information in a preset historical time period is obtained, and a second alarm feature set is obtained based on the first-class historical alarm information in the preset historical time period.

And S703, determining a union set of the first alarm characteristic set and the first alarm characteristic set as an alarm characteristic set, wherein the alarm characteristic set comprises a plurality of alarm characteristics.

S704, acquiring alarm information to be identified.

S705, matching the alarm information to be identified with the alarm feature set to obtain a corresponding matching result.

S706, if the matching result indicates that the alarm information to be identified is matched with the alarm feature in the alarm feature set, determining that the alarm information to be identified is effective alarm information.

For the detailed description of the steps S701 to S706, reference may be made to the foregoing embodiments, which are not described herein again. In the embodiment, a first alarm feature set obtained based on all historical alarm information and a second alarm feature set obtained based on the first type of historical alarm information are combined to form an alarm feature set, the alarm feature set objectively and comprehensively reflects the features possibly with high fault risks, can be used for judging hidden fault risks of newly generated alarm information, and can be used as a basis for evaluating the effectiveness and the importance degree of the alarm information to quickly, comprehensively and accurately identify effective alarm information, so that the alarm information screening efficiency is improved, related workers can find and process corresponding faults in time, and the fault processing efficiency of an information system is improved.

It should be understood that, although the steps in the flowcharts related to the above embodiments are shown in sequence as indicated by the arrows, the steps are not necessarily executed in sequence as indicated by the arrows. The steps are not performed in the exact order shown and described, and may be performed in other orders, unless explicitly stated otherwise. Moreover, at least a part of the steps in each flowchart related to the above embodiments may include multiple steps or multiple stages, which are not necessarily performed at the same time, but may be performed at different times, and the order of performing the steps or stages is not necessarily sequential, but may be performed alternately or alternately with other steps or at least a part of the steps or stages in other steps.

In one embodiment, as shown in fig. 8, there is provided a schematic structural diagram of an alarm information recognition apparatus based on an information system, where the apparatus may adopt a software module or a hardware module, or a combination of the two modules to form a part of a computer device, and the apparatus specifically includes: an obtaining module 810, a matching module 820, and a determining module 830, wherein:

the obtaining module 810 is configured to obtain alarm information to be identified.

The matching module 820 is used for matching the alarm information to be identified with a preset alarm feature set to obtain a corresponding matching result; the alarm feature set comprises a plurality of alarm features, and the alarm feature set is determined based on keywords and result categories of historical alarm information; the result type is used for indicating whether the historical alarm information represents that the information system has a fault; the matching result represents whether the alarm information to be identified is matched with the alarm characteristics in the alarm characteristic set.

The determining module 830 is configured to determine that the alarm information to be identified is valid alarm information if it is determined that the matching result represents that the alarm information to be identified matches the alarm feature in the alarm feature set.

In an example, the set of alert features includes a first set of alert features and/or a second set of alert features; the alarm characteristics in the first alarm characteristic set comprise alarm characteristics obtained based on all historical alarm information in a preset historical time period; the alarm features in the second alarm feature set include alarm features obtained based on first-class historical alarm information in a preset historical time period, and the first-class historical alarm information is historical alarm information representing that the information system has a fault.

In one embodiment, as shown in FIG. 9, the apparatus further includes an alarm feature set obtaining module 840 for obtaining the alarm feature set.

In one example, the alarm feature set obtaining module 840 includes a first alarm feature set obtaining module 841 configured to obtain a first alarm feature set. The first alarm feature set obtaining module 841 includes: a first acquisition unit 8411, a first keyword extraction unit 8412, a first conversion unit 8413, a distance calculation unit 8414, a weight calculation unit 8415, and a first determination unit 8416, in which:

the first obtaining unit 8411 is configured to obtain all historical alarm information in a preset historical time period, where all the historical alarm information includes first-type historical alarm information indicating that an information system has a fault and second-type historical alarm information indicating that an information system has no fault.

The first keyword extraction unit 8412 is configured to perform keyword extraction based on all historical alarm information to obtain a first keyword set of all historical alarm information.

A first conversion unit 8413, configured to convert each first type of historical warning information into a corresponding first feature vector, and convert each second type of historical warning information into a corresponding second feature vector; the first feature vector comprises keywords which are matched with the corresponding first type of historical alarm information in the first keyword set, and the second feature vector comprises keywords which are matched with the corresponding second type of historical alarm information in the first keyword set.

The distance calculation unit 8414 is configured to select one eigenvector from the first eigenvector and the second eigenvector, determine the neighboring eigenvector of the same class according to the euclidean distance between the eigenvector and the eigenvector of the same class, and determine the neighboring eigenvector of the different class according to the euclidean distance between the eigenvector and the eigenvector of the different class.

The weight calculating unit 8415 is configured to obtain the weight of each keyword in the first keyword set according to the distribution difference of each keyword in the same-class neighboring feature vectors and the distribution difference of each keyword in different-class neighboring feature vectors.

The first determining unit 8416 is configured to obtain a first warning feature set according to each keyword in each first feature vector and the weight thereof.

In an example, the first keyword extraction unit 8412 is specifically configured to: dividing all historical alarm information into a plurality of sentences, performing word segmentation and part-of-speech tagging processing on each sentence, and determining words with specified parts-of-speech as first candidate keywords; calculating the weight of each first candidate keyword according to the co-occurrence relation of different first candidate keywords in a preset word length window; sorting the weights of the first candidate keywords from big to small, taking the first candidate keywords with the preset number of weights at the top of the sorting as the first keywords, and if a plurality of first keywords form adjacent phrases in the historical alarm information, combining the plurality of first keywords into a second keyword; and forming a first keyword set of all historical alarm information according to the first keyword and the second keyword.

In an example, the first determining unit 8416 is specifically configured to: respectively calculating the median and the average value of the weights of all the keywords in each first feature vector, and taking the maximum value of the median and the average value as the weight threshold value corresponding to each first feature vector; filtering the keywords with weights lower than corresponding weight thresholds in the first characteristic vectors to obtain first alarm characteristics of the first type of historical alarm information; and obtaining a first alarm characteristic set according to the first alarm characteristics of all the first type of historical alarm information.

In one embodiment, as shown in FIG. 9, the alarm feature set acquiring module 840 includes a second alarm feature set acquiring module 842 for acquiring a second alarm feature set. The second alarm feature set obtaining module 842 includes: a second acquisition unit 8421, a second keyword extraction unit 8422, a second conversion unit 8423, and a second determination unit 8424, wherein:

the second obtaining unit 8421 is configured to obtain first-type historical alarm information in a preset historical time period.

The second keyword extraction unit 8422 is configured to perform keyword extraction based on all the first-class historical alarm information, and obtain a second keyword set of all the first-class historical alarm information.

The second conversion unit 8423 is configured to convert each first-class history alarm information into a corresponding third feature vector as a second alarm feature of each first-class history alarm information, where the third feature vector includes a keyword matched with the corresponding first-class history alarm information in the second keyword set.

The second determining unit 8424 is configured to obtain a second alarm feature set according to second alarm features of all the first-class historical alarm information.

In an example, the second keyword extraction unit 8422 is specifically configured to: dividing all the first-class historical warning information into a plurality of sentences, performing word segmentation and part-of-speech tagging on each sentence, and determining words with specified parts-of-speech as second candidate keywords; calculating the weight of each second candidate keyword according to the co-occurrence relation of different second candidate keywords in a preset word length window; sorting the weights of the second candidate keywords from big to small, taking the second candidate keywords with the preset number of weights ranked in the front as third keywords, and if a plurality of third keywords form adjacent phrases in the first type of historical alarm information, combining the third keywords into a fourth keyword; and forming a second keyword set of all the first-class historical alarm information according to the third keyword and the fourth keyword.

In one embodiment, as shown in fig. 9, the warning feature set obtaining module 840 includes: a first alarm feature set obtaining module 841, a second alarm feature set obtaining module 842, and a merging module 843, wherein: a first alarm feature set obtaining module 841, configured to obtain a first alarm feature set; a second alarm feature set obtaining module 842, configured to obtain a second alarm feature set; the merging module 843 is configured to determine a union of the first alarm feature set and the second alarm feature set as an alarm feature set.

The specific definition of the alarm information identification device based on the information system can refer to the above definition of the alarm information identification method based on the information system, and is not described herein again. All or part of the modules in the alarm information identification device based on the information system can be realized by software, hardware and a combination thereof. The modules can be embedded in a hardware form or independent from a processor in the computer device, and can also be stored in a memory in the computer device in a software form, so that the processor can call and execute operations corresponding to the modules.

In one embodiment, as shown in fig. 10, there is provided a schematic structural diagram of a computer device, the computer device comprising: a processor 1001 and a memory 1002 communicatively coupled to the processor 1001; the memory 1002 stores computer-executable instructions; the processor 1001 executes computer-executable instructions stored by the memory 1002 to implement the methods provided by the embodiments described above.

The computer device further comprises a receiver 1003 and a transmitter 1004. The receiver 1003 is used for receiving instructions and data sent by an external device, and the transmitter 1004 is used for sending instructions and data to the external device.

FIG. 11 is a block diagram illustrating a computer device, which may be a mobile phone, a computer, a digital broadcast terminal, a messaging device, a game console, a tablet device, a medical device, an exercise device, a personal digital assistant, and the like, according to an exemplary embodiment.

The apparatus 1100 may include one or more of the following components: processing component 1102, memory 1104, power component 1106, multimedia component 1108, audio component 1110, input/output (I/O) interface(s) 1112, sensor component 1114, and communication component 816.

The processing component 1102 generally controls the overall operation of the device 1100, such as operations associated with display, telephone calls, data communications, camera operations, and recording operations. The processing components 1102 may include one or more processors 1120 to execute instructions to perform all or a portion of the steps of the methods described above. Further, the processing component 1102 may include one or more modules that facilitate interaction between the processing component 1102 and other components. For example, the processing component 1102 may include a multimedia module to facilitate interaction between the multimedia component 1108 and the processing component 1102.

The memory 1104 is configured to store various types of data to support operations at the apparatus 1100. Examples of such data include instructions for any application or method operating on device 1100, contact data, phonebook data, messages, pictures, videos, and so forth. The memory 1104 may be implemented by any type or combination of volatile or non-volatile memory devices such as Static Random Access Memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic or optical disks.

A power component 1106 provides power to the various components of the device 1100. The power components 1106 may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power for the apparatus 1100.

The multimedia component 1108 includes a screen that provides an output interface between the device 1100 and the user. In some embodiments, the screen may include a Liquid Crystal Display (LCD) and a Touch Panel (TP). If the screen includes a touch panel, the screen may be implemented as a touch screen to receive an input signal from a user. The touch panel includes one or more touch sensors to sense touch, slide, and gestures on the touch panel. The touch sensor may not only sense the boundary of a touch or slide action, but also detect the duration and pressure associated with the touch or slide operation. In some embodiments, the multimedia component 1108 includes a front facing camera and/or a rear facing camera. The front camera and/or the rear camera may receive external multimedia data when the device 1100 is in an operating mode, such as a shooting mode or a video mode. Each front camera and rear camera may be a fixed optical lens system or have a focal length and optical zoom capability.

The audio component 1110 is configured to output and/or input audio signals. For example, the audio component 1110 includes a Microphone (MIC) configured to receive external audio signals when the apparatus 1100 is in operating modes, such as a call mode, a recording mode, and a voice recognition mode. The received audio signals may further be stored in the memory 1104 or transmitted via the communication component 1116. In some embodiments, the audio assembly 1110 further includes a speaker for outputting audio signals.

The I/O interface 1112 provides an interface between the processing component 1102 and peripheral interface modules, which may be keyboards, click wheels, buttons, etc. These buttons may include, but are not limited to: a home button, a volume button, a start button, and a lock button.

The sensor assembly 1114 includes one or more sensors for providing various aspects of state assessment for the apparatus 1100. For example, the sensor assembly 1114 may detect an open/closed state of the apparatus 1100, the relative positioning of components, such as a display and keypad of the apparatus 1100, the sensor assembly 1114 may also detect a change in position of the apparatus 1100 or a component of the apparatus 1100, the presence or absence of user contact with the apparatus 1100, orientation or acceleration/deceleration of the apparatus 1100, and a change in temperature of the apparatus 1100. The sensor assembly 1114 may include a proximity sensor configured to detect the presence of a nearby object without any physical contact. The sensor assembly 1114 may also include a light sensor, such as a CMOS or CCD image sensor, for use in imaging applications. In some embodiments, the sensor assembly 1114 may also include an acceleration sensor, a gyroscope sensor, a magnetic sensor, a pressure sensor, or a temperature sensor.

The communication component 1116 is configured to facilitate wired or wireless communication between the apparatus 1100 and other devices. The apparatus 1100 may access a wireless network based on a communication standard, such as WiFi, 2G or 3G, or a combination thereof. In an exemplary embodiment, the communication component 1116 receives broadcast signals or broadcast related information from an external broadcast management system via a broadcast channel. In an exemplary embodiment, the communication component 1116 also includes a Near Field Communication (NFC) module to facilitate short-range communications. For example, the NFC module may be implemented based on Radio Frequency Identification (RFID) technology, infrared data association (IrDA) technology, Ultra Wideband (UWB) technology, Bluetooth (BT) technology, and other technologies.

In an exemplary embodiment, the apparatus 1100 may be implemented by one or more Application Specific Integrated Circuits (ASICs), Digital Signal Processors (DSPs), Digital Signal Processing Devices (DSPDs), Programmable Logic Devices (PLDs), Field Programmable Gate Arrays (FPGAs), controllers, micro-controllers, microprocessors or other electronic components for performing the above-described methods.

In an exemplary embodiment, a non-transitory computer-readable storage medium comprising instructions, such as the memory 1104 comprising instructions, executable by the processor 1120 of the apparatus 1100 to perform the method described above is also provided. For example, the non-transitory computer readable storage medium may be a ROM, a Random Access Memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, an optical data storage device, and the like.

Embodiments of the present application further provide a non-transitory computer-readable storage medium, where instructions in the storage medium, when executed by a processor of a computer device, enable the computer device to perform the method provided in any of the above embodiments.

An embodiment of the present invention further provides a computer program product, where the computer program product includes: a computer program, the computer program being stored in a readable storage medium, from which the computer program can be read by at least one processor of a computer device, execution of the computer program by the at least one processor causing the computer device to perform the method provided by any of the embodiments described above.

It should be understood that the terms "first", "second", etc. in the above-described embodiments are used for descriptive purposes only and are not to be construed as indicating or implying relative importance or implying any number of technical features indicated. Further, in the description of the present application, the meaning of "a plurality" means at least two unless otherwise specified.

Other embodiments of the present application will be apparent to those skilled in the art from consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of the invention following, in general, the principles of the application and including such departures from the present disclosure as come within known or customary practice within the art to which the invention pertains. It is intended that the specification and examples be considered as exemplary only, with a true scope and spirit of the application being indicated by the following claims.

It will be understood that the present application is not limited to the precise arrangements described above and shown in the drawings and that various modifications and changes may be made without departing from the scope thereof. The scope of the application is limited only by the appended claims.

Claims

1. An alarm information identification method based on an information system is characterized by comprising the following steps:

acquiring alarm information to be identified;

2. The method according to claim 1, wherein the set of alarm features comprises a first set of alarm features and/or a second set of alarm features;

the alarm characteristics in the first alarm characteristic set comprise alarm characteristics obtained based on all historical alarm information in a preset historical time period;

the alarm characteristics in the second alarm characteristic set comprise alarm characteristics obtained based on first-class historical alarm information in a preset historical time period, wherein the first-class historical alarm information is historical alarm information representing that the information system has faults.

3. The method of claim 2, further comprising:

acquiring all historical alarm information in a preset historical time period, wherein the all historical alarm information comprises first type historical alarm information representing that the information system has a fault and second type historical alarm information not representing that the information system has the fault;

extracting keywords based on all historical alarm information to obtain a first keyword set of all historical alarm information;

converting each first type of historical alarm information into a corresponding first characteristic vector, and converting each second type of historical alarm information into a corresponding second characteristic vector; the first feature vector comprises keywords which are matched with the corresponding first type of historical alarm information in the first keyword set, and the second feature vector comprises keywords which are matched with the corresponding second type of historical alarm information in the first keyword set;

randomly selecting one feature vector from the first feature vector and the second feature vector, determining similar neighbor feature vectors according to Euclidean distances between the feature vectors and similar feature vectors, and determining heterogeneous neighbor feature vectors according to Euclidean distances between the feature vectors and heterogeneous feature vectors;

obtaining the weight of each keyword in the first keyword set according to the distribution difference of each keyword in the first keyword set in the similar neighbor feature vectors and the distribution difference of each keyword in the different neighbor feature vectors;

and obtaining a first alarm characteristic set according to each keyword in each first characteristic vector and the weight thereof.

4. The method of claim 3, wherein performing keyword extraction based on the all historical alarm information to obtain a first keyword set of the all historical alarm information comprises:

dividing all the historical alarm information into a plurality of sentences, performing word segmentation and part-of-speech tagging on each sentence, and determining words with specified parts-of-speech as first candidate keywords;

calculating the weight of each first candidate keyword according to the co-occurrence relation of different first candidate keywords in a preset word length window;

sorting the weights of the first candidate keywords from big to small, taking a preset number of first candidate keywords with the weights sorted in the front as first keywords, and if a plurality of first keywords form adjacent phrases in the historical alarm information, combining the plurality of first keywords into a second keyword;

and forming a first keyword set of all the historical alarm information according to the first keyword and the second keyword.

5. The method of claim 3, wherein obtaining a first set of alert features based on the keywords and their weights in each of the first feature vectors comprises:

respectively calculating the median and the average of the weights of all the keywords in each first feature vector, and taking the maximum value of the median and the average as the weight threshold corresponding to each first feature vector;

filtering the keywords with weights lower than corresponding weight thresholds in the first characteristic vectors to obtain first alarm characteristics of the first type of historical alarm information;

and obtaining a first alarm characteristic set according to the first alarm characteristics of all the first type of historical alarm information.

6. The method according to any one of claims 2-5, further comprising:

acquiring first-type historical alarm information in a preset historical time period;

extracting keywords based on all the first-class historical alarm information to obtain a second keyword set of all the first-class historical alarm information;

converting each first-class historical alarm information into a corresponding third feature vector serving as a second alarm feature of each first-class historical alarm information, wherein the third feature vector comprises a keyword matched with the corresponding first-class historical alarm information in the second keyword set;

and obtaining a second alarm characteristic set according to the second alarm characteristics of all the first type of historical alarm information.

7. The method of claim 6, wherein extracting keywords based on all the first-class historical alarm information to obtain a second keyword set of all the first-class historical alarm information comprises:

dividing all the first-class historical warning information into a plurality of sentences, performing word segmentation and part-of-speech tagging on each sentence, and determining words with specified parts-of-speech as second candidate keywords;

calculating the weight of each second candidate keyword according to the co-occurrence relation of different second candidate keywords in a preset word length window;

sorting the weights of the second candidate keywords from big to small, taking a preset number of second candidate keywords with the weights sorted in front as third keywords, and if a plurality of third keywords form adjacent phrases in the first type of historical warning information, combining the third keywords into a fourth keyword;

and forming a second keyword set of all the first-class historical alarm information according to the third keyword and the fourth keyword.

8. An apparatus for identifying alarm information based on an information system, the apparatus comprising:

9. A computer device, comprising: a processor and a memory communicatively coupled to the processor;

the memory stores computer-executable instructions;

the processor executes computer-executable instructions stored by the memory to implement the method of any of claims 1-7.

10. A computer-readable storage medium having computer-executable instructions stored therein, which when executed by a processor, are configured to implement the method of any one of claims 1-7.