CN114664062A - Alarm suppression method based on event time and water line and related device - Google Patents
Alarm suppression method based on event time and water line and related device Download PDFInfo
- Publication number
- CN114664062A CN114664062A CN202210323467.4A CN202210323467A CN114664062A CN 114664062 A CN114664062 A CN 114664062A CN 202210323467 A CN202210323467 A CN 202210323467A CN 114664062 A CN114664062 A CN 114664062A
- Authority
- CN
- China
- Prior art keywords
- time
- alarm
- calculation window
- alarm information
- window
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
- XLYOFNOQVPJJNP-UHFFFAOYSA-N water Substances O XLYOFNOQVPJJNP-UHFFFAOYSA-N 0.000 title claims abstract description 83
- 238000000034 method Methods 0.000 title claims abstract description 47
- 230000001629 suppression Effects 0.000 title claims abstract description 37
- 238000004364 calculation method Methods 0.000 claims abstract description 190
- 238000003825 pressing Methods 0.000 claims abstract description 39
- 238000004590 computer program Methods 0.000 claims description 9
- 238000012545 processing Methods 0.000 description 9
- 230000001960 triggered effect Effects 0.000 description 8
- 230000003287 optical effect Effects 0.000 description 6
- 238000010586 diagram Methods 0.000 description 5
- 230000003111 delayed effect Effects 0.000 description 3
- 230000006870 function Effects 0.000 description 3
- 230000005540 biological transmission Effects 0.000 description 2
- 230000006835 compression Effects 0.000 description 2
- 238000007906 compression Methods 0.000 description 2
- 238000012544 monitoring process Methods 0.000 description 2
- 239000013307 optical fiber Substances 0.000 description 2
- 230000000644 propagated effect Effects 0.000 description 2
- 239000004065 semiconductor Substances 0.000 description 2
- 238000007619 statistical method Methods 0.000 description 2
- 238000003491 array Methods 0.000 description 1
- 238000004422 calculation algorithm Methods 0.000 description 1
- 238000013461 design Methods 0.000 description 1
- 238000005516 engineering process Methods 0.000 description 1
- 238000007429 general method Methods 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
Images
Classifications
-
- G—PHYSICS
- G08—SIGNALLING
- G08B—SIGNALLING OR CALLING SYSTEMS; ORDER TELEGRAPHS; ALARM SYSTEMS
- G08B21/00—Alarms responsive to a single specified undesired or abnormal condition and not otherwise provided for
- G08B21/18—Status alarms
-
- G—PHYSICS
- G08—SIGNALLING
- G08B—SIGNALLING OR CALLING SYSTEMS; ORDER TELEGRAPHS; ALARM SYSTEMS
- G08B29/00—Checking or monitoring of signalling or alarm systems; Prevention or correction of operating errors, e.g. preventing unauthorised operation
- G08B29/12—Checking intermittently signalling or alarm systems
-
- G—PHYSICS
- G08—SIGNALLING
- G08B—SIGNALLING OR CALLING SYSTEMS; ORDER TELEGRAPHS; ALARM SYSTEMS
- G08B29/00—Checking or monitoring of signalling or alarm systems; Prevention or correction of operating errors, e.g. preventing unauthorised operation
- G08B29/18—Prevention or correction of operating errors
- G08B29/185—Signal analysis techniques for reducing or preventing false alarms or for enhancing the reliability of the system
Landscapes
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Business, Economics & Management (AREA)
- Emergency Management (AREA)
- Alarm Systems (AREA)
Abstract
The invention provides an alarm suppression method based on event time and a water level line and a related device, wherein the method comprises the following steps: acquiring alarm information in real time; when the calculation window is not started, acquiring alarm information, and starting the calculation window; judging whether the alarm information acquired in the current calculation window meets the corresponding pressing release condition or not; the starting time of the calculation window is the event time when the alarm information is acquired when the calculation window is not started, and the ending time of the calculation window is the preset water level line time; the preset water level line time is greater than the alarm time in the pressing release condition; if yes, releasing the alarm; the problem of disorder of alarm time caused by slow sending time of the head end of the alarm source is avoided, and the accuracy of suppressing alarm is improved.
Description
Technical Field
The invention belongs to the technical field of alarms, and particularly relates to an alarm suppression method based on event time and a water line and a related device.
Background
In the field of monitoring of modern financial enterprise business systems, a unified centralized alarm management platform is often present, which is responsible for receiving alarms from all sources, suppressing the alarms and uniformly processing other event instances, such as notification and upgrading. The accurate alarm is an important guarantee for the stable operation of the system, and aiming at the condition that the accidental alarm or single-point false alarm rate is high in part of alarms, the alarm management platform provides an alarm suppression function, namely, the alarm is released only when the number of times of certain type of alarms is more than that of certain type of alarms within a long time, and a series of processing operations such as alarm notification and the like are carried out.
At present, pressing is carried out according to alarm processing time, original alarms received by an alarm management platform may be out of order, and inaccurate pressing is caused; and collecting all alarms in the time window in a fixed time window through the event time in the original alarm, closing the window for calculation after the alarm reaches the water line, and releasing the alarm if the pressing times are exceeded, so that accurate pressing can be realized, inaccurate pressing caused by disorder is avoided, and a better monitoring guarantee is provided for a financial service system.
However, based on the processing time when the alarm management platform receives the alarms, since the source end of the alarm transmission cannot ensure that the alarms transmitted by the source end of the alarm transmission are transmitted in sequence, if the alarm management platform receives only one alarm, the alarm is recorded once, and the alarm is released after the alarm management platform is full, the situation that the later received alarms are not calculated due to the disorder problem of the alarm time is likely to occur, the possibility of inconsistency with the actual situation exists, and the accuracy of suppression cannot be ensured hundreds of percent.
Disclosure of Invention
In view of the above, the present invention provides an alarm suppressing method and related apparatus based on event time and water level line, which are used to avoid the problem of disorder of alarm time caused by slow sending time at the head end of the alarm source, and improve the accuracy of suppressing the alarm.
The application discloses in a first aspect a warning suppression method based on event time and water line, comprising:
acquiring alarm information in real time;
acquiring alarm information when a calculation window is not started, and starting the calculation window;
judging whether the alarm information acquired in the current calculation window meets the corresponding pressing release condition or not; the starting time of the calculation window of this time is the event time of acquiring the alarm information when the calculation window is not started, and the ending time of the calculation window of this time is the preset water level line time; the preset water level line time is longer than the alarm time in the pressing release condition;
and if so, releasing the alarm.
Optionally, in the alarm suppressing method based on the event time and the water line, starting the current calculation window includes:
taking the event time of firstly acquiring the alarm information as the starting time of the calculation window;
if the current moment reaches the preset waterline time, finishing the calculation window; and taking the preset time after the starting time of the current calculation window as the preset waterline time.
Optionally, in the alarm pressing method based on the event time and the water level line, determining whether the alarm information acquired in the current calculation window meets the corresponding pressing release condition includes:
triggering and starting the alarm information of the current calculation window as the 1 st alarm information of the current calculation window;
the current calculation window continues to lengthen the window length according to the time lapse, and the acquired alarm information is brought into the current calculation window;
when the alarm triggering time corresponding to the type of the alarm information is reached, the window length is continued to be lengthened according to the time lapse, and the obtained alarm information is brought into the current calculation window;
when the current calculation window is formed, the current calculation window is closed;
and judging whether the alarm information in the current calculation window meets the suppression release condition or not.
Optionally, in the alarm suppressing method based on event time and water level line, the calculation window is formed completely, and after the calculation window is closed, the step of obtaining the alarm information in real time is returned to, so that when new alarm information is obtained, the next calculation window is started.
Optionally, in the above alarm pressing method based on event time and water line, the pressing release condition includes: acquiring alarm information exceeding a preset number of times within the alarm time;
and the event time of the alarm information exceeding the preset times is within the alarm time.
The second aspect of the present application discloses an alarm suppressing apparatus based on an event time and a water level line, comprising:
the acquisition unit is used for acquiring the alarm information in real time;
the starting unit is used for acquiring alarm information when the calculation window is not started and starting the calculation window;
the judging unit is used for judging whether the alarm information acquired in the current calculation window meets the corresponding pressing release condition or not; the starting time of the calculation window of this time is the event time of acquiring the alarm information when the calculation window is not started, and the ending time of the calculation window of this time is the preset water level line time; the preset water level line time is longer than the alarm time in the pressing release condition;
and the release alarm unit is used for releasing the alarm if the judgment result of the judgment unit is yes.
Optionally, in the alarm and pressure device based on the event time and the water level line, when the starting unit is configured to start the current calculation window, the starting unit is specifically configured to:
taking the event time of firstly acquiring the alarm information as the starting time of the calculation window;
if the current time reaches the preset waterline time, finishing the calculation of the window; and taking the preset time after the starting time of the current calculation window as the preset waterline time.
Optionally, in the alarm pressing device based on the event time and the water level line, when the determining unit is configured to determine whether the alarm information acquired in the current calculation window meets a corresponding pressing release condition, the determining unit is specifically configured to:
triggering and starting the alarm information of the current calculation window as the 1 st alarm information of the current calculation window;
the current calculation window continues to lengthen the window length according to the time lapse, and the acquired alarm information is brought into the current calculation window;
when the triggering alarm time corresponding to the type of the alarm information is reached, the window length is continued to be lengthened according to the time lapse, and the obtained alarm information is brought into the current calculation window;
when the current calculation window is formed, the current calculation window is closed;
and judging whether the alarm information in the current calculation window meets the suppression release condition or not.
A third aspect of the present application discloses an electronic device, comprising:
one or more processors;
a storage system having one or more programs stored thereon;
the one or more programs, when executed by the one or more processors, cause the one or more processors to implement a method of alarm throttling based on event time and water line as defined in any one of the first aspects of the present application.
A fourth aspect of the present application discloses a computer storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the alarm suppression method based on event time and water level according to any one of the first aspect of the present application.
According to the technical scheme, the alarm suppressing method based on the event time and the water line, provided by the invention, comprises the following steps of: acquiring alarm information in real time; acquiring alarm information when a calculation window is not started, and starting the calculation window; judging whether the alarm information acquired in the current calculation window meets the corresponding pressing release condition or not; the starting time of the current calculation window is the event time of acquiring the alarm information when the calculation window is not started, and the ending time of the current calculation window is the preset water line time; the preset water level line time is greater than the alarm time in the pressing release condition; if yes, releasing the alarm; that is, through the event time in the original alarm, collecting all alarms in the calculation window by the calculation window with time period, and closing the window to calculate after the alarm reaches the water level line; if the alarm number in the window exceeds the pressing times, releasing the alarm; otherwise, continuously passing through the next window, repeating the method and judging; the problem of disorder of alarm time caused by slow sending time of the head end of the alarm source is avoided, and the accuracy of suppressing alarm is improved.
Drawings
In order to more clearly illustrate the embodiments or technical solutions of the present invention, the drawings used in the embodiments or technical solutions in the prior art are briefly introduced below, and it is obvious that the drawings in the following description are some embodiments of the present invention, and it is obvious for those skilled in the art that other drawings can be obtained according to these drawings without creative efforts.
FIG. 1 is a flow chart of an alarm throttling method based on event time and water level according to an embodiment of the present invention;
FIG. 2 is a schematic diagram of the calculation windows involved in an alarm suppression method based on event time and water level according to an embodiment of the present invention;
FIG. 3 is a schematic diagram of the calculation windows involved in an alarm throttling method based on event time and water level line according to an embodiment of the present invention;
FIG. 4 is a diagram illustrating the calculation windows involved in an alarm throttling method based on event time and water level line according to an embodiment of the present invention;
FIG. 5 is a schematic diagram of an alarm suppression device based on event time and water level according to an embodiment of the present invention;
fig. 6 is a schematic diagram of an electronic device according to an embodiment of the present invention.
Detailed Description
In order to make the objects, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the drawings in the embodiments of the present invention, and it is obvious that the described embodiments are some, but not all, embodiments of the present invention. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present invention.
In this application, the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising an … …" does not exclude the presence of other identical elements in the process, method, article, or apparatus that comprises the element.
The embodiment of the application discloses an alarm suppression method based on event time and water level line, which is used for solving the problems that in the prior art, based on the processing time when an alarm management platform receives the alarm, because the source end of alarm sending can not ensure that the alarm sent by the source end is sent in sequence, if the alarm management platform only receives one alarm, the alarm is recorded once, and after the alarm is released, the alarm is likely to be missed due to disorder of the alarm time, the possibility of inconsistency between the alarm and the actual situation exists, and the suppression accuracy can not be guaranteed hundreds.
The related terms referred to in this application are to be construed as:
(1) and (3) an alarm management platform: and the system is responsible for receiving alarms from all sources and carrying out suppression or other policy processing on the alarms.
(2) Warning suppression: after receiving the alarm, the alarm management module does not process the alarm immediately, but releases the alarm according to a preset strategy, such as that the class A alarm occurs more than 10 times in 5 minutes.
(3) Event time: the time in the original alarm (i.e. the time reported by the alarm source), the processing time after the non-alarm management platform receives the alarm.
(4) Treatment time: and the time when the alarm management platform receives the alarm.
(5) Window: and collecting all alarms in the windows through calculation windows with fixed time length, closing the windows after the alarms reach the water level line, and calculating whether the pressing release condition is met.
(6) Water line: the window allows the maximum limit of storing the alarms, and after the alarms in the window reach a certain number, if the event time of a certain alarm exceeds a set value, the water level line is considered to be reached.
Referring to fig. 1, the alarm suppressing method based on the event time and the water line includes:
and S101, acquiring alarm information in real time.
When the source end of the alarm sending appears the alarm condition, the alarm information is sent in real time; and the application equipment applying the alarm suppression method based on the event time and the water level line receives the alarm information.
The specific process of acquiring the alarm information is not described in detail herein, and may be determined according to the actual situation, all of which are within the scope of the present application.
And S102, acquiring alarm information when the calculation window is not started, and starting the calculation window.
It should be noted that, if any one of the calculation windows is not started at the current time and the alarm information is acquired, one calculation window is started, and the calculation window is recorded as the current calculation window.
In addition, the alarm information is acquired in real time in the step S101; that is, if a calculation window is started, the alarm information obtained continuously enters the calculation window; until after the end of the calculation window; and starting the next calculation window according to the acquired condition, and recording as the next calculation window.
S103, judging whether the alarm information acquired in the current calculation window meets the corresponding pressing release condition.
The starting time of the calculation window is the event time when the alarm information is acquired when the calculation window is not started, and the ending time of the calculation window is the preset water level line time; the preset waterline time is greater than the alarm time within the press release condition.
In practical applications, the compression release conditions include: and acquiring alarm information exceeding the preset times within the alarm time.
And the event time of the alarm information exceeding the preset times is within the alarm time.
That is, the end time corresponding to the alarm time is less than the preset waterline time; and on the basis of the final time line, giving a certain surplus time, namely the water level line time, closing the calculation window when the alarm event time exceeds the water level line, and performing unified calculation.
After closing the calculation window, eliminating the alarm information of which the event time exceeds the alarm time, and then calculating the quantity of the alarm information in the calculation window; when the number of the alarm information in the calculation window exceeds the preset number, judging that the alarm information acquired in the calculation window at this time meets the corresponding suppression release condition; otherwise, judging that the alarm information acquired in the current calculation window does not meet the corresponding pressing release condition.
And if the alarm information acquired in the current calculation window meets the corresponding suppression release condition, executing the step S104.
And S104, releasing the alarm.
In this embodiment, on the basis of the final time line, a certain margin time, i.e., a water level line, is given, and when the event time with alarm exceeds the water level line, the window is closed again, and the calculation is unified.
In the embodiment, all alarms in the calculation window are collected through the calculation window with the time period one by one according to the event time in the original alarm, and the window is closed for calculation after the alarms reach the water level line; if the alarm number in the window exceeds the pressing times, releasing the alarm; otherwise, continuously passing through the next window, repeating the method and judging; the problem of disorder of alarm time caused by slow sending time of the head end of the alarm source is avoided, and the accuracy of suppressing alarm is improved.
In practical applications, the starting of the current calculation window in step S102 includes:
taking the event time of firstly acquiring the alarm information as the starting time of the current calculation window; if the current moment reaches the preset waterline time, finishing the calculation of the window; and taking the preset time after the starting time of the current calculation window as the preset waterline time.
That is to say, the length of the calculation window is fixed, and it may be determined according to the type of the alarm information, or certainly, it may be determined in other manners, and it is not described herein any more, and it is only required depending on the actual situation, and all are within the protection scope of the present application.
The starting time of the calculation window is based on the event time of firstly acquiring the alarm information; and in a specific time after the event time when the alarm information is acquired firstly, the alarm information is taken as the whole calculation window.
It should be noted that the specific time is different from the alarm time, and the specific time is greater than the alarm time, that is, the alarm time is delayed, so that all the alarm information of the alarm is sent to the corresponding device.
In practical application, the specific process of S103 determining whether the alarm information acquired in the current calculation window satisfies the corresponding compression release condition is as follows:
(1) triggering and starting the alarm information of the current calculation window as the 1 st alarm information of the current calculation window.
(2) And the calculation window continuously lengthens the window length according to the time lapse, and the acquired alarm information is brought into the calculation window.
(3) When the alarm triggering time corresponding to the type of the alarm information is reached, the window length is continued to be lengthened according to the time lapse, and the obtained alarm information is brought into the calculation window.
(4) And when the current calculation window reaches the preset water level line, the current calculation window is formed completely, and the current calculation window is closed.
(5) And judging whether the alarm information in the current calculation window meets the suppression release condition or not.
Specifically, as shown in FIG. 3, one water line (03 minutes 40 seconds, if possible) is set before 03-04 minutes from past experience or statistical analysis. If the event time of a certain received alarm reaches or exceeds the set value, the calculation window is considered to be formed completely, calculation is triggered, and whether the number of alarms exceeds the set value or not is judged.
Therefore, in this scenario, if the suppression logic of the class a alarm is more than 2 times within 2 minutes, the alarm is released, the alarm management platform receives alarm 1 with an event time of 00 minutes at 00 minutes and enters the current calculation window, receives alarm 2 with an event time of 01 minutes at 01 minutes and enters the current calculation window, the alarm is not received at 02 minutes, the window continues to be performed because the water level line is not triggered, and receives alarm 3 with an event time of 02 minutes at 03 minutes, the water level line is still not triggered, the window continues to be performed, and the alarm 3 enters the current calculation window; after the alarm of which the event time is more than or equal to the water level line is received subsequently, the calculation window is formed completely, the window is closed, and whether the alarm in the window meets the pressing release condition or not is judged; and (5) finding that the alarm occurs for 3 times in two minutes in the window, and releasing the alarm.
In practical application, after the calculation window is formed, the execution step is returned to obtain the alarm information in real time after the calculation window is closed, so that when new alarm information is obtained, the next calculation window is started.
Specifically, after receiving the class a alarm, the centralized alarm management platform finds that a suppression policy exists, that is, how many times the class a alarm occurs within a long time, the centralized alarm management platform releases the alarm, and the general method is as follows: and recording once an alarm is received, and judging whether the condition is met or not to release the alarm each time the alarm is received.
In practical situations, due to network delay or the reason of the alarm source itself or the reason of the alarm management platform, the alarms sent by the alarm source may be delayed or out of order, as shown in fig. 2, the alarm management platform receives 123 three alarms in sequence, but the event time of alarm 3 is 02 minutes.
The conventional suppressing logic is that one alarm record is received once, and if the number of the alarm records is met, the releasing alarm is triggered. If the suppression logic of the class A alarm is more than 2 times within 2 minutes, the alarm is released, the alarm management platform receives three alarms 123 between 00 minutes and 02 minutes, so no alarm is generated, the alarm 3 is sent in the third minute, the alarm event time in the alarm 3 is 02 minutes, the judgment is overtime after more than two minutes according to the conventional logic, and even if the alarm with the event time of 02 minutes is received in the third minute, the release condition cannot be met.
This can be avoided by the event time based throttling logic, which in turn assists the water line.
As shown in fig. 3, according to past experience or statistical analysis, a water level line is set before 03-04 minutes (03 minutes 40 seconds is assumed), and if the event time of a certain received alarm reaches or exceeds the set value, it can be regarded that the calculation window is formed completely, and the calculation is triggered to judge whether the number of alarms exceeds the set value. Therefore, in this scenario, if the suppression logic of the class a alarm is more than 2 times within 2 minutes, the alarm is released, the alarm management platform receives alarm 1 with an event time of 00 minutes at 00 minutes and enters the current calculation window, receives alarm 2 with an event time of 01 minutes at 01 minutes and enters the current calculation window, the alarm is not received at 02 minutes, the window continues to be performed because the water level line is not triggered, and receives alarm 3 with an event time of 02 minutes at 03 minutes, the water level line is still not triggered, the window continues to be performed, and the alarm 3 enters the current calculation window; after the alarm of which the event time is more than or equal to the water level line is received subsequently, the calculation window is formed completely, the window is closed, and whether the alarm in the window meets the pressing release condition or not is judged; and (5) finding that the alarm occurs for 3 times in two minutes in the window, and releasing the alarm.
The specific operation process in the window is as shown in fig. 4, assuming that the length of the window is 5 minutes, and setting the water level line as the last time of the window plus two minutes, the circles representing the alarm in fig. 4 enter the window in sequence; in the window of 05-10 minutes, 6 alarms including the event time of 11 minutes are collected in the window of 05-10 minutes, and an alarm with the event time of 10 minutes and an alarm with the event time of 12 minutes are received before 10-12 minutes, and because the set water level line is achieved, the window is closed, and the alarm number in the window is counted; when counting the number of alarms in the window, finding that the alarm with the event time of 11 points is not in the window time, and removing the alarm from the window; the alarm with the event time of 10 minutes is in the window time, so the alarm is added into the window; and then the total number of the alarms in the window is calculated to obtain the number of the alarms in the window.
That is, the actual time length of the calculation window is determined by how fast the event time reaches the water level line, for example, the event time with an alarm reaches the threshold of the water level line, and the window closing and calculation is triggered.
In this embodiment, based on the event time rather than the processing time, it can be ensured that the centralized alarm management platform can accurately suppress the out-of-order alarms when receiving the out-of-order alarms, instead of the conventional suppression method of directly counting according to the processing time.
In addition, the water level line is set, so that the alarm has a certain delay space, even if the alarm management platform receives out-of-order alarms or delayed alarms due to a network or other reasons, the alarm management platform can enter a window for calculation before the water level line arrives, the latest alarm is calculated only when the alarm on the water level line appears, and at the moment, the window can be ended, and the alarm quantity in the window is calculated.
And the calculation window is generally a fixed time length, is generated at regular time and is used for storing the alarm meeting the conditions, and is closed after the water level line conditions are met, so that whether the alarm number meets the pressing release conditions or not is judged. That is, the frequency of calculation window generation may be set, such as ten minutes to generate a calculation window. Instead, the length of the window is calculated, depending on the location of the water line and when the event time reaches the water line in actually receiving that many alarms.
Specifically, a calculation window is generated at regular time, for example, one calculation window is generated every ten minutes, and is used for storing an alarm of which the event time is taken in the window, when the event time of a certain alarm reaches the water level, the window is closed, and whether the alarm number meets the suppression release condition is started to be judged.
Another embodiment of the present application provides an alarm suppression device based on event time and water line.
Referring to fig. 5, the alarm pressing apparatus based on the event time and the water line includes:
the acquiring unit 101 is configured to acquire the alarm information in real time.
And the starting unit 102 is configured to acquire the alarm information when the calculation window is not started, and start the calculation window this time.
The judging unit 103 is configured to judge whether the alarm information acquired in the current calculation window meets a corresponding suppression release condition; the starting time of the calculation window is the event time when the alarm information is acquired when the calculation window is not started, and the ending time of the calculation window is the preset water level line time; the preset waterline time is greater than the alarm time within the press release condition.
And a release alarm unit 104, configured to release the alarm if the determination result of the determination unit 103 is yes.
In practical application, when the starting unit 102 is configured to start the current calculation window, it is specifically configured to:
taking the event time of firstly acquiring the alarm information as the starting time of the current calculation window; if the current moment reaches the preset waterline time, finishing the calculation of the window; and taking the preset time after the starting time of the current calculation window as the preset waterline time.
In practical application, the determining unit 103 is specifically configured to, when determining whether the alarm information acquired in the current calculation window meets the corresponding suppression release condition:
triggering and starting the alarm information of the current calculation window as the 1 st alarm information of the current calculation window; the calculation window is continued to be lengthened according to the time lapse, and the acquired alarm information is brought into the calculation window; when the alarm triggering time corresponding to the type of the alarm information is reached, the window length is continuously lengthened according to the time lapse, and the obtained alarm information is incorporated into the current calculation window; when the preset water level line is reached, the calculation window is formed completely, and the calculation window is closed; and judging whether the alarm information in the current calculation window meets the pressing release condition or not.
For details of the specific working process and principle of each unit, reference is made to the alarm suppression method based on the event time and the water level line provided in the above embodiment, and details are not repeated here and are all within the protection scope of the present application.
In the embodiment, all alarms in the calculation window are collected through the calculation window with the time period one by one according to the event time in the original alarm, and the window is closed for calculation after the alarms reach the water level line; if the alarm number in the window exceeds the pressing times, releasing the alarm; otherwise, continuously passing through the next window, repeating the method and judging; the problem of disorder of alarm time caused by slow sending time of the head end of the alarm source is avoided, and the accuracy of suppressing alarm is improved.
The units described in the embodiments of the present disclosure may be implemented by software or hardware. Where the name of a unit does not in some cases constitute a limitation of the unit itself, for example, the first obtaining unit may also be described as a "unit obtaining at least two internet protocol addresses".
The functions described herein above may be performed, at least in part, by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field Programmable Gate Arrays (FPGAs), Application Specific Integrated Circuits (ASICs), Application Specific Standard Products (ASSPs), systems on a chip (SOCs), Complex Programmable Logic Devices (CPLDs), and the like.
Another embodiment of the present application provides a computer storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the alarm suppression method based on event time and water level as described in any one of the above embodiments.
In the context of this disclosure, a machine-readable medium may be a tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device. The machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples of a machine-readable storage medium would include an electrical connection based on one or more wires, a portable computer diskette, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.
It should be noted that the computer readable medium in the present disclosure can be a computer readable signal medium or a computer readable storage medium or any combination of the two. A computer readable storage medium may be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination of the foregoing. More specific examples of the computer readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer diskette, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In the present disclosure, a computer readable storage medium may be any tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device. In contrast, in the present disclosure, a computer readable signal medium may comprise a propagated data signal with computer readable program code embodied therein, either in baseband or as part of a carrier wave. Such a propagated data signal may take many forms, including, but not limited to, electro-magnetic, optical, or any suitable combination thereof. A computer readable signal medium may also be any computer readable medium that is not a computer readable storage medium and that can communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device. Program code embodied on a computer readable medium may be transmitted using any appropriate medium, including but not limited to: electrical wires, optical cables, RF (radio frequency), etc., or any suitable combination of the foregoing.
The computer readable medium may be embodied in the electronic device; or may exist separately without being assembled into the electronic device.
Another embodiment of the present invention provides an electronic device, as shown in fig. 6, including:
one or more processors 601.
A storage device 602 having one or more programs stored thereon.
The one or more programs, when executed by the one or more processors 601, cause the one or more processors 601 to implement the alarm throttling method based on event time and water line as in any of the above embodiments.
In particular, according to an embodiment of the present disclosure, the processes described above with reference to the flowcharts may be implemented as computer software programs. For example, embodiments of the present disclosure include a computer program product comprising a computer program carried on a non-transitory computer readable medium, the computer program containing program code for performing the method illustrated by the flow chart.
Although the subject matter has been described in language specific to structural features and/or methodological acts, it is to be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or acts described above. Rather, the specific features and acts described above are disclosed as example forms of implementing the claims.
While several specific implementation details are included in the above discussion, these should not be construed as limitations on the scope of the disclosure. Certain features that are described in the context of separate embodiments can also be implemented in combination in a single embodiment. Conversely, various features that are described in the context of a single embodiment can also be implemented in multiple embodiments separately or in any suitable subcombination.
The foregoing description is only exemplary of the preferred embodiments of the disclosure and is illustrative of the principles of the technology employed. It will be appreciated by those skilled in the art that the scope of the disclosure herein is not limited to the particular combination of features described above, but also encompasses other embodiments in which any combination of the features described above or their equivalents does not depart from the spirit of the disclosure. For example, the above features and (but not limited to) the features disclosed in this disclosure having similar functions are replaced with each other to form the technical solution.
Features described in the embodiments in the present specification may be replaced or combined with each other, and the same and similar portions among the embodiments may be referred to each other, and each embodiment is described with emphasis on differences from other embodiments. In particular, the system or system embodiments are substantially similar to the method embodiments and therefore are described in a relatively simple manner, and reference may be made to some of the descriptions of the method embodiments for related points. The above-described system and system embodiments are only illustrative, wherein the units described as separate parts may or may not be physically separate, and the parts displayed as units may or may not be physical units, may be located in one place, or may be distributed on a plurality of network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of the present embodiment. One of ordinary skill in the art can understand and implement it without inventive effort.
Those of skill would further appreciate that the various illustrative elements and algorithm steps described in connection with the embodiments disclosed herein may be implemented as electronic hardware, computer software, or combinations of both, and that the various illustrative components and steps have been described above generally in terms of their functionality in order to clearly illustrate this interchangeability of hardware and software. Whether such functionality is implemented as hardware or software depends upon the particular application and design constraints imposed on the implementation. Skilled artisans may implement the described functionality in varying ways for each particular application, but such implementation decisions should not be interpreted as causing a departure from the scope of the present invention.
The previous description of the disclosed embodiments is provided to enable any person skilled in the art to make or use the present invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the generic principles defined herein may be applied to other embodiments without departing from the spirit or scope of the invention. Thus, the present invention is not intended to be limited to the embodiments shown herein but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.
Claims (10)
1. An alarm suppressing method based on event time and water level line is characterized by comprising the following steps:
acquiring alarm information in real time;
acquiring alarm information when a calculation window is not started, and starting the calculation window;
judging whether the alarm information acquired in the current calculation window meets the corresponding pressing release condition or not; the starting time of the calculation window of this time is the event time of acquiring the alarm information when the calculation window is not started, and the ending time of the calculation window of this time is the preset water level line time; the preset water level line time is longer than the alarm time in the pressing release condition;
and if so, releasing the alarm.
2. The alarm suppression method based on event time and water line according to claim 1, wherein starting the calculation window comprises:
taking the event time of firstly acquiring the alarm information as the starting time of the calculation window;
if the current moment reaches the preset waterline time, finishing the calculation window; and taking the preset time after the starting time of the current calculation window as the preset waterline time.
3. The alarm pressing method based on the event time and the water line according to claim 1, wherein judging whether the alarm information acquired in the current calculation window meets the corresponding pressing release condition comprises:
triggering and starting the alarm information of the current calculation window as the 1 st alarm information of the current calculation window;
the current calculation window continues to lengthen the window length according to the time lapse, and the acquired alarm information is brought into the current calculation window;
when the triggering alarm time corresponding to the type of the alarm information is reached, the window length is continued to be lengthened according to the time lapse, and the obtained alarm information is brought into the current calculation window;
when the current calculation window is formed, the current calculation window is closed;
and judging whether the alarm information in the current calculation window meets the suppression release condition or not.
4. The alarm suppression method according to claim 3, wherein the current calculation window is formed, and after the current calculation window is closed, the step of obtaining the alarm information in real time is returned to, so that when new alarm information is obtained, the next calculation window is started.
5. The alarm throttling method based on event time and water line according to any one of claims 1 to 4, wherein the throttling release condition comprises: acquiring alarm information exceeding a preset number of times within the alarm time;
and the event time of the alarm information exceeding the preset times is within the alarm time.
6. An alarm suppression device based on event time and water level, comprising:
the acquisition unit is used for acquiring alarm information in real time;
the starting unit is used for acquiring alarm information when the calculation window is not started and starting the calculation window;
the judging unit is used for judging whether the alarm information acquired in the current calculation window meets the corresponding pressing release condition or not; the starting time of the calculation window at this time is the event time of acquiring the alarm information when the calculation window is not started, and the ending time of the calculation window at this time is the preset water line time; the preset water level line time is longer than the alarm time in the pressing release condition;
and the release alarm unit is used for releasing the alarm if the judgment result of the judgment unit is yes.
7. The alarm pressing device according to claim 6, wherein the starting unit is configured to, when starting the current calculation window, specifically:
taking the event time of firstly acquiring the alarm information as the starting time of the calculation window;
if the current moment reaches the preset waterline time, finishing the calculation window; and taking the preset time after the starting time of the current calculation window as the preset waterline time.
8. The alarm pressing device according to claim 6, wherein the determining unit, when determining whether the alarm information acquired within the current calculation window satisfies the corresponding pressing release condition, is specifically configured to:
triggering and starting the alarm information of the current calculation window as the 1 st alarm information of the current calculation window;
the current calculation window continues to lengthen the window length according to the time lapse, and the acquired alarm information is brought into the current calculation window;
when the triggering alarm time corresponding to the type of the alarm information is reached, the window length is continued to be lengthened according to the time lapse, and the obtained alarm information is brought into the current calculation window;
when the current calculation window is formed, the current calculation window is closed;
and judging whether the alarm information in the current calculation window meets the suppression release condition or not.
9. An electronic device, comprising:
one or more processors;
a storage system having one or more programs stored thereon;
the one or more programs, when executed by the one or more processors, cause the one or more processors to implement the alarm squashing method based on event time and water line of any of claims 1-5.
10. A computer storage medium, having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the alarm suppression method based on event time and water level according to any of claims 1-5.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202210323467.4A CN114664062B (en) | 2022-03-30 | 2022-03-30 | Alarm suppressing method based on event time and water line time and related device |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202210323467.4A CN114664062B (en) | 2022-03-30 | 2022-03-30 | Alarm suppressing method based on event time and water line time and related device |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN114664062A true CN114664062A (en) | 2022-06-24 |
| CN114664062B CN114664062B (en) | 2024-06-11 |
Family
ID=82033140
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202210323467.4A Active CN114664062B (en) | 2022-03-30 | 2022-03-30 | Alarm suppressing method based on event time and water line time and related device |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN114664062B (en) |
Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101483545A (en) * | 2008-12-31 | 2009-07-15 | 中国建设银行股份有限公司 | Financial service monitoring method and system |
| US20190215757A1 (en) * | 2009-04-30 | 2019-07-11 | Icontrol Networks, Inc. | Server-based notification of alarm event subsequent to communication failure with armed security system |
| CN111181751A (en) * | 2018-11-12 | 2020-05-19 | 中国移动通信集团广东有限公司 | Stroboscopic alarm order dispatching control method and system |
| CN112769612A (en) * | 2020-12-30 | 2021-05-07 | 北京天融信网络安全技术有限公司 | Alarm event false alarm removing method and device |
| CN113312241A (en) * | 2021-06-29 | 2021-08-27 | 中国农业银行股份有限公司 | Abnormal alarm method, access log generation method and operation and maintenance system |
| CN113608839A (en) * | 2021-08-10 | 2021-11-05 | 曙光信息产业(北京)有限公司 | Cluster alarm method and device, computer equipment and storage medium |
-
2022
- 2022-03-30 CN CN202210323467.4A patent/CN114664062B/en active Active
Patent Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101483545A (en) * | 2008-12-31 | 2009-07-15 | 中国建设银行股份有限公司 | Financial service monitoring method and system |
| US20190215757A1 (en) * | 2009-04-30 | 2019-07-11 | Icontrol Networks, Inc. | Server-based notification of alarm event subsequent to communication failure with armed security system |
| CN111181751A (en) * | 2018-11-12 | 2020-05-19 | 中国移动通信集团广东有限公司 | Stroboscopic alarm order dispatching control method and system |
| CN112769612A (en) * | 2020-12-30 | 2021-05-07 | 北京天融信网络安全技术有限公司 | Alarm event false alarm removing method and device |
| CN113312241A (en) * | 2021-06-29 | 2021-08-27 | 中国农业银行股份有限公司 | Abnormal alarm method, access log generation method and operation and maintenance system |
| CN113608839A (en) * | 2021-08-10 | 2021-11-05 | 曙光信息产业(北京)有限公司 | Cluster alarm method and device, computer equipment and storage medium |
Also Published As
| Publication number | Publication date |
|---|---|
| CN114664062B (en) | 2024-06-11 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN110661659B (en) | Alarm method, device and system and electronic equipment | |
| CN112822143B (en) | Method, system and equipment for evaluating IP address | |
| US9952921B2 (en) | System and method for detecting and predicting anomalies based on analysis of time-series data | |
| EP3489877A1 (en) | Risk identification method, client device, and risk identification system | |
| CN112164210B (en) | Object-based early warning method and device, storage medium and electronic equipment | |
| CN109936475B (en) | Anomaly detection method and device | |
| CN110475124B (en) | Video jamming detection method and device | |
| CN108923972B (en) | Weight-reducing flow prompting method, device, server and storage medium | |
| CN108306846B (en) | Network access abnormity detection method and system | |
| CN111585837B (en) | Internet of things data link monitoring method and device, computer equipment and storage medium | |
| CN110909306B (en) | Business abnormality detection method and device, electronic equipment and storage equipment | |
| US20190164067A1 (en) | Method and device for monitoring a process of generating metric data for predicting anomalies | |
| CN113992340B (en) | User abnormal behavior identification method, device, equipment and storage medium | |
| CN108923967B (en) | Duplication-removing flow recording method, duplication-removing flow recording device, server and storage medium | |
| CN114664062B (en) | Alarm suppressing method based on event time and water line time and related device | |
| CN111461198B (en) | Action determining method, system and device | |
| CN110633165B (en) | Fault processing method, device, system server and computer readable storage medium | |
| CN117271177A (en) | Root cause positioning method and device based on link data, electronic equipment and storage medium | |
| CN111324809A (en) | Hotspot information monitoring method, device and system | |
| CN110990223A (en) | Monitoring alarm method and device based on system log | |
| CN112702227B (en) | Heartbeat event detection method, device, equipment and computer readable storage medium | |
| CN114943455A (en) | Method and device for preventing rule violation of foreground and background, electronic equipment and storage medium | |
| CN109507645B (en) | Method and device for extracting pulse description words | |
| CN112861120A (en) | Identification method, device and storage medium | |
| EP3457609A1 (en) | System and method for computing of anomalies based on frequency driven transformation and computing of new features based on point anomaly density |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |