CN115495302A

CN115495302A - Determination method of alarm equipment, related device and equipment

Info

Publication number: CN115495302A
Application number: CN202110680956.0A
Authority: CN
Inventors: 邓玉颖; 夏恒; 高江; 岳上; 王嵩; 张美华; 黄现东; 刘凌; 许文正
Original assignee: Tencent Technology Shenzhen Co Ltd; Xian Jiaotong University
Current assignee: Tencent Technology Shenzhen Co Ltd; Xian Jiaotong University
Priority date: 2021-06-18
Filing date: 2021-06-18
Publication date: 2022-12-20

Abstract

The embodiment of the application discloses a method, a device and equipment for determining alarm equipment, which are applied to the field of cloud security and are used for determining root alarm equipment through an alarm convergence matrix so as to quickly locate faults and ensure safe operation. The application includes: acquiring equipment monitoring data corresponding to a target area, wherein the equipment monitoring data comprises the total alarm amount, the state information of each piece of equipment and the state information of each measuring point in at least one measuring point; if the total alarm number of the equipment is greater than or equal to the alarm threshold value, generating an alarm matrix according to the state information of each equipment; generating a fault matrix according to the state information of each measuring point in at least one measuring point; generating an alarm convergence matrix according to the alarm matrix, the fault matrix and the current matrix; and if the alarm convergence matrix is a nonzero matrix, determining the equipment corresponding to the nonzero element position in the alarm convergence matrix as alarm equipment.

Description

Determination method of alarm equipment, related device and equipment

Technical Field

The embodiment of the application relates to the field of cloud security, in particular to a method for determining alarm equipment, a related device and equipment.

Background

Along with the gradual deepening of the information-based construction, the construction scales of a data center, the Internet of things or edge calculation and the like are larger and larger, and the operation and maintenance personnel also need to maintain in time to ensure the normal operation of each construction, so that the operation and maintenance personnel can be helped to discover, respond quickly and deal with problems in time by generating a large amount of alarm information through a monitoring system.

In general, a monitoring system monitors operation data of a plurality of devices and generates corresponding alarm information, and then pushes the alarm information to a designated operation and maintenance person, so that the operation and maintenance person can perform corresponding maintenance on the devices according to the alarm information.

However, when an abnormality occurs in a large-scale network, a situation that the amount of alarm is increased suddenly, that is, an alarm storm, may occur, and then an operation and maintenance person may continuously receive an alarm notification at a certain time, which may cause a problem of repeated alarm or alarm stacking, and a large amount of alarm information may interfere with the operation and maintenance person to obtain important information, causing a trouble to the operation and maintenance person, and bringing about a difficulty in troubleshooting of equipment failure, resulting in a decrease in the accuracy of obtaining a failed device, thereby causing a decrease in the maintenance efficiency of the device.

Disclosure of Invention

The embodiment of the application provides a determination method of alarm equipment, a related device and equipment, wherein the relevance among the equipment is enhanced and the dimension of determining the reference information of the alarm equipment is increased by constructing a current matrix taking the equipment in a target area as an element, an alarm matrix constructed based on the state information of the equipment and a fault matrix constructed based on the state information of a measuring point and determining an alarm convergence matrix by combining the current matrix, the alarm matrix and the fault matrix, so that the alarm equipment is determined by the elements in the alarm convergence matrix, the accuracy rate of obtaining the alarm equipment is improved, the equipment fault investigation is not required to be performed by consuming a large amount of human resources, the efficiency of obtaining the alarm equipment is improved, and the efficiency of maintaining the equipment is improved.

An aspect of the present application provides a method for determining an alarm device, including:

acquiring device monitoring data corresponding to a target area, wherein the target area comprises K devices, the device monitoring data comprises the total alarm number of the K devices, the state information of each device in the K devices and the state information of each measuring point in at least one measuring point, and K is an integer greater than 1;

if the total alarm number of the K devices is greater than or equal to the alarm threshold value, generating an alarm matrix according to the state information of each device;

generating a fault matrix according to the state information of each measuring point in at least one measuring point;

generating an alarm convergence matrix according to the alarm matrix, the fault matrix and the current matrix, wherein the current matrix is used for representing a cause-and-effect network relationship among the K devices, the cause-and-effect network relationship represents a logical relationship between any two devices in the K devices, the current matrix is composed of K elements, and the K elements and the K devices have one-to-one correspondence relationship;

and if the alarm convergence matrix is a nonzero matrix, determining the equipment corresponding to the nonzero element position in the alarm convergence matrix as alarm equipment.

Another aspect of the present application provides an apparatus for determining an alarm device, including:

the device monitoring system comprises an acquisition unit, a processing unit and a processing unit, wherein the acquisition unit is used for acquiring device monitoring data corresponding to a target area, the target area comprises K devices, the device monitoring data comprises the total alarm number of the K devices, the state information of each device in the K devices and the state information of each measuring point in at least one measuring point, and K is an integer larger than 1;

the generating unit is used for generating an alarm matrix according to the state information of each device if the total alarm number of the K devices is greater than or equal to an alarm threshold;

the generating unit is also used for generating a fault matrix according to the state information of each measuring point in at least one measuring point;

the generating unit is further used for generating an alarm convergence matrix according to the alarm matrix, the fault matrix and the current matrix, wherein the current matrix is used for representing a cause-and-effect network relationship among the K devices, the cause-and-effect network relationship represents a logical relationship between any two devices in the K devices, the current matrix is composed of K elements, and the K elements and the K devices have one-to-one correspondence relationship;

and the determining unit is used for determining the equipment corresponding to the position of the non-zero element in the alarm convergence matrix as the alarm equipment if the alarm convergence matrix is a non-zero matrix.

In one possible design, in one implementation of another aspect of an embodiment of the present application,

the device comprises an acquisition unit and a control unit, wherein the acquisition unit is further used for acquiring a causal network relationship corresponding to a target area, the causal network relationship comprises K nodes and Q directed connecting edges, each node corresponds to one device, each directed connecting edge is used for connecting two devices, and Q is an integer greater than or equal to 1;

the determining unit is further configured to determine, according to the causal network relationship, element values corresponding to any two devices of the K devices in the K × K matrix;

and the generating unit is further used for generating a current matrix according to element values corresponding to any two devices in the K x K matrix.

In a possible design, in an implementation manner of another aspect of the embodiment of the present application, the determining unit is specifically configured to:

if the ith device and the jth device in the K devices meet the non-causal relationship, determining the elements of the ith row and the jth column in the K x K matrix as first elements, wherein i and j are integers which are greater than or equal to 1 and less than or equal to K;

and if the ith device and the jth device in the K devices meet the cause-and-effect relationship, determining the element of the ith row and the jth column in the K x K matrix as a second element.

if current passes between the ith device and the jth device in the K devices, determining an element in the ith row and the jth column in the K x K matrix as a first element;

and if no current passes between the ith device and the jth device in the K devices, determining the element in the ith row and the jth column in the K x K matrix as a second element.

the acquisition unit is also used for acquiring an equipment wiring diagram corresponding to the target area;

the processing unit is used for carrying out node division on K devices in the device wiring diagram to obtain K nodes;

the processing unit is further used for carrying out edge connection on any two nodes in the K nodes to obtain a node connection graph

And the processing unit is also used for determining directed edges in the node connection graph and the relationship between every two nodes according to the causal network so as to obtain the causal network relationship.

the acquisition unit is also used for acquiring a historical equipment wiring diagram corresponding to the target area;

the processing unit is also used for transposing the current matrix to obtain a target current matrix when the equipment wiring diagram is inconsistent with the historical equipment wiring diagram;

the generating unit is specifically configured to generate an alarm convergence matrix according to the alarm matrix, the fault matrix, and the target current matrix.

In a possible design, in an implementation manner of another aspect of the embodiment of the present application, the generating unit is specifically configured to:

if the equipment state of the ith equipment in the K equipment is in a normal state, determining the element of the ith row in the K x 1 matrix as a first element;

if the equipment state of the ith equipment in the K equipment is in an abnormal state, determining the element of the ith row in the K x 1 matrix as a second element;

and generating a fault matrix according to the corresponding element values in the K x 1 matrix in the K devices.

the processing unit is further configured to change a second element in the fault matrix into a first element to obtain a target fault matrix if the device load of each device of the K devices meets a preset load condition;

the processing unit is further configured to change a first element in the fault matrix into a second element to obtain a target fault matrix if the device load of any one of the K devices does not meet the preset load condition;

the generating unit is specifically used for generating an alarm convergence matrix according to the alarm matrix, the target fault matrix and the current matrix.

if the alarm state of the ith equipment in the K equipment is a normal state, determining the element of the ith row in the K x 1 matrix as a first element;

if the alarm state of the ith equipment in the K equipment is an abnormal state, determining the element of the ith row in the K x 1 matrix as a second element;

and generating an alarm matrix according to the element values corresponding to the K x 1 matrix in the K devices.

the determining unit is further used for determining elements to be updated in the alarm matrix according to the mapping relation between the fault matrix and the alarm matrix if the alarm convergence matrix is a zero matrix;

the processing unit is also used for updating the element value of the element to be updated into a first element to obtain an updated target alarm matrix;

and the processing unit is also used for releasing the alarm of the equipment corresponding to the first element in the target alarm matrix to obtain the total alarm convergence number.

the determining unit is also used for determining a transfer matrix according to the current matrix and the alarm matrix;

the generating unit is specifically configured to and-operate each element in the transition matrix and the fault matrix to obtain an alarm convergence matrix.

the processing unit is further configured to set the alarm index at the first time as a second index if the total number of alarms at the first time is greater than a preset first alarm threshold and the alarm index at the second time is the first index, where the second time is an adjacent previous time to the first time;

the processing unit is further configured to set the alarm index at the first time as a first index if the total number of alarms at the first time is smaller than a preset second alarm threshold and the alarm index at the second time is a second index, where the second alarm threshold is larger than the first alarm threshold;

the processing unit is further used for setting the alarm index at the first moment as the alarm index at the second moment if the alarm total number at the first moment is less than or equal to a first alarm threshold and is greater than or equal to a second alarm threshold;

and the determining unit is also used for determining the alarm level at the first moment according to the alarm index.

Another aspect of the present application provides a computer device comprising: a memory, a processor, and a bus system;

the memory is used for storing program codes;

the processor is used for executing the determination method of the alarm device in any aspect according to the instructions in the program code;

the bus system is used for connecting the memory and the processor so as to enable the memory and the processor to communicate.

Another aspect of the present application provides a computer-readable storage medium having instructions stored thereon, which when executed on a computer, cause the computer to perform the method of the above-described aspects.

One aspect of the present application provides a computer program product or computer program comprising computer instructions stored in a computer readable storage medium. The processor of the computer device reads the computer instructions from the computer readable storage medium, and the processor executes the computer instructions to cause the computer device to execute the determination method of the alarm device provided by any one of the above aspects.

According to the technical scheme, the embodiment of the application has the following advantages:

the method comprises the steps of obtaining device monitoring data corresponding to a target area, generating an alarm matrix according to state information of each device when the total alarm number of the devices in the device monitoring data is larger than or equal to an alarm threshold value, generating a fault matrix according to the state information of each measuring point in at least one measuring point in the device monitoring data, further generating an alarm convergence matrix according to the alarm matrix, the fault matrix and a current matrix, and determining the devices corresponding to the non-zero element positions in the alarm convergence matrix as alarm devices when the alarm convergence matrix is a non-zero matrix. By the aid of the method, the current matrix taking the equipment in the target area as an element, the alarm matrix constructed on the basis of the state information of the equipment and the fault matrix constructed on the basis of the state information of the measuring points are constructed, and the alarm convergence matrix is determined by combining the current matrix, the alarm matrix and the fault matrix to enhance the relevance among the equipment and increase the dimensionality of reference information for determining the alarm equipment.

Drawings

FIG. 1 is a schematic diagram of an architecture of alarm processing in an embodiment of the present application;

FIG. 2 is a schematic diagram of an embodiment of a method for determining an alarm device in an embodiment of the present application;

FIG. 3 is a schematic diagram of another embodiment of a determination method of an alarm device in the embodiment of the present application;

FIG. 4 is a schematic diagram of another embodiment of a determination method of an alarm device in the embodiment of the present application;

FIG. 5 is a schematic diagram of another embodiment of a determination method of an alarm device in an embodiment of the present application;

FIG. 6 is a schematic diagram of another embodiment of a determination method of an alarm device in an embodiment of the present application;

FIG. 7 is a schematic diagram of another embodiment of a determination method of an alarm device in the embodiment of the present application;

FIG. 8 is a schematic diagram of another embodiment of a determination method of an alarm device in the embodiment of the present application;

fig. 9 is a schematic diagram of another embodiment of the determination method of the alarm device in the embodiment of the present application;

FIG. 10 is a schematic diagram of another embodiment of a determination method of an alarm device in the embodiment of the present application;

fig. 11 is a schematic diagram of another embodiment of the determination method of the alarm device in the embodiment of the present application;

fig. 12 is a schematic diagram of another embodiment of the determination method of the alarm device in the embodiment of the present application;

FIG. 13 is a schematic diagram of another embodiment of a determination method of an alarm device in the embodiment of the present application;

FIG. 14 is a schematic diagram of one device wiring of the determination method of the alerting device in the embodiment of the present application;

FIG. 15 is a schematic diagram of a causal network of the determination of an alert device in an embodiment of the present application;

FIG. 16 is a schematic diagram of a current matrix of a determination method of an alerting device in an embodiment of the present application;

FIG. 17 is a diagram showing a change in a failure matrix of a determination method of an alarm device in the embodiment of the present application;

FIG. 18 is a schematic diagram of an embodiment of a determination device of an alarm apparatus in the embodiment of the present application;

FIG. 19 is a schematic diagram of an embodiment of a computer device in the embodiment of the present application.

Detailed Description

The embodiment of the application provides a determination method of alarm equipment, a related device and equipment, which are used for enhancing the relevance among the equipment and increasing the dimensionality of reference information for determining the alarm equipment by constructing a current matrix taking equipment in a target area as an element, constructing an alarm matrix based on state information of the equipment and a fault matrix constructed based on state information of a measuring point and determining an alarm convergence matrix by combining the current matrix, the alarm matrix and the fault matrix, thereby determining the alarm equipment by using the elements in the alarm convergence matrix, improving the accuracy rate of obtaining the alarm equipment, avoiding consuming a large amount of human resources for equipment fault troubleshooting, improving the efficiency of obtaining the alarm equipment and improving the efficiency of maintaining the equipment.

The terms "first," "second," "third," "fourth," and the like in the description and in the claims, as well as in the drawings, if any, are used for distinguishing between similar elements and not necessarily for describing a particular sequential or chronological order. It is to be understood that the data so used is interchangeable under appropriate circumstances such that the embodiments of the invention described herein are, for example, capable of operation in sequences other than those illustrated or otherwise described herein. Moreover, the terms "comprises," "comprising," and "having," and any variations thereof, are intended to cover a non-exclusive inclusion, such that a process, method, system, article, or apparatus that comprises a list of steps or elements is not necessarily limited to those steps or elements expressly listed, but may include other steps or elements not expressly listed or inherent to such process, method, article, or apparatus.

With the gradual deepening of the informatization construction, the construction scale of a data center, a public cloud/private cloud or an internet of things is larger and larger, so that the cloud security technology can be adopted for construction and maintenance in order to ensure the normal operation of each construction. A data center (DataCenter) generally refers to a physical space where centralized processing, storage, transmission, exchange and management of information are implemented, and computer devices, server devices, network devices, storage devices, etc. are generally regarded as key devices of a core computer room of a network, wherein environmental factors required by the operation of the key devices, such as a power supply system, a refrigeration system, an equipment rack system, a fire protection system, a monitoring system, etc., are generally regarded as key physical infrastructures.

Cloud Security (Cloud Security) refers to the generic name of Security software, hardware, users, organizations, security Cloud platforms based on Cloud computing business model applications. The cloud security integrates emerging technologies and concepts such as parallel processing, grid computing and unknown virus behavior judgment, abnormal monitoring of software behaviors in the network is achieved through a large number of meshed clients, the latest information of trojans and malicious programs in the internet is obtained and sent to the server for automatic analysis and processing, and then the virus and trojan solution is distributed to each client.

The main research directions of cloud security include: 1. the cloud computing security mainly researches how to guarantee the security of the cloud and various applications on the cloud, including the security of a cloud computer system, the security storage and isolation of user data, user access authentication, information transmission security, network attack protection, compliance audit and the like; 2. the cloud of the security infrastructure mainly researches how to adopt cloud computing to newly build and integrate security infrastructure resources and optimize a security protection mechanism, and the cloud computing technology is used for constructing an ultra-large-scale security event and information acquisition and processing platform, so that the acquisition and correlation analysis of mass information are realized, and the security event control capability and risk control capability of the security network are improved; 3. the cloud security service mainly researches various security services, such as anti-virus services and the like, provided for users based on a cloud computing platform.

It should be understood that the method for determining an alarm device provided by the present application may be applied to the field of cloud security, and is used in a scenario where an alarm device is located through monitoring data and an alarm of a device, for example, an alarm device in a computer room is located by processing collected monitoring data and an alarm of devices such as a data processing device, a storage device, a network transmission device, and a machine room security device in the computer room; as another example, the positioning of the alarm device in the campus is performed, for example, by using the collected monitoring data and alarms of various electrical devices in the electrical system of the internet of things campus; as another example, the location of the alarm device within the fire park is performed, for example, using collected monitoring data of various electrical devices in the electrical system of the fire park and alarms; as another example, for example, the alarm device of the power supply system is located by using collected monitoring data and alarms of various electrical devices in the power supply system, in order to implement the location of the alarm device in the above various scenarios, in the conventional method for determining the alarm device, a failed device is mainly investigated by manually analyzing collected operation data of multiple devices and alarm information of the devices to obtain the alarm device, which not only needs to consume a large amount of labor cost and time cost, but also is easily interfered by a large amount of alarm information, so that the accuracy rate for determining the alarm device is not high, and the efficiency for maintaining the safety of the device is low.

In order to solve the above problem, the present application provides a method for determining an alarm device, where the method is applied to an alarm processing system shown in fig. 1, and please refer to fig. 1, where fig. 1 is a schematic diagram of an architecture of the alarm processing system in an embodiment of the present application, as shown in fig. 1, a server obtains device monitoring data corresponding to a target area, generates an alarm matrix according to state information of each device when a total number of alarms of devices in the device monitoring data is greater than or equal to an alarm threshold, generates a fault matrix according to state information of each measurement point in at least one measurement point in the device monitoring data, further generates an alarm convergence matrix according to the alarm matrix, the fault matrix, and a current matrix, and then determines a device corresponding to a non-zero element position in the alarm convergence matrix as an alarm device when the alarm convergence matrix is a non-zero matrix. By the method, the current matrix taking the equipment in the target area as an element, the alarm matrix constructed based on the state information of the equipment and the fault matrix constructed based on the state information of the measuring point are constructed, and the alarm convergence matrix is determined by combining the current matrix, the alarm matrix and the fault matrix to enhance the relevance among the equipment and increase the dimensionality of the reference information for determining the alarm equipment.

In order to solve the above problem, the present application proposes a determination method of an alert device, which is generally performed by a server or a terminal device, and accordingly, a determination apparatus applied to an alert device is generally provided in a server or a terminal device.

Referring to fig. 2, a method for determining an alarm device in the present application is described below, where an embodiment of the method for determining an alarm device in the present application includes:

in step S101, device monitoring data corresponding to a target area is obtained, where the target area includes K devices, the device monitoring data includes the total number of alarms of the K devices, status information of each device of the K devices, and status information of each measurement point of at least one measurement point, and K is an integer greater than 1;

in this embodiment, with the development of the internet, in order to better store and utilize data, each large enterprise is performing information construction, for example, establishing a data center, so a target area may be represented as an area where devices such as a computer room, a distribution substation, and a power supply system of the data center are regularly distributed, and may also be other areas such as an internet of things park and an electric power system, which is not specifically limited herein.

However, due to the service requirement, there are often thousands of devices in a data center, and different measurement points are set for each device to monitor the devices, so that there are multiple devices in a target area, such as various electrical devices, which are connected to each other, and the electrical devices often fail to timely handle the device failure problems, such as line aging, device short circuit, and disconnection, during the actual operation process, which may cause a failure of the power system, thereby seriously jeopardizing the normal power supply of the power users, and since the devices may generate and send out corresponding alarm information, i.e., an alarm, such as an excessively high voltage of the device a, when a failure occurs in the target area, the alarm of thousands or even tens of thousands of devices is often accompanied, which easily causes an alarm storm, so that the operation and maintenance personnel cannot judge the root cause of the failure, and cannot perform device maintenance in time, thereby causing the device breakdown in the target area.

Therefore, in order to maintain safe operation of the devices in the target area, for example, the power system can quickly recover power supply in a short time, the device monitoring data can be obtained by monitoring the devices in the target area in real time, and the device monitoring data includes total alarms, device state information, state information of the measurement point, and the like, wherein the device state information includes, without specific limitation, alarms of each device, alarm types, alarm positions, alarm contents, alarm times, and the like corresponding to each alarm, and the state information of the measurement point includes, without specific limitation, normal measurement point, abnormal measurement point, device load of each device, and the like, and then the faulty device can be located by analyzing and processing the obtained device monitoring data.

Specifically, the acquiring of the device monitoring Data corresponding to the target area may specifically be to perform Data monitoring And device alarming on each device in the target area through a Data Acquisition And monitoring Control System (SCADA), so as to acquire the device monitoring Data, and may also adopt other monitoring devices, where no specific limitation is imposed, so that the device monitoring Data may be subsequently analyzed And processed by using a certain method, such as a method for constructing a time sequence cause network, a grand cause And effect network, or an analysis model, so as to accurately position the alarming device according to a processing result.

The SCADA is a Distributed Control System (DCS) and an electric power automation monitoring System based on a computer, and can be applied to data acquisition and monitoring Control, process Control and the like in the fields of electric power, metallurgy, petroleum, chemical industry, gas, railways and the like. The SCADA mainly relates to configuration software, and industrial isolation security gateways of data transmission links (such as data transmission Radio stations and General Packet Radio Service (GPRS)), wherein the security isolation gateways ensure the security of an industrial information network, and most of the industry uses the security gateways to prevent viruses so as to ensure the security of industrial data and information.

In step S102, if the total number of alarms of the K devices is greater than or equal to the alarm threshold, generating an alarm matrix according to the status information of each device;

in this embodiment, after the device monitoring data corresponding to the target area is obtained, because a certain correlation exists between devices in the target area, for example, a certain logical relationship exists between a device fault and protection and a circuit breaker action in the power system, and this relationship can be described by using a cause-and-effect network, and physical quantities such as current and voltage can be detected between devices electrically connected in the target area, and the types of alarms generated by the devices are various, the present embodiment can introduce an alarm matrix to construct a new cause-and-effect network, that is, a current network, on the basis of the original cause-and-effect network, which is a network formed by taking devices flowing through as nodes, and is used for locating a fault of a device in the target area.

Further, since the device in the target area may be configured with the alarm policy in advance, and when the device is abnormal or faulty, the device may generate corresponding alarm information, that is, device information, such as the time when the alarm occurs, the location where the alarm occurs, and the alarm content, so that the alarm matrix at each moment in a period of time may be constructed by predefining the definition of the alarm matrix to initially classify the alarm of the device, which may be used to accurately eliminate the non-faulty device, thereby further analyzing and processing other devices that generate the alarm and that eliminate the non-faulty device, so as to accurately obtain the alarm device.

Wherein the alarm type generated by the equipment can be expressed as A _ij Wherein i ∈ [1, 2.,. K., k ∈]K is more than or equal to 1, k represents the number of devices in the target area, and j belongs to [1,2]S is more than or equal to 1, s represents the number of equipment alarm strategies configured in the equipment in the target area, and the alarm type A _ij There are the following rules between:

A _i1 ∩A _i2 ∩A _i3 ∩...∩A _is ＝φ,i∈[1,2,...,k] (1.1)

A _1j ∩A _2j ∩A _3j ∩...∩A _kj ≠φ,j∈[1,2,...,s] (1.2)

it should be noted that, when configuring the device alarm policy for the device, the target area in this embodiment may also be configured according to the above equations (1.1) and (1.2).

Further, if the total number of alarms of the K devices at a certain time is greater than or equal to the alarm threshold value within a period of time, it can be understood that the alarm number at the certain time may form an alarm storm, a preset alarm convergence program can be started to converge the obtained device alarm according to a preset time window, and a sending channel blockage caused by the alarm storm can be avoided, so that operation and maintenance personnel can obtain effective alarm information in time, thereby improving the device maintenance efficiency to a certain extent and ensuring the safe operation of the device.

Specifically, in the acquired device monitoring data, if the total number of alarms of K devices at a certain time is greater than or equal to an alarm threshold value within a period of time, it may be understood that the alarm number at the time may form an alarm storm, and to avoid device paralysis, an alarm matrix at the time may be generated according to a pre-designed alarm matrix definition for the acquired device information of each device, and it may be understood that a failed device is analyzed by the internal information of the device, so as to classify non-failed devices and devices that may be failed devices, and a non-failed device may be accurately excluded, thereby improving the accuracy of acquiring the alarm device to a certain extent.

In step S103, a fault matrix is generated according to the status information of each measurement point in the at least one measurement point;

in this embodiment, the reason for the alarm generated by the device is not limited to the device fault, and may be that the device is unstable due to the influence of an upstream device, so that a false alarm is generated, if the device generating the alarm is directly analyzed as a faulty device during device fault diagnosis, the accuracy of positioning the alarm device is reduced, and since the types of devices in the target area are various and the types of corresponding alarms are also various, after the device monitoring data is obtained, in order to further perform troubleshooting or positioning of the device that generates the alarm on the device that generates the alarm, it is possible to analyze whether the device belongs to the device that is the root of the fault through state information corresponding to the measurement point used for measuring the operating state of the device in the device monitoring data, such as device abnormality, device normality, or device load, according to the definition of a preset fault matrix, a fault matrix corresponding to each time is constructed.

Specifically, after the device monitoring data is acquired, the state information of the measurement point corresponding to each time within a period of time may be used to construct the fault matrix corresponding to each time according to the definition of the preset fault matrix, and it may be understood that whether the device belongs to the fault source device is analyzed through the external information of the device, so that the accuracy of acquiring the fault device is improved to a certain extent, wherein each measurement point may correspond to one or more devices, and therefore the state information of each measurement point may correspond to the state information of one or more devices.

In step S104, an alarm convergence matrix is generated according to the alarm matrix, the fault matrix, and the current matrix, where the current matrix is used to represent a cause-and-effect network relationship among the K devices, the cause-and-effect network relationship represents a logical relationship between any two devices among the K devices, the current matrix is composed of K elements, and the K elements and the K devices have a one-to-one correspondence relationship;

in this embodiment, the current matrix is a rule matrix that includes K elements, each element corresponds to one device in the target area, and is constructed by taking all devices in the target area as objects, and can be used to represent a causal network relationship among all devices in the target area, and it can be understood that whether a device belongs to the fault root source device is analyzed through global information of the device.

Specifically, after the alarm matrix and the fault matrix are obtained, the alarm matrix, the fault matrix and the current matrix are calculated by obtaining the current matrix to obtain an alarm convergence matrix with multi-dimensional reference information, and whether the multi-dimensional analysis equipment belongs to the fault source equipment can be further determined by using the alarm convergence matrix, so that the accuracy of obtaining the alarm equipment is increased.

In step S105, if the alarm convergence matrix is a non-zero matrix, the device corresponding to the non-zero element position in the alarm convergence matrix is determined as an alarm device.

In this embodiment, the alarm device is a root cause fault device that may cause a breakdown of the target area device, and after the alarm convergence matrix is obtained, when the alarm convergence matrix is a non-zero matrix, it may be understood that the root cause matrix that generates the fault is captured, so that the alarm device may be determined by using non-zero elements in the non-zero matrix.

Specifically, when the obtained alarm convergence matrix is a non-zero matrix, the device corresponding to the non-zero element in the alarm convergence matrix can be used as an alarm device, so that the alarm device can be accurately and quickly obtained, the efficiency of determining the alarm device is improved, and the efficiency of maintaining the device is improved.

For example, assuming that a current matrix R corresponding to a target area constructed by using equipment as an element can obtain an 88-order sparse matrix, and assuming that a line 1 of the target area is powered off, power supply is maintained by a line 2 instantly through a bus-coupled switch, so that a service normally operates, but 437 alarms are still generated, assuming that an alarm threshold is 10, wherein 437 alarms are obviously generated at the current moment, and therefore, in order to avoid a transmission channel blockage caused by the alarm storm, operation and maintenance personnel can timely obtain effective alarm information and accurately obtain and position the alarm information to the alarm equipment, thereby improving equipment maintenance efficiency to a certain extent, ensuring operation safety, starting an alarm convergence program to converge the alarms, generating an alarm matrix a based on the alarms to eliminate non-fault equipment, constructing a fault matrix F by whether the operation of a measurement point is abnormal, and calculating the alarm matrix, the fault matrix and the current matrix to obtain a most converged alarm terminal equipment.

As shown in table 1, the device corresponding to the element with the element value of 1 in the transformation matrix T indicates that the upstream device of the device does not generate an alarm, but the device itself generates an alarm, and then the alarms of these devices may be the root cause of the alarm storm, and the final convergence device is obtained by obtaining the same elements in F and T and starting an alarm convergence program for alarm convergence, and the final convergence device is the alarm device, and the alarm device is further obtained as device 1. If 5 alarm sources are output after the alarms of the device corresponding to the element 0 in the alarm matrix a are released in the convergence process, in 437 alarms, if there are 20 remaining alarms, that is, no convergence alarm, and 412 converged alarms, the alarm convergence rate reaches 97.3%, which not only can achieve a good convergence effect, but also enables operation and maintenance personnel to quickly locate a fault according to the device 1, thereby maintaining operation safety.

TABLE 1

For example, assuming that power supply is restored after the line 1 in a certain target area is interrupted, assuming that 3569 alarms are generated in total, assuming that the alarm threshold is 10, as shown in table 2, assuming that alarm convergence is performed when an alarm convergence procedure is started when the total number of alarms exceeds the alarm threshold, and a fault matrix F is generated according to the state information of the measurement point, assuming that, in the process of restoring power supply to the line 1, as shown in table 2, the alarm devices that can be obtained are the device 5, the device 7, and the device 8. Assuming that the alarms of the devices corresponding to the 0 element stored in the alarm matrix are released in the convergence process, the final positions of 30 alarm roots, 3321 converged alarms and 218 unconverged alarms are located, and the convergence rate reaches 93%.

TABLE 2

In the embodiment of the application, a method for determining the alarm device is provided, and through the above manner, the current matrix taking the device in the target area as an element, the alarm matrix constructed based on the state information of the device, the fault matrix constructed based on the state information of the measurement point, and the alarm convergence matrix determined by combining the current matrix, the alarm matrix and the fault matrix are realized to enhance the relevance among the devices and increase the dimension of the reference information for determining the alarm device, so that the alarm device is determined by the element in the alarm convergence matrix, the accuracy of obtaining the alarm device is improved, the device fault troubleshooting is not required to be performed by consuming a large amount of human resources, the obtaining efficiency of the alarm device is improved, and the maintenance efficiency of the device is improved.

Optionally, on the basis of the embodiment corresponding to fig. 2, in another optional embodiment of the method for determining an alert device provided in the embodiment of the present application, as shown in fig. 3, the method further includes:

in step S301, a causal network relationship corresponding to the target area is obtained, where the causal network relationship includes K nodes and Q directed connecting edges, each node corresponds to one device, each directed connecting edge is used to connect two devices, and Q is an integer greater than or equal to 1;

in step S302, according to the causal network relationship, determining element values corresponding to any two devices in the K × K matrix;

in step S303, a current matrix is generated according to the element values corresponding to any two devices in the K × K matrix.

In this embodiment, the causal network relationship is a relationship obtained by performing conversion processing on an electrical general connection diagram of a device in a construction target area based on a causal network, and can be used to represent a logical relationship between devices, where the causal network is a network based on a glanged causal network and is composed of fault nodes, breaker nodes, and protection device nodes, as shown in fig. 15, the devices may be converted into nodes, then the nodes may be connected by directed connection edges, and the logical relationship between the devices is expressed by the directed connection edges based on the causal network, that is, each directed connection edge corresponds to one logical relationship.

Therefore, after the causal network relationship corresponding to the target area is obtained, a current network can be introduced to construct a current matrix, and the causal network relationship corresponding to the current network is also a network relationship formed by taking current flowing through equipment as nodes, so that the current matrix can be constructed according to the causal network relationship, a K-order binary matrix constructed by taking the number of the equipment in the current network as an order and taking the current flow direction as an element is constructed according to the definition of a preset current matrix, namely the current matrix, and the current matrix can be used for enhancing the relevance among the equipment in the target area and clearly describing the logical relationship among the equipment through the current matrix, so that the current matrix can be used for further fault reasoning subsequently, and the alarm equipment can be accurately obtained.

Specifically, before the alarm convergence matrix is obtained, a current matrix which is constructed by taking the number of devices in the current network as an order and taking the current flow direction as an element may be constructed by obtaining a cause-and-effect network relationship of the target region, specifically, the element values corresponding to any two devices in the K × K matrix may be obtained by defining the K devices according to a preset current matrix according to the obtained cause-and-effect network relationship, so as to obtain the current matrix of the K order.

Optionally, on the basis of the embodiment corresponding to fig. 3, in another optional embodiment of the method for determining an alarm device provided in the embodiment of the present application, as shown in fig. 4, determining, according to a causal network relationship, element values corresponding to any two devices of the K devices in a K × K matrix includes:

in step S401, if the ith device and the jth device in the K devices satisfy a non-causal relationship, determining an element in the ith row and jth column in the K × K matrix as a first element, where i and j are integers greater than or equal to 1 and less than or equal to K;

in step S402, if the ith device and the jth device in the K devices satisfy the cause-and-effect relationship, the element in the ith row and jth column in the K × K matrix is determined as the second element.

In this embodiment, the current matrix is configured as a binary matrix of K-th order, which can more clearly represent the logical relationship between the devices, so that the element values in the current matrix can be represented by a first element and a second element, where the element values are preferably 0 and 1, and other element values can also be adopted, and are not limited herein.

Further, since the causal network relationship can be used to represent the logical relationship between the devices, referring to fig. 15, the logical relationship between the devices can be specifically expressed as a causal relationship (cause), and a non-causal relationship, such as protected and supported, etc., so that, in order to further enhance the association between the devices in the target area and to describe the logical relationship between the devices more accurately and clearly, the present embodiment may construct the current matrix by the definition in the following equation (2):

wherein the current matrix R [ i, j ]]Opposite angle of (2)The line elements are all set to 1's,

indicates the phase, C _i And C _j Is a current matrix R [ i, j ]]Is used for representing various electrical devices, i, j is belonged to [1,2]K is more than or equal to 1, k represents the number of the electrical equipment,

for indicating that the ith and jth devices satisfy a causal relationship, specifically indicating C _j Is caused by C _i The cause of the occurrence of C _i Is composed of C _j The resulting result, else, indicates that the other, i.e., the ith device and the jth device, satisfy a non-causal relationship.

For example, as shown in fig. 16, assuming that when the causal relationship is satisfied between the device C2 and the device C3, referring to fig. 15, it is known that the device C3 is a cause causing the C2 to occur and the C2 is a result caused by the C3 by the directional edge connection, and therefore, the element value of the second row and the third column may be set to 1.

Optionally, on the basis of the embodiment corresponding to fig. 3, in another optional embodiment of the method for determining an alarm device provided in the embodiment of the present application, as shown in fig. 5, determining, according to a causal network relationship, element values corresponding to any two devices of the K devices in a K × K matrix includes:

in step S501, if there is a current passing between the ith device and the jth device in the K devices, determining an element in the ith row and the jth column in the K × K matrix as a first element;

in step S502, if there is no current passing between the ith device and the jth device in the K devices, the element in the ith row and the jth column in the K × K matrix is determined as the second element.

In this embodiment, since the rule matrix R in the causal network is derived from the belief network, and the bayesian conditional probability between the default associated nodes is 1, which is completely suitable in the power system, but a large number of expert rules are introduced in the convergence alarm content, which increases the workload of manual work, and has no generalization, if fault location is performed in the low-voltage side power system in the target area, which may result in a decrease in location accuracy and a poor alarm convergence effect, therefore, the current matrix is constructed by introducing the flowing state of the current to enhance the association between the devices, so as to better describe the logical relationship between the devices, and the current matrix may be constructed by the definition in the following equation (3):

wherein the current matrix R [ i, j ]]All diagonal elements of (1,C) _i And C _j Is a current matrix R [ i, j ]]The element in (1), i, j belongs to [1,2]K is 1, k represents the number of electrical devices, C _i →C _j Indicating that current is flowing from electrical device i to electrical device j and else indicating that no current is flowing between the two electrical devices.

For example, as shown in fig. 16, assuming that there is a current passing between the device C2 and the device C3, it can be understood that there is a strong correlation between the device C2 and the device C3, and therefore, the element value of the second row and the third column can be set to 1.

Optionally, on the basis of the embodiment corresponding to fig. 3, in another optional embodiment of the method for determining an alarm device provided in the embodiment of the present application, as shown in fig. 6, the obtaining a causal network relationship corresponding to the target area includes:

in step S601, an equipment wiring diagram corresponding to the target area is obtained;

in step S602, node division is performed on K devices in the device wiring diagram to obtain K nodes;

in step S603, any two nodes of the K nodes are edge-connected to obtain a node connection graph;

in step S604, a directed edge in the node connection graph and a relationship between two nodes are determined according to the causal network, so as to obtain a causal network relationship.

In this embodiment, the cause-and-effect network relationship corresponding to the target area is obtained by converting an equipment wiring diagram corresponding to the target area based on a cause-and-effect network, and can be used for visually reflecting a logic relationship between each piece of equipment to quickly and accurately construct a current matrix, and then analyzing and positioning the fault equipment through the current matrix, so that the accuracy of obtaining the alarm equipment can be improved to a certain extent, wherein the equipment wiring diagram can be specifically represented as an electrical general wiring diagram in the target area, can be provided by a construction team, can be obtained from a large data platform, and can also be obtained in other manners, which is not specifically limited herein.

For example, as shown in fig. 14, in an equipment wiring diagram, L represents an equipment fault, CB1 represents a circuit breaker 1, mr1 represents a main protection 1, br1 represents a backup protection 1, cb2 represents a circuit breaker 2, mr2 represents a main protection 2, br2 represents a backup protection 2, which may be embodied by that, for example, due to a single-phase grounding of L on a line, such as a lightning stroke, etc., protective devices MR1, MR2, BR1, and BR2 may sense a large grounding current and may exceed a fixed value of the protective devices, and the protective devices may operate, and trip out circuit breakers CB1 or CB2 (such as high-voltage switches) of the line, thereby cutting off power transmitted to the line and reducing the influence on the power grid.

Further, when a large number of alarms are caused by an equipment fault and an alarm storm is caused, in order to effectively eliminate interference information and visually reflect the connection between the equipments, so as to better determine the equipment of the fault source, as shown in fig. 15, in this embodiment, a node type may be introduced, an obtained equipment wiring diagram is divided according to a preset node type, then, edges are connected between the classified nodes to obtain a node connection diagram, and further, the direction of each edge is determined through a causal network to obtain directed connecting edges, and each directed connecting edge corresponds to a logical relationship, so that the relationship between the equipments and the equipments can be better presented in a topological graph of the causal network relationship.

Further, as shown in table 3, after the causal network relationship is obtained, in order to construct the current matrix more accurately and quickly, the embodiment may perform list conversion on the obtained causal network relationship to obtain a node list including nodes, node contents, and node labels.

Node point	Content providing method and apparatus	Label (R)
			C1	Fault is generated at L position of power transmission line	L
C2	Primary protection MR1 action	MR1
			C3	Current breaker CB1 trip	CB1
C4	MR1 action but CB1 rejection	MR1∧(！CB1)
			C5	Backup protection BR1 actions	BR1
C6	Primary protection MR2 action	MR1
			C7	Trip of current breaker CB2	CB2
C8	MR2 action but CB2 rejection	MR2∧(！CB2)
			C9	Backup protected BR2 actions	BR2

TABLE 3

Optionally, on the basis of the embodiment corresponding to fig. 6, in another optional embodiment of the method for determining an alert device according to the embodiment of the present application, as shown in fig. 7, the method further includes:

in step S701, a historical device wiring diagram corresponding to the target area is obtained;

in step S702, when the device wiring diagram is inconsistent with the historical device wiring diagram, transposing the current matrix to obtain a target current matrix;

generating an alarm convergence matrix according to the alarm matrix, the fault matrix and the current matrix comprises:

in step S703, an alarm convergence matrix is generated according to the alarm matrix, the fault matrix, and the target current matrix.

In this embodiment, the historical device wiring diagram is a wiring diagram acquired at a time before an obtained device wiring diagram at the current time, and since when the device wiring diagram is inconsistent with the historical device wiring diagram and the connection between the devices changes, the logical relationship between the devices may also change accordingly, in order to avoid repeatedly constructing a current matrix and ensure that the current matrix can accurately reflect the logical relationship between the devices, this embodiment may be implemented by transposing the current matrix.

Specifically, because the cause and effect relationship between the devices is mainly reflected by the current matrix R, the original cause and effect relationship between the devices is also converted along with the transposition of the current matrix, so when the device wiring diagram is inconsistent with the historical device wiring diagram, the current matrix is transposed to obtain the target current matrix, and the current matrix after the logic relationship between the devices is changed can be accurately obtained, thereby realizing the reverse reasoning between the alarm signal and the fault signal to a certain extent.

Optionally, on the basis of the embodiment corresponding to fig. 2, in another optional embodiment of the method for determining an alarm device provided in the embodiment of the present application, as shown in fig. 8, the fault matrix is a K × 1 matrix, and the state information of the measurement point includes a device state; generating a fault matrix based on the status information of each of the at least one measurement point comprises:

in step S801, if the device status of the ith device among the K devices is a normal status, determining an element in the ith row in the K × 1 matrix as a first element;

in step S802, if the device status of the ith device of the K devices is an abnormal status, determining an element in the ith row of the K × 1 matrix as a second element;

in step S803, a failure matrix is generated from the element values corresponding to the K × 1 matrix in the K devices.

In this embodiment, since the fault matrix can be used to judge whether data of the equipment fault is captured, the fault matrix can be determined by judging the operation condition of the measuring points, wherein the operation condition of the measuring points can be represented by the current value flowing through the equipment and the state change of the circuit breaker on the line, so that the fault equipment can be analyzed and positioned by the fault matrix, and therefore, the fault matrix can be constructed by the definition in the following expression (4):

wherein F (i) is a k × 1 column vector, i, j ∈ [1,2]K.gtoreq.1, k represents the number of electrical devices, wherein,

indicated as 0 for the current through the electrical device i,

state indicates a change in the state of the breaker switch, else indicates that the current flowing through the electrical apparatus i is not 0.

For example, when the acquired state information of the measurement point indicates that the device state of the device i is an abnormal state, specifically, it indicates that the current value flowing through the device i is 0, and the current state of the breaker connected to the device i is switched to an open state with respect to the closed state at the previous time, therefore, the element in the ith row in the K × 1 matrix corresponding to the device i may be set to 1.

Optionally, on the basis of the embodiment corresponding to fig. 8, in another optional embodiment of the method for determining an alert device provided in the embodiment of the present application, as shown in fig. 9, the method further includes:

in step S901, if the device load of each device of the K devices meets the preset load condition, changing the second element in the fault matrix into the first element to obtain a target fault matrix;

in step S902, if the device load of any one of the K devices does not satisfy the preset load condition, changing the first element in the fault matrix of the device load that does not satisfy the preset load condition into the second element to obtain a target fault matrix;

in step S903, an alarm convergence matrix is generated according to the alarm matrix, the target fault matrix, and the current matrix.

In this embodiment, since the alarm of the devices may be the source of the alarm storm when the upstream device does not generate an alarm but the current device itself generates an alarm, in order to further locate the accurate alarm source device, this embodiment may determine the target fault matrix by specifically and without limitation to the device load of each device, such as a current value, a voltage, or a switch state.

Specifically, after the fault matrix is obtained, in order to further locate an accurate alarm source device, it may be determined whether the device load of each device meets a preset load condition, where when the device load of each device in the K devices meets the preset load condition, it is indicated that the device load of the device is normal, and then 1 in the fault matrix is changed to 0, or when one device load of each device in the K devices does not meet the preset load condition, it is indicated that the device load of the device is abnormal, and then 0 in the fault matrix is changed to 1, so as to obtain a target fault matrix.

For example, as shown in fig. 17, assuming that the data center adopts a dual-loop power supply, corresponding elements of the a-way commercial power and the B-way commercial power in the current matrix R are C1 and C2, when the current values of the a-way commercial power and the B-way commercial power do not reach normal values, the corresponding position of the F matrix jumps from 0 to 1, which may be specifically represented as a illustrated in fig. 17 and B illustrated in fig. 17, and it may be understood that the current value of the device C1 or the device C2 does not reach normal values, so that 0 may be changed to 1; and C shown in fig. 17 means that the current values of the device C1 and the device C2 both reach a normal value, so 1 is changed to 0, wherein the normal value can be set according to the number of loads in each data center, and the current is considered to be a normal value when the current is greater than 0 in the case of specific load power.

Further, each time can correspond to a fault matrix within a time period, so that whether the fault matrix is changed or not can be judged by comparing the fault matrix at the current time with the fault matrix at the previous time, and the change of the fault matrix is mainly used for avoiding misconvergence of alarm.

Optionally, on the basis of the embodiment corresponding to fig. 2, in another optional embodiment of the method for determining an alarm device provided in the embodiment of the present application, as shown in fig. 10, the alarm matrix is a K × 1 matrix, the state information of the device includes an alarm state, and generating the alarm matrix according to the state information of each device includes:

in step S1001, if the alarm state of the ith device among the K devices is a normal state, determining an element in the ith row in the K × 1 matrix as a first element;

in step S1002, if the alarm state of the ith device among the K devices is an abnormal state, determining an element in the ith row in the K × 1 matrix as a second element;

in step S1003, an alarm matrix is generated according to the corresponding element values in the K × 1 matrix in the K devices.

In this embodiment, since the alarm matrix can be used to initially classify the alarms and can play an important role in analyzing the alarm sequence systematically, the alarm matrix can be constructed by using the following definition in formula (5):

wherein A (i) is a k × 1 column vector, A _ij Represents the alarm category, i, j belongs to [1,2]K is 1, k represents the number of electrical devices, C _i waning stands for Electrical device i producingAlarm information, C _i normal indicates that the electrical device i is operating normally.

For example, when the device C1 generates an alarm, the element value of the device in the 1 st row in the K × 1 matrix is set to 1, or when the device C2 operates normally and no alarm is generated, the element value of the device in the 2 nd row in the K × 1 matrix is set to 1.

Optionally, on the basis of the embodiment corresponding to fig. 2, in another optional embodiment of the method for determining an alert device provided in the embodiment of the present application, as shown in fig. 11, the method further includes:

in step S1101, determining a transition matrix according to the current matrix and the alarm matrix;

in step S1102, and operation is performed on each element in the transition matrix and the fault matrix to obtain an alarm convergence matrix.

In the present embodiment, the transition matrix is a matrix in which each element is non-negative, the sum of each row element is equal to 1, each element is represented by a probability, and the elements are mutually transitioned under a certain condition, so the transition matrix is called. The transition matrix is used to indicate some factors of a system that in the transition, the nth result is only affected by the (n-1) th result, i.e. only related to the current state, but not to the past state. Thus, the concept of state transition can be introduced. The state refers to a state in which an objective thing may appear or exist; state transition refers to the probability of an objective thing transitioning from one state to another.

Specifically, because the cause-and-effect relationship between the devices is mainly reflected by the current matrix R, and the original cause-and-effect relationship between the devices is also transformed along with the change of the matrix, and the alarm matrix may be used to reflect whether the device generates an alarm, the transition from the alarm state to the fault state may be achieved by calculating a transition matrix between the current matrix R and the alarm matrix a, so as to implement reverse reasoning between the alarm signal and the fault signal, so as to implement positioning of the faulty device, and specifically, a transition matrix T may be obtained by calculating the current matrix R and the alarm matrix a by binary multiplication according to the following calculation formula (6):

further, after the current matrix R and the alarm matrix a are subjected to matrix conversion to obtain a transition matrix T, logical and operation may be performed through the fault matrix F and the transition matrix T to obtain an alarm convergence matrix b, and since only a fault device node may have a fault, elements corresponding to devices having a fault in the alarm convergence matrix b are all non-zero elements, so that devices corresponding to non-zero elements in the non-zero matrix b may be determined as alarm devices.

Optionally, on the basis of the embodiment corresponding to fig. 2, in another optional embodiment of the method for determining an alert device provided in the embodiment of the present application, as shown in fig. 12, the method further includes:

in step S1201, if the alarm convergence matrix is a zero matrix, determining an element to be updated in the alarm matrix according to a mapping relationship between the fault matrix and the alarm matrix;

in step S1202, the element value of the element to be updated is updated to be the first element, so as to obtain an updated target alarm matrix;

in step S1203, the alarm of the device corresponding to the first element in the target alarm matrix is released, so as to obtain the total alarm convergence number.

In this embodiment, if the alarm convergence matrix b is a zero matrix, it can be understood that the current data acquisition system does not capture the status information of the measurement point including the operation abnormality, or the device generates a false alarm, such as an alarm generated by a non-fault, such as a commercial power change or a shutdown and maintenance of the transformer, which easily causes the alarm convergence procedure to converge to the false alarm, thereby causing a positioning error of the faulty device, affecting the device maintenance, and because the alarm convergence is a zero matrix, the device is not capable of performing the normal operationThe convergence to at least one alarm is performed, and therefore, in order to reduce the situations of misconvergence and misconvergence, this embodiment releases the alarm, which may be specifically expressed as that the alarm generated by the device corresponding to the element with the alarm matrix of 0 is not converged, or when the collected alarm is not in the alarm cluster, that is, the alarm type a _ij The alarm can be directly output and prompted, and the like, and can also be in other expression forms, and the specific limitation is not made here.

Specifically, when the alarm convergence matrix is a zero matrix, in order to reduce the situation of false convergence, in this embodiment, first, according to a mapping relationship between the fault matrix and the alarm matrix, an element position of an element to be updated in the alarm matrix is determined, and then, an element to be updated at the element position to be updated is set to 0, that is, a (i) = F (i) =0, and if an element in an ith row of the fault matrix of K × 1 is 0, an element in an ith row, which is the same as the alarm matrix of K × 1, is found according to the mapping relationship between the fault matrix and the alarm matrix, and is determined as the element to be updated, and the element to be updated is set to 0, and then, by not converging an alarm generated by a device corresponding to the element to be updated, the situation of false convergence of a false alarm is avoided, so that the effect of alarm convergence is improved.

For example, it is assumed that more than one finally located alarm source device cannot be located to the root source device, which results in the reason that the operation of recovering power supply for the line 1 does not cause the system to generate a corresponding alarm, because the line recovering power supply does not belong to a fault under normal conditions, and in the alarm system in the target area, a corresponding alarm policy is usually not configured for a non-fault state such as line recovery, which results in that an abnormal state of the measurement point at the instant time, such as a state with a current of 0, cannot be captured when the acquisition frequency of the data acquisition system is too low, and some unrelated alarms, such as non-fault alarms, are converged by the alarm convergence procedure. Therefore, in order to reduce the situation of false convergence, when a certain position of the fault matrix F is 0, the corresponding position of the alarm matrix is forced to be 0, and the alarm stored in the corresponding position is released, so that the alarm is prevented from being converged, and the accuracy of alarm convergence is improved.

Optionally, on the basis of the embodiment corresponding to fig. 2, in another optional embodiment of the method for determining an alert device provided in the embodiment of the present application, as shown in fig. 13, the method further includes:

in step S1301, if the total number of alarms at the first time is greater than a preset first alarm threshold and the alarm index at the second time is the first index, setting the alarm index at the first time as the second index, where the second time is a previous time adjacent to the first time;

in step S1302, if the total number of alarms at the first time is smaller than a preset second alarm threshold and the alarm index at the second time is a second index, setting the alarm index at the first time as the first index, where the second alarm threshold is greater than the first alarm threshold;

in step S1303, if the total number of alarms at the first time is less than or equal to the first alarm threshold and greater than or equal to the second alarm threshold, the alarm index at the first time is set as the alarm index at the second time;

in step S1304, the alert level at the first time is determined based on the alert index.

In this embodiment, because no clear definition of an alarm storm exists in the information construction field, an alarm can be better handled, and the alarm storm definition in the industry can be adopted to quickly and accurately determine whether an alarm storm occurs in a target area, according to the standard of the International Society of Automation (ISA) 18.2: "alarm storm" refers to a case where the alarm generation rate is greater than the manager's effective management (the number of alarms exceeds 10/10 minutes) ".

Thus, according to this above-mentioned time criterion, it is possible to define two alarm thresholds, namely a first alarm threshold Γ _s And a second alarm threshold Γ _e Wherein, the first alarm threshold is greater than the second alarm threshold to obtain an alarm index changing with time, and whether an alarm storm occurs in the target area at the current time is judged according to the alarm index, specifically, the alarm index can be obtained by the definition in the following formula (7)Counting:

wherein, gamma is _s And Γ _e Representing a preset alarm threshold value, zeta (t) represents the alarm quantity at the moment t, psi (t-1) is the alarm index at the moment before psi (t), and else represents that the alarm total number at the first moment is less than or equal to the first alarm threshold value and is greater than or equal to the second alarm threshold value.

Wherein the first alarm threshold Γ _s Normally set to 10, and a second alarm threshold Γ _e It is usually set to be 5 and,

for example, a data center 15 pm 5/20/2020: 18 minutes mains interruption and 20 pm: and (3) recovering power supply by a 14-branch mains supply A path, wherein the data center adopts double-loop power supply, and the first time 15: and when the total alarm count of 18 minutes is 300 and is obviously greater than a preset first alarm threshold value 10, and the acquired second time 15: the alarm index of 17 points is 0, the alarm index of the first time is set to 1, which indicates that the alarm generated at the time may generate an alarm storm, or, assuming that the first time 15: and when the total alarm count of 18 points is 2 and is smaller than a preset second alarm threshold value 5, and the acquired second moment 15: the alarm index of 17 points is 1, the alarm index of the first time is set to 0, which indicates that the alarm generated at the time does not generate an alarm storm, or, assuming that the first time 15: the total alarm count of 18 points is 8, and if the total alarm count is greater than the preset second alarm threshold 5 and less than the preset first alarm threshold 10, the alarm index at the first time is set as a second time 15: an alarm index of 17 points for indicating that an alarm generated at that moment does not generate an alarm storm.

It should be noted that the alarm index can also be used to determine the start and end of the alarm convergence procedure, specifically, by setting the initial Ψ (T) to 0, and setting the convergence time window to be generally T =10min =600s.

Further, when the alarm converges at time t _s At the beginning, Ψ (t) needs to satisfy: psi (t) _s )＝1,Ψ(t _s -1) =0 indicating that the number of alarms exceeds the first alarm threshold Γ at the time _s ＝10。

And, when the alarm converges at time t _e At the end, Ψ (t) needs to satisfy: Ψ (t) _e )＝1,Ψ(t _e -1) =1, indicating that the number of alarms is below the second alarm threshold Γ at the time _e ＝5。

Referring to fig. 18, fig. 12 is a schematic diagram of an embodiment of a determining apparatus of an alerting device in an embodiment of the present application, where the determining apparatus 20 of the alerting device includes:

an obtaining unit 201, configured to obtain device monitoring data corresponding to a target area, where the target area includes K devices, the device monitoring data includes a total number of alarms of the K devices, state information of each device of the K devices, and state information of each measurement point of at least one measurement point, and K is an integer greater than 1;

a generating unit 202, configured to generate an alarm matrix according to the state information of each device if the total number of alarms of the K devices is greater than or equal to an alarm threshold;

the generating unit 202 is further configured to generate a fault matrix according to the state information of each measurement point in the at least one measurement point;

the generating unit 202 is further configured to generate an alarm convergence matrix according to the alarm matrix, the fault matrix, and the current matrix, where the current matrix is used to represent a cause-and-effect network relationship among the K devices, the cause-and-effect network relationship represents a logical relationship between any two devices among the K devices, the current matrix is composed of K elements, and there is a corresponding relationship between the K elements and the K devices;

the determining unit 203 is configured to determine, if the alarm convergence matrix is a non-zero matrix, a device corresponding to a position of a non-zero element in the alarm convergence matrix as an alarm device.

Optionally, on the basis of the embodiment corresponding to fig. 18, in another embodiment of the determination apparatus of an alarm device provided in the embodiment of the present application,

the obtaining unit 201 is further configured to obtain a causal network relationship corresponding to the target area, where the causal network relationship includes K nodes and Q directed connecting edges, each node corresponds to one device, each directed connecting edge is used to connect two devices, and Q is an integer greater than or equal to 1;

the determining unit 203 is further configured to determine, according to the causal network relationship, element values corresponding to any two devices in the K × K matrix;

the generating unit 202 is further configured to generate a current matrix according to element values corresponding to any two devices in the K × K matrix.

Optionally, on the basis of the embodiment corresponding to fig. 18, in another embodiment of the apparatus for determining an alert device provided in the embodiment of the present application, the determining unit 203 is specifically configured to:

if the ith device and the jth device in the K devices meet the non-causal relationship, determining elements in the ith row and the jth column in the K x K matrix as first elements, wherein i and j are integers which are greater than or equal to 1 and less than or equal to K;

and if no current passes between the ith device and the jth device in the K devices, determining the element in the ith row and the jth column in the K-by-K matrix as a second element.

Optionally, on the basis of the embodiment corresponding to fig. 18, in another embodiment of the determining apparatus for an alarm device provided in the embodiment of the present application,

the obtaining unit 201 is further configured to obtain an equipment wiring diagram corresponding to the target area;

the processing unit 204 is configured to perform node division on K devices in the device wiring diagram to obtain K nodes;

the processing unit 204 is further configured to perform edge connection on any two nodes in the K nodes to obtain a node connection graph

The processing unit 204 is further configured to determine a directed edge and a relationship between every two nodes in the node connection graph according to the causal network, so as to obtain a causal network relationship.

the obtaining unit 201 is further configured to obtain a historical device wiring diagram corresponding to the target area;

the processing unit 204 is further configured to transpose the current matrix to obtain a target current matrix when the device wiring diagram is inconsistent with the historical device wiring diagram;

the generating unit 202 is specifically configured to generate an alarm convergence matrix according to the alarm matrix, the fault matrix, and the target current matrix.

Optionally, on the basis of the embodiment corresponding to fig. 18, in another embodiment of the apparatus for determining an alert device provided in the embodiment of the present application, the generating unit 202 is specifically configured to:

the processing unit 204 is further configured to change a second element in the fault matrix into a first element to obtain a target fault matrix if the device load of each device of the K devices meets a preset load condition;

the processing unit 204 is further configured to, if the device load of any one of the K devices does not satisfy the preset load condition, change a first element in the fault matrix of the device load that does not satisfy the preset load condition into a second element to obtain a target fault matrix;

the generating unit 202 is specifically configured to generate an alarm convergence matrix according to the alarm matrix, the target fault matrix, and the current matrix.

if the alarm state of the ith device in the K devices is a normal state, determining the element of the ith row in the K x 1 matrix as a first element;

if the alarm state of the ith device in the K devices is an abnormal state, determining the element of the ith row in the K x 1 matrix as a second element;

the determining unit 203 is further configured to determine, if the alarm convergence matrix is a zero matrix, an element to be updated in the alarm matrix according to a mapping relationship between the fault matrix and the alarm matrix;

the processing unit 204 is further configured to update an element value of an element to be updated to a first element, so as to obtain an updated target alarm matrix;

the processing unit 204 is further configured to release the alarm of the device corresponding to the first element in the target alarm matrix, so as to obtain a total alarm convergence number.

the determining unit 203 is further configured to determine a transfer matrix according to the current matrix and the alarm matrix;

the generating unit 202 is specifically configured to perform and operation on each element in the transition matrix and the fault matrix to obtain an alarm convergence matrix.

the processing unit 204 is further configured to set the alarm index at the first time as a second index if the total number of alarms at the first time is greater than a preset first alarm threshold and the alarm index at the second time is the first index, where the second time is an adjacent previous time to the first time;

the processing unit 204 is further configured to set the alarm index at the first time as the first index if the total number of alarms at the first time is smaller than a preset second alarm threshold and the alarm index at the second time is a second index, where the second alarm threshold is greater than the first alarm threshold;

the processing unit 204 is further configured to set the alarm index at the first time as the alarm index at the second time if the total alarm count at the first time is less than or equal to the first alarm threshold and greater than or equal to the second alarm threshold;

the determining unit 203 is further configured to determine an alarm level at the first time according to the alarm index.

In another aspect, as shown in fig. 19, fig. 19 is a schematic diagram of a computer device structure provided in this embodiment, and the computer device 300 may have a relatively large difference due to different configurations or performances, and may include one or more Central Processing Units (CPUs) 310 (e.g., one or more processors) and a memory 320, and one or more storage media 330 (e.g., one or more mass storage devices) storing an application 331 or data 332. Memory 320 and storage media 330 may be, among other things, transient or persistent storage. The program stored on the storage medium 330 may include one or more modules (not shown), each of which may include a sequence of instructions for operating on the computer device 300. Still further, the central processor 310 may be configured to communicate with the storage medium 330 to execute a series of instruction operations in the storage medium 330 on the computer device 300.

The computer device 300 may also include one or more power supplies 340, one or more wired or wireless network interfaces 350, one or more input-output interfaces 360, and/or one or more operating systems 333, such as a Windows Server ^TM ，Mac OS X ^TM ，Unix ^TM ,Linux ^TM ，FreeBSD ^TM And so on.

The computer device 300 described above is also adapted to perform the steps in the embodiments corresponding to fig. 2 to 13.

Another aspect of the present application provides a computer-readable storage medium having instructions stored thereon, which, when executed on a computer, cause the computer to perform the steps of the method as described in the embodiments shown in fig. 2 to 13.

Another aspect of the present application provides a computer program product containing instructions which, when run on a computer or processor, cause the computer or processor to perform the steps in the method as described in the embodiments shown in fig. 2 to 13.

It is clear to those skilled in the art that, for convenience and brevity of description, the specific working processes of the above described systems, apparatuses and units may refer to the corresponding processes in the foregoing method embodiments, and are not described herein again.

In the several embodiments provided in the present application, it should be understood that the disclosed system, apparatus and method may be implemented in other ways. For example, the above-described apparatus embodiments are merely illustrative, and for example, the division of the units is only one logical division, and other divisions may be realized in practice, for example, a plurality of units or components may be combined or integrated into another system, or some features may be omitted, or not executed. In addition, the shown or discussed mutual coupling or direct coupling or communication connection may be an indirect coupling or communication connection through some interfaces, devices or units, and may be in an electrical, mechanical or other form.

The units described as separate parts may or may not be physically separate, and parts displayed as units may or may not be physical units, may be located in one place, or may be distributed on a plurality of network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of the embodiment.

In addition, functional units in the embodiments of the present application may be integrated into one processing unit, or each unit may exist alone physically, or two or more units are integrated into one unit. The integrated unit may be implemented in the form of hardware, or may also be implemented in the form of a software functional unit.

The integrated unit, if implemented in the form of a software functional unit and sold or used as a stand-alone product, may be stored in a computer readable storage medium. Based on such understanding, the technical solution of the present application may be substantially implemented or contributed to by the prior art, or all or part of the technical solution may be embodied in a software product, which is stored in a storage medium and includes instructions for causing a computer device (which may be a personal computer, a server, or a network device) to execute all or part of the steps of the method according to the embodiments of the present application. And the aforementioned storage medium includes: various media capable of storing program codes, such as a usb disk, a removable hard disk, a read-only memory (ROM), a Random Access Memory (RAM), a magnetic disk, or an optical disk.

Claims

1. A method for determining an alert device, comprising:

acquiring device monitoring data corresponding to a target area, wherein the target area comprises the K devices, the device monitoring data comprises the total number of alarms of the K devices, state information of each device in the K devices and state information of each measuring point in at least one measuring point, and K is an integer greater than 1;

if the total alarm number of the K devices is greater than or equal to an alarm threshold value, generating an alarm matrix according to the state information of each device;

generating a fault matrix according to the state information of each measuring point in the at least one measuring point;

generating an alarm convergence matrix according to the alarm matrix, the fault matrix and a current matrix, wherein the current matrix is used for representing a cause and effect network relationship among the K devices, the cause and effect network relationship represents a logical relationship between any two devices among the K devices, the current matrix is composed of K elements, and the K elements and the K devices have one-to-one correspondence relationship;

2. The method of claim 1, wherein prior to generating an alarm convergence matrix from the alarm matrix, the fault matrix, and the current matrix, the method further comprises:

obtaining the causal network relationship corresponding to the target area, where the causal network relationship includes K nodes and Q directed connecting edges, each node corresponds to one device, each directed connecting edge is used to connect two devices, and Q is an integer greater than or equal to 1;

determining element values corresponding to any two devices in the K devices in a K x K matrix according to the causal network relationship;

and generating the current matrix according to element values corresponding to any two devices in the K x K matrix.

3. The method according to claim 2, wherein the determining, according to the causal network relationship, the element values corresponding to any two devices of the K devices in a K x K matrix comprises:

if the ith device and the jth device in the K devices meet the non-causal relationship, determining the element of the ith row and the jth column in the K x K matrix as a first element, wherein i and j are integers which are greater than or equal to 1 and less than or equal to K;

and if the ith device and the jth device in the K devices meet a causal relationship, determining an element in an ith row and a jth column in the K x K matrix as a second element.

4. The method according to claim 2, wherein the determining, according to the causal network relationship, the element values corresponding to any two devices of the K devices in a K x K matrix comprises:

5. The method of claim 2, wherein the obtaining the causal network relationship corresponding to the target area comprises:

acquiring an equipment wiring diagram corresponding to the target area;

performing node division on K devices in the device wiring diagram to obtain K nodes;

performing edge connection on any two nodes in the K nodes to obtain a node connection graph;

and determining directed edges in the node connection graph and the relationship between every two nodes according to the causal network so as to obtain the causal network relationship.

6. The method of claim 5, wherein prior to generating an alarm convergence matrix from the alarm matrix, the fault matrix, and the current matrix, the method further comprises:

obtaining a historical equipment wiring diagram corresponding to the target area;

when the equipment wiring diagram is inconsistent with the historical equipment wiring diagram, transposing the current matrix to obtain the target current matrix;

the generating an alarm convergence matrix according to the alarm matrix, the fault matrix and the current matrix comprises:

and generating the alarm convergence matrix according to the alarm matrix, the fault matrix and the target current matrix.

7. The method of claim 1, wherein the fault matrix is a K x 1 matrix, and the status information of the measurement points includes device status;

the generating a fault matrix according to the state information of each measurement point of the at least one measurement point comprises:

if the device state of the ith device in the K devices is a normal state, determining the element of the ith row in the K x 1 matrix as a first element;

if the device state of the ith device in the K devices is an abnormal state, determining an element in the ith row in the K x 1 matrix as a second element;

and generating the fault matrix according to the corresponding element values in the K x 1 matrix in the K devices.

8. The method of claim 7, wherein the status information of the measurement points includes device loads, and wherein before generating an alarm convergence matrix based on the alarm matrix, the fault matrix, and the current matrix, the method further comprises:

if the equipment load of each piece of K equipment meets a preset load condition, changing the second element in the fault matrix into the first element to obtain a target fault matrix;

if the equipment load of any one of the K equipment does not meet a preset load condition, changing a first element of the equipment load not meeting the preset load condition into a second element in the fault matrix to obtain the target fault matrix;

and generating the alarm convergence matrix according to the alarm matrix, the target fault matrix and the current matrix.

9. The method of claim 1, wherein the alarm matrix is a K x 1 matrix, the status information of the devices includes alarm statuses, and the generating the alarm matrix according to the status information of each device includes:

and generating the alarm matrix according to the element values corresponding to the K x 1 matrixes in the K devices.

10. The method of claim 1, wherein prior to generating an alarm convergence matrix from the alarm matrix, the fault matrix, and the current matrix, the method further comprises:

determining a transfer matrix according to the current matrix and the alarm matrix;

and operating each element in the transfer matrix and the fault matrix to obtain the alarm convergence matrix.

11. The method of claim 1, wherein after the generating an alarm convergence matrix from the alarm matrix, the fault matrix, and a current matrix, the method further comprises:

if the alarm convergence matrix is a zero matrix, determining an element to be updated in the alarm matrix according to a mapping relation between the fault matrix and the alarm matrix;

updating the element value of the element to be updated into a first element to obtain an updated target alarm matrix;

and releasing the alarm of the equipment corresponding to the first element in the target alarm matrix to obtain the total alarm convergence number.

12. The method according to claim 1, wherein before generating the alarm matrix according to the status information of each device if the total number of alarms of the K devices is greater than or equal to the alarm threshold, the method further comprises:

if the alarm total number at a first moment is greater than a preset first alarm threshold value and the alarm index at a second moment is a first index, setting the alarm index at the first moment as a second index, wherein the second moment is a previous moment adjacent to the first moment;

if the total alarm number at the first moment is smaller than a preset second alarm threshold and the alarm index at the second moment is the second index, setting the alarm index at the first moment as the first index, wherein the second alarm threshold is larger than the first alarm threshold;

if the total alarm number at a first moment is smaller than or equal to the first alarm threshold and larger than or equal to the second alarm threshold, setting the alarm index at the first moment as the alarm index at the second moment;

and determining the alarm level of the first moment according to the alarm index.

13. An apparatus for determining an alert device, comprising:

an obtaining unit, configured to obtain device monitoring data corresponding to a target area, where the target area includes the K devices, the device monitoring data includes a total number of alarms of the K devices, state information of each device in the K devices, and state information of each measurement point in at least one measurement point, and K is an integer greater than 1;

a generating unit, configured to generate an alarm matrix according to the state information of each device if the total number of alarms of the K devices is greater than or equal to an alarm threshold;

the generating unit is further configured to generate a fault matrix according to the state information of each measurement point in the at least one measurement point;

the generating unit is further configured to generate an alarm convergence matrix according to the alarm matrix, the fault matrix, and a current matrix, where the current matrix is used to represent a cause-and-effect network relationship among the K devices, the cause-and-effect network relationship represents a logical relationship between any two devices among the K devices, the current matrix is composed of K elements, and the K elements and the K devices have a one-to-one correspondence relationship;

and the determining unit is used for determining the equipment corresponding to the position of the nonzero element in the alarm convergence matrix as alarm equipment if the alarm convergence matrix is a nonzero matrix.

14. A computer device, comprising: a memory, a transceiver, a processor, and a bus system;

wherein the memory is used for storing programs;

the processor when executing the program in the memory implementing the method of any one of claims 1 to 12;

15. A computer-readable storage medium comprising instructions that, when executed on a computer, cause the computer to perform the method of any of claims 1 to 12.