CN116416764A - Alarm threshold generation method and device, electronic equipment and storage medium - Google Patents
Alarm threshold generation method and device, electronic equipment and storage medium Download PDFInfo
- Publication number
- CN116416764A CN116416764A CN202111662609.1A CN202111662609A CN116416764A CN 116416764 A CN116416764 A CN 116416764A CN 202111662609 A CN202111662609 A CN 202111662609A CN 116416764 A CN116416764 A CN 116416764A
- Authority
- CN
- China
- Prior art keywords
- data
- operation data
- target
- quantile
- threshold
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
- 238000000034 method Methods 0.000 title claims abstract description 59
- 238000003860 storage Methods 0.000 title claims abstract description 20
- 238000004364 calculation method Methods 0.000 claims abstract description 54
- 238000009826 distribution Methods 0.000 claims abstract description 23
- 230000006870 function Effects 0.000 claims description 59
- 238000004891 communication Methods 0.000 claims description 19
- 238000004590 computer program Methods 0.000 claims description 12
- 238000013507 mapping Methods 0.000 claims description 12
- 238000007781 pre-processing Methods 0.000 claims description 8
- 238000004519 manufacturing process Methods 0.000 abstract description 9
- 238000005516 engineering process Methods 0.000 abstract description 6
- 238000012545 processing Methods 0.000 description 16
- 230000008569 process Effects 0.000 description 6
- 238000010586 diagram Methods 0.000 description 5
- 230000002159 abnormal effect Effects 0.000 description 3
- 230000010354 integration Effects 0.000 description 3
- 230000003287 optical effect Effects 0.000 description 3
- 230000009471 action Effects 0.000 description 2
- 230000003044 adaptive effect Effects 0.000 description 2
- 230000008878 coupling Effects 0.000 description 2
- 238000010168 coupling process Methods 0.000 description 2
- 238000005859 coupling reaction Methods 0.000 description 2
- 238000012544 monitoring process Methods 0.000 description 2
- 230000002093 peripheral effect Effects 0.000 description 2
- 230000006978 adaptation Effects 0.000 description 1
- 230000003321 amplification Effects 0.000 description 1
- 238000013500 data storage Methods 0.000 description 1
- 230000003247 decreasing effect Effects 0.000 description 1
- 238000013461 design Methods 0.000 description 1
- 230000006866 deterioration Effects 0.000 description 1
- 238000011161 development Methods 0.000 description 1
- 238000003745 diagnosis Methods 0.000 description 1
- 238000001914 filtration Methods 0.000 description 1
- 230000003993 interaction Effects 0.000 description 1
- 238000007726 management method Methods 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 238000003199 nucleic acid amplification method Methods 0.000 description 1
- 230000002085 persistent effect Effects 0.000 description 1
- 238000010998 test method Methods 0.000 description 1
- 238000012549 training Methods 0.000 description 1
Images
Classifications
-
- G—PHYSICS
- G08—SIGNALLING
- G08B—SIGNALLING OR CALLING SYSTEMS; ORDER TELEGRAPHS; ALARM SYSTEMS
- G08B21/00—Alarms responsive to a single specified undesired or abnormal condition and not otherwise provided for
- G08B21/18—Status alarms
- G08B21/182—Level alarms, e.g. alarms responsive to variables exceeding a threshold
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/30—Monitoring
- G06F11/3003—Monitoring arrangements specially adapted to the computing system or computing system component being monitored
-
- Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
- Y02—TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
- Y02P—CLIMATE CHANGE MITIGATION TECHNOLOGIES IN THE PRODUCTION OR PROCESSING OF GOODS
- Y02P90/00—Enabling technologies with a potential contribution to greenhouse gas [GHG] emissions mitigation
- Y02P90/02—Total factory control, e.g. smart factories, flexible manufacturing systems [FMS] or integrated manufacturing systems [IMS]
Landscapes
- Engineering & Computer Science (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- Theoretical Computer Science (AREA)
- Business, Economics & Management (AREA)
- Emergency Management (AREA)
- Computing Systems (AREA)
- Mathematical Physics (AREA)
- Quality & Reliability (AREA)
- General Engineering & Computer Science (AREA)
- Alarm Systems (AREA)
Abstract
The application provides a method and a device for generating an alarm threshold, electronic equipment and a storage medium, wherein the method comprises the following steps: acquiring historical operation data of a target unit within a preset time period; determining a target density calculation function according to the distribution characteristics of the historical operation data; calculating a function and parameter adjustment parameters according to the historical operation parameters and the target density to obtain an upper quantile and a lower quantile; and determining early warning thresholds of a plurality of levels according to the upper quantile and the lower quantile. Through the method and the device, the problem that the safety and normal operation of the production system are affected due to unreasonable alarm threshold setting in the related technology is solved.
Description
Technical Field
The present disclosure relates to the field of data processing, and in particular, to a method and apparatus for generating an alarm threshold, an electronic device, and a storage medium.
Background
The alarm management system is an important component in the petrochemical industry process, can monitor the whole production process in real time, and can effectively prevent and prevent the development and the deterioration of abnormal events. The alarm threshold value is used as an important index of the alarm system and reflects the current running state of the production system.
With the increase of the scale and complexity of industrial enterprises, the reasons for generating abnormal events and the processing measures become more difficult, so that the enterprise efficiency is affected, and a plurality of safety problems are brought. Among other things, the unreasonable design of alarm thresholds is an important factor in causing the problem of alarm flooding that is common in industrial monitoring systems. The alarm threshold is set too low, a large number of invalid alarms can appear even if the system is in a normal state, so that key alarms can be submerged in the alarms, operators cannot timely and effectively process measures, and potential safety hazards or economic losses are caused. The alarm threshold is set too high, and possibly some parameters cannot be timely alarmed when the system is abnormal, so that safety threat is caused to production equipment and personnel.
Therefore, the problem that the safety and normal operation of the production system are affected due to unreasonable alarm threshold setting exists in the related technology.
Disclosure of Invention
The application provides a method and a device for generating an alarm threshold, electronic equipment and a storage medium, and aims to at least solve the problems that the alarm threshold is unreasonable to set and the safety and normal operation of a production system are affected in the related technology.
According to an aspect of an embodiment of the present application, there is provided a method for generating an alarm threshold, including:
Acquiring historical operation data of a target unit within a preset time period;
determining a target density calculation function according to the distribution characteristics of the historical operation data;
obtaining an upper quantile and a lower quantile according to the historical operation parameters, the target density calculation function and parameter adjustment parameters, wherein the upper quantile is data distributed above an abscissa generated by the target density calculation function, the lower quantile is data distributed below an abscissa generated by the target density calculation function, and the parameter adjustment parameters are used for adjusting and acquiring a numerical range of the upper quantile and the lower quantile;
and determining early warning thresholds of a plurality of grades according to the upper quantile and the lower quantile.
According to another aspect of the embodiments of the present application, there is also provided a method for generating an alarm threshold, where the method includes:
the acquisition unit is used for acquiring historical operation data of the target unit within a preset time length;
the first determining unit is used for determining a target density calculating function according to the distribution characteristics of the historical operation data;
the obtaining unit is used for obtaining an upper quantile and a lower quantile according to the historical operation parameters, the target density calculation function and the parameter adjustment parameter, wherein the upper quantile is data distributed above an abscissa generated by the target density calculation function, the lower quantile is data distributed below an abscissa generated by the target density calculation function, and the parameter adjustment parameter is used for adjusting and obtaining a numerical range of the upper quantile and the lower quantile;
And the second determining unit is used for determining early warning thresholds of a plurality of grades according to the upper quantile and the lower quantile.
Optionally, the apparatus comprises:
the processing unit is used for preprocessing the historical operation data of the target unit after acquiring the historical operation data of the target unit within a preset time length to obtain preprocessed target operation data, wherein the target operation data is effective data for generating the alarm threshold value;
and the integration unit is used for integrating the target operation data to obtain the distribution characteristics of the target operation data, wherein the target operation data is a subset of the historical operation data.
Optionally, the processing unit comprises:
the first obtaining module is used for removing shutdown data in the historical operation data to obtain first operation data;
the second obtaining unit is used for removing or replacing outlier data in the first operation data to obtain the target operation data.
Optionally, the second obtaining unit includes:
the first acquisition module is used for acquiring data which is far from the first operation data and is at a first preset distance and used as the outlier data;
the second acquisition module is used for acquiring the target sub-operation data falling within a second preset distance range of the outlier data, wherein the target sub-operation data is a subset of the target operation data;
And the replacing module is used for replacing the outlier data by the target sub-operation data.
Optionally, the second determining unit includes:
the first obtaining module is used for obtaining a numerical value corresponding to the ordinate of the upper quantile as a first threshold according to the mapping relation between the upper quantile and each numerical value on the ordinate generated by the target density calculation function;
the second obtaining module is used for obtaining the numerical value corresponding to the ordinate of the lower quantile as a second threshold according to the mapping relation between the lower quantile and each numerical value on the ordinate generated by the target density calculation function;
and the third obtaining module is used for obtaining the alarm thresholds of a plurality of levels according to the first threshold and the second threshold.
Optionally, the third obtaining module includes:
the acquisition subunit is used for acquiring an adjustment coefficient, wherein the adjustment coefficient is used for carrying out numerical adjustment on the first threshold value and the second threshold value;
and the obtaining subunit is used for obtaining the alarm thresholds of a plurality of levels according to the first threshold, the second threshold and the adjustment coefficient, wherein the sum of the first threshold and the second threshold is the number of the generated alarm thresholds.
Optionally, the acquiring subunit includes:
the acquisition sub-module is used for acquiring the average value and standard deviation of the historical operation data;
the determining submodule is used for determining the quotient of the standard deviation and the mean value, and determining the adjustment coefficient according to the quotient and a preset parameter, wherein the preset parameter is a custom value and is used for generating the adjustment coefficient.
According to yet another aspect of the embodiments of the present application, there is also provided an electronic device including a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory complete communication with each other through the communication bus; wherein the memory is used for storing a computer program; a processor for performing the method steps of any of the embodiments described above by running the computer program stored on the memory.
According to a further aspect of the embodiments of the present application, there is also provided a computer-readable storage medium having stored therein a computer program, wherein the computer program is arranged to perform the method steps of any of the embodiments described above when run.
In the embodiment of the application, historical operation data of the target unit within a preset time period are obtained; determining a target density calculation function according to the distribution characteristics of the historical operation data; obtaining an upper quantile and a lower quantile according to the historical operation parameters, the target density calculation function and the parameter adjustment parameters, wherein the upper quantile is data distributed above an abscissa generated by the target density calculation function, the lower quantile is data distributed below the abscissa generated by the target density calculation function, and the parameter adjustment parameters are used for adjusting and acquiring a numerical range of the upper quantile and the lower quantile; and determining early warning thresholds of a plurality of levels according to the upper quantile and the lower quantile. Because the preset threshold value determined by the embodiment of the application is obtained according to the density characteristics of the historical operation data, the working condition of the target unit can be accurately represented, the unit alarm threshold is further divided on the basis of the working condition, the intelligent statistical alarm threshold value is realized, and the problems that the alarm threshold value is unreasonable in setting and the safety and the normal operation of a production system are affected in the related technology are solved.
Drawings
The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the invention and together with the description, serve to explain the principles of the invention.
In order to more clearly illustrate the embodiments of the invention or the technical solutions of the prior art, the drawings which are used in the description of the embodiments or the prior art will be briefly described, and it will be obvious to a person skilled in the art that other drawings can be obtained from these drawings without inventive effort.
FIG. 1 is a schematic diagram of a hardware environment of an alternative method of generating an alarm threshold according to an embodiment of the present invention;
FIG. 2 is a flow chart of an alternative method of generating an alarm threshold according to an embodiment of the present application;
FIG. 3 is a flowchart illustration of an alternative adaptive threshold method according to an embodiment of the present application;
FIG. 4 is a block diagram of an alternative alarm threshold generation apparatus according to an embodiment of the present application;
fig. 5 is a block diagram of an alternative electronic device according to an embodiment of the present application.
Detailed Description
In order to make the present application solution better understood by those skilled in the art, the following description will be made in detail and with reference to the accompanying drawings in the embodiments of the present application, it is apparent that the described embodiments are only some embodiments of the present application, not all embodiments. All other embodiments, which can be made by one of ordinary skill in the art based on the embodiments herein without making any inventive effort, shall fall within the scope of the present application.
It should be noted that the terms "first," "second," and the like in the description and claims of the present application and the above figures are used for distinguishing between similar objects and not necessarily for describing a particular sequential or chronological order. It is to be understood that the data so used may be interchanged where appropriate such that embodiments of the present application described herein may be implemented in sequences other than those illustrated or otherwise described herein. Furthermore, the terms "comprises," "comprising," and "having," and any variations thereof, are intended to cover a non-exclusive inclusion, such that a process, method, system, article, or apparatus that comprises a list of steps or elements is not necessarily limited to those steps or elements expressly listed but may include other steps or elements not expressly listed or inherent to such process, method, article, or apparatus.
According to one aspect of the embodiments of the present application, a method for generating an alarm threshold is provided. Alternatively, in the present embodiment, the above-described method for generating the alarm threshold may be applied to a hardware environment as shown in fig. 1. As shown in fig. 1, the terminal 102 may include a memory 104, a processor 106, and a display 108 (optional components). The terminal 102 may be communicatively coupled to a server 112 via a network 110, the server 112 being operable to provide services (e.g., application services, etc.) to the terminal or to clients installed on the terminal, and a database 114 may be provided on the server 112 or independent of the server 112 for providing data storage services to the server 112. In addition, a processing engine 116 may be run in the server 112, which processing engine 116 may be used to perform the steps performed by the server 112.
Alternatively, the terminal 102 may be, but is not limited to, a terminal capable of calculating data, such as a mobile terminal (e.g., a mobile phone, a tablet computer), a notebook computer, a PC (Personal Computer ) or the like, which may include, but is not limited to, a wireless network or a wired network. Wherein the wireless network comprises: bluetooth, WIFI (Wireless Fidelity ) and other networks that enable wireless communications. The wired network may include, but is not limited to: wide area network, metropolitan area network, local area network. The server 112 may include, but is not limited to, any hardware device that can perform calculations.
In addition, in this embodiment, the method for generating the alarm threshold may be applied to, but not limited to, an independent processing device with a relatively high processing capability, without performing data interaction. For example, the processing device may be, but is not limited to being, a more processing-capable terminal device, i.e., the various operations of the above-described alarm threshold generation method may be integrated into a single processing device. The above is merely an example, and is not limited in any way in the present embodiment.
Alternatively, in this embodiment, the method for generating the alarm threshold may be performed by the server 112, or may be performed by the terminal 102, or may be performed by both the server 112 and the terminal 102. The method for generating the alarm threshold by the terminal 102 according to the embodiment of the present application may also be performed by a client installed thereon.
Taking a server as an example, fig. 2 is a schematic flow chart of an alternative method for generating an alarm threshold according to an embodiment of the present application, as shown in fig. 2, a flow of the method may include the following steps:
step S201, historical operation data of a target unit in a preset time period is obtained.
Optionally, in the embodiment of the present application, a target unit is taken as an observation object, and the server obtains historical operation data such as vibration frequency, process parameters, and the like of the target unit under different loads in a normal state according to a selected preset time period, for example, 15 days.
Step S202, determining a target density calculation function according to the distribution characteristics of the historical operation data.
Optionally, after obtaining the historical operation data, fitting probability density distribution according to the distribution condition of the data, and in the embodiment of the application, three different probability density function calculation modes are provided when different data distribution characteristics are dealt with: gaussian distribution, beta distribution, nuclear density estimation, etc., wherein the nuclear density estimation is preferably chosen as the target density calculation function.
In addition, since the core density estimation function calculation mode, the bandwidth parameter has a great influence on the obtained estimation value. At this time, the optimal bandwidth can be searched by using grid search, but the grid search generally has time cost, and if the requirement of the running time exists, the optimal bandwidth is selected by using AMISE rule, so as to generate the final target density calculation function.
Step S203, according to the historical operation parameters, the target density calculation function and the parameter adjustment parameters, an upper quantile and a lower quantile are obtained, wherein the upper quantile is data distributed above an abscissa generated by the target density calculation function, the lower quantile is data distributed below an abscissa generated by the target density calculation function, and the parameter adjustment parameters are used for adjusting and obtaining a numerical range of the upper quantile and the lower quantile.
Optionally, when the above historical operation data is processed based on the target density calculation function, a two-dimensional coordinate axis is generated, which is composed of an x-axis coordinate and a y-axis coordinate, at this time, the historical operation data is distributed above and below the x-axis of the two-dimensional coordinate, and when the server automatically selects the upper quantile and the lower quantile by combining an adjustable parameter, wherein the adjustable parameter is a parameter, which may be a confidence sigma, and 0< sigma <1.
Further, the upper quantile is data distributed above the x-axis of the abscissa generated by the target density calculation function, the lower quantile is data distributed below the x-axis of the abscissa generated by the target density calculation function, and the parameter adjustment parameter is used for adjusting and acquiring the numerical ranges of the upper quantile and the lower quantile.
Step S204, determining early warning thresholds of a plurality of levels according to the upper quantile and the lower quantile.
Optionally, in the embodiment of the present application, according to the upper quantile and the lower quantile, the early warning threshold values of multiple levels, such as high report, low report, and low report, may be obtained. The number of the upper quantiles and the number of the lower quantiles determine the number of the early warning threshold values, the levels of the early warning threshold values are sequentially decreased according to the high report, the low report and the low report, the larger the values are, the more dangerous the bigger the values are, and the smaller the values are, the lower the importance of the current early warning is.
In the embodiment of the application, historical operation data of the target unit within a preset time period are obtained; determining a target density calculation function according to the distribution characteristics of the historical operation data; obtaining an upper quantile and a lower quantile according to the historical operation parameters, the target density calculation function and the parameter adjustment parameters, wherein the upper quantile is data distributed above an abscissa generated by the target density calculation function, the lower quantile is data distributed below the abscissa generated by the target density calculation function, and the parameter adjustment parameters are used for adjusting and acquiring a numerical range of the upper quantile and the lower quantile; and determining early warning thresholds of a plurality of levels according to the upper quantile and the lower quantile. Because the preset threshold value determined by the embodiment of the application is obtained according to the density characteristics of the historical operation data, the working condition of the target unit can be accurately represented, the unit alarm threshold is further divided on the basis of the working condition, the intelligent statistical alarm threshold value is realized, and the problems that the alarm threshold value is unreasonable in setting and the safety and the normal operation of a production system are affected in the related technology are solved.
As an alternative embodiment, after acquiring the historical operation data of the target unit within the preset time period, the method includes:
preprocessing historical operation data to obtain preprocessed target operation data, wherein the target operation data is effective data of an alarm threshold;
and integrating the target operation data to obtain the distribution characteristics of the target operation data, wherein the target operation data is a subset of the historical operation data.
Optionally, in order to obtain accurate operation data, the embodiment of the application may preprocess the obtained historical operation data by removing invalid operation data, so that the preprocessed target operation data are all effective data for generating an alarm threshold value.
And then, carrying out integration statistics on the target operation data to obtain a density distribution characteristic of the current target operation data, and taking the density distribution characteristic as a basis for selecting a target density function. It will be appreciated that the target operational data is valid data selected from the historical operational data, and that the target operational data must be a subset of the historical operational data.
In the embodiment of the application, the historical operation data are preprocessed, so that the obtained target operation data are all effective data, and a data base is made for accurately generating the alarm threshold.
As an alternative embodiment, preprocessing the historical operation data to obtain preprocessed target operation data includes:
removing shutdown data in the historical operation data to obtain first operation data;
and removing or replacing outlier data in the first operation data to obtain target operation data.
Optionally, the data preprocessing includes: 1. clearing shutdown data: and judging the shutdown state of the point location based on the frequency of startup and shutdown or operation, and removing data of the shutdown point (front and back) for a period of time to obtain first operation data. 2. Removing outlier data: based on the first operational data, some outlier garbage is culled. Here, to cope with the characteristics of different parameters, three different outlier data identification methods are provided: the recognized outlier data is directly removed by the Laida method, the box graph method and the 4d test method by default, but if the data density is required to be maintained, the outlier data can be replaced by replacing the outlier data, so that the validity of the data can be ensured, and the overall density of the data can be ensured.
In the process of replacing the outlier data, which data are the outlier data can be selected first, at this time, the data which are far away from the first operation data and reach the first preset distance can be obtained to serve as the outlier data, then the target sub-operation data which fall within the second preset distance range of the outlier data are obtained, and the target sub-operation data are replaced by the outlier data in a linear interpolation mode. The first preset distance and the second preset distance are user-defined values, and the first preset distance and the second preset distance can be set automatically according to scene requirements. In addition, the second preset distance is generally set to a value nearest to the outlier data, for example, may be set to 0.1, so that data nearest before and after the outlier data may be obtained as target sub-operation data.
The target sub-operation data is also valid data selected from the target operation data, so the target sub-operation data is also a subset of the target operation data.
In the embodiment of the application, more accurate effective data, namely target sub-operation data, can be obtained through processing the shutdown data and the outlier data, so that learning and acquisition of an alarm threshold are intelligently realized.
As an alternative embodiment, determining the early warning threshold for the plurality of levels according to the upper quantile and the lower quantile includes:
according to the mapping relation between the upper quantile and each numerical value on the ordinate generated by the target density calculation function, obtaining the numerical value corresponding to the ordinate by the upper quantile as a first threshold;
according to the mapping relation between the lower quantile and each numerical value on the ordinate generated by the target density calculation function, obtaining the numerical value corresponding to the ordinate by the lower quantile as a second threshold;
and obtaining alarm thresholds of multiple levels according to the first threshold and the second threshold.
Optionally, the coordinates generated by the object density calculation function further include y-axis coordinates, wherein a mapping relationship exists between each upper quantile and the y-axis of the ordinate, and a mapping relationship also exists between each lower quantile and the y-axis of the ordinate.
At this time, according to the mapping relation between the upper quantile and each numerical value on the ordinate generated by the target density calculation function, the numerical value on the ordinate corresponding to the upper quantile is obtained and used as a first threshold, and according to the mapping relation between the lower quantile and each numerical value on the ordinate generated by the target density calculation function, the numerical value on the ordinate corresponding to the lower quantile is obtained and used as a second threshold, and then the first threshold and the second threshold are used as parameters for generating alarm thresholds, so that the alarm thresholds of multiple levels are obtained.
As an alternative embodiment, deriving the alarm thresholds for the plurality of levels based on the first threshold and the second threshold includes:
acquiring an adjustment coefficient, wherein the adjustment coefficient is used for carrying out numerical adjustment on the first threshold value and the second threshold value;
and obtaining alarm thresholds of multiple levels according to the first threshold, the second threshold and the adjustment coefficient, wherein the number of the alarm thresholds generated by the sum of the first threshold and the second threshold.
Optionally, an adjustment coefficient is set first in the embodiment of the present application, where the adjustment coefficient may be an amplification coefficient, and is used to perform numerical adjustment on the first threshold value and the second threshold value, and the formula is as follows:
Wherein x is derived from the standard deviation of the historical operating data and the mean of the historical operating data, i.e., x = standard deviation/mean; a. b, c are custom values, e.g., a= ±0.5, b=0.01, c=1, etc. It will be appreciated that x is related to historical operating data and is not a fixed value, nor is a, b, c flexibly set according to historical experience or scene requirements.
Then, the first threshold value and the second threshold value are multiplied by the adjustment coefficients respectively, and then a plurality of alarm threshold values are obtained, and the number of the alarm threshold values generated by the sum of the first threshold value and the second threshold value is necessarily greater than 1 because the number of the alarm threshold values generated by the sum of the first threshold value and the second threshold value is the same, so that the alarm threshold values obtained in the embodiment of the application are a plurality of. And because the obtained values are different in size after the first threshold value and the second threshold value are multiplied by the adjustment coefficient respectively, the obtained alarm thresholds are classified according to the magnitude of the values, and the alarm thresholds are ranked from large to small, so that the threshold levels of high reporting, low reporting and low reporting are obtained.
As an alternative embodiment, as shown in fig. 3, the steps of the adaptive threshold method flow provided are as follows:
(1) Extracting data: selecting the latest Th time period data, wherein Th is configurable;
(2) Data preprocessing: firstly, clearing shutdown data, and then removing outlier data;
(3) Threshold learning: firstly, fitting probability density distribution, then selecting an upper quantile and a lower quantile (selected based on set confidence), and finally calculating a threshold value (the upper quantile and the lower quantile are respectively multiplied by set adjustment coefficients);
(4) The threshold is saved.
As an alternative embodiment, the application after obtaining alarm thresholds for multiple levels will be described in the embodiments of the present application:
(1) Starting diagnosis service, loading the threshold value obtained by the latest training, and storing the threshold value in a memory.
(2) The background continuously calls the diagnostic service and transmits the newly acquired parameters to the diagnostic service.
(3) And comparing the acquired parameters in the service with the alarm threshold, and triggering an alarm if the new parameters exceed the alarm threshold.
(4) Filtering the alarm, and pushing if the alarm is newly generated. If a persistent alarm occurred before, no push is made.
(5) And (5) pushing the alarm, namely pushing the alarm information to a front-end monitoring interface or pushing the alarm information to related personnel through a short message after the rear end acquires the alarm information.
It should be noted that, for simplicity of description, the foregoing method embodiments are all expressed as a series of action combinations, but it should be understood by those skilled in the art that the present application is not limited by the order of actions described, as some steps may be performed in other order or simultaneously in accordance with the present application. Further, those skilled in the art will also appreciate that the embodiments described in the specification are all preferred embodiments, and that the acts and modules referred to are not necessarily required in the present application.
From the description of the above embodiments, it will be clear to a person skilled in the art that the method according to the above embodiments may be implemented by means of software plus the necessary general hardware platform, but of course also by means of hardware, but in many cases the former is a preferred embodiment. Based on such understanding, the technical solution of the present application may be embodied essentially or in a part contributing to the prior art in the form of a software product stored in a storage medium (such as ROM (Read-Only Memory)/RAM (Random Access Memory), magnetic disk, optical disk), including instructions for causing a terminal device (which may be a mobile phone, a computer, a server, or a network device, etc.) to perform the method of the embodiments of the present application.
According to another aspect of the embodiment of the application, there is also provided an alarm threshold generating device for implementing the alarm threshold generating method. Fig. 4 is a block diagram of an alternative alarm threshold generating device according to an embodiment of the present application, and as shown in fig. 4, the device may include:
an obtaining unit 401, configured to obtain historical operation data of a target unit within a preset duration;
A first determining unit 402, connected to the obtaining unit 401, for determining a target density calculating function according to the distribution characteristics of the historical operation data;
the obtaining unit 403 is connected to the first determining unit 402, and is configured to obtain an upper quantile and a lower quantile according to the historical operating parameter, the target density calculating function, and the parameter tuning parameter, where the upper quantile is data distributed above an abscissa generated by the target density calculating function, the lower quantile is data distributed below an abscissa generated by the target density calculating function, and the parameter tuning parameter is used to adjust a numerical range for obtaining the upper quantile and the lower quantile;
a second determining unit 404, connected to the obtaining unit 403, for determining early warning thresholds of multiple levels according to the upper quantile and the lower quantile.
It should be noted that the acquisition unit 401 in this embodiment may be used to perform the above-described step S201, the first determination unit 402 in this embodiment may be used to perform the above-described step S202, the obtaining unit 403 in this embodiment may be used to perform the above-described step S203, and the second determination unit 404 in this embodiment may be used to perform the above-described step S204.
Through the module, since the preset threshold value determined by the embodiment of the application is obtained according to the density characteristics of the historical operation data, the working condition of the target unit can be accurately represented, the unit alarm threshold is further divided on the basis, the intelligent statistical alarm threshold value is realized, and the problems that the alarm threshold value is unreasonable in setting and the safety and the normal operation of a production system are affected in the related technology are solved.
As an alternative embodiment, the apparatus comprises:
the processing unit is used for preprocessing the historical operation data after acquiring the historical operation data of the target unit within a preset time length to obtain preprocessed target operation data, wherein the target operation data is effective data of an alarm threshold;
and the integration unit is used for integrating the target operation data to obtain the distribution characteristics of the target operation data, wherein the target operation data is a subset of the historical operation data.
As an alternative embodiment, the processing unit comprises:
the first obtaining module is used for removing shutdown data in the historical operation data to obtain first operation data;
the second obtaining unit is used for removing or replacing outlier data in the first operation data to obtain target operation data.
As an alternative embodiment, the second deriving unit comprises:
the first acquisition module is used for acquiring data which is far from the first operation data and is at a first preset distance and used as outlier data;
the second acquisition module is used for acquiring target sub-operation data falling within a second preset distance range of the outlier data, wherein the target sub-operation data is a subset of the target operation data;
and the replacing module is used for replacing the outlier data by utilizing the target sub-operation data.
As an alternative embodiment, the second determining unit comprises:
the first obtaining module is used for obtaining a numerical value corresponding to the ordinate of the upper quantile according to the mapping relation between the upper quantile and each numerical value on the ordinate generated by the target density calculation function, and taking the numerical value as a first threshold;
the second obtaining module is used for obtaining a numerical value corresponding to the ordinate of the lower quantile according to the mapping relation between the lower quantile and each numerical value on the ordinate generated by the target density calculation function, and taking the numerical value as a second threshold;
and the third obtaining module is used for obtaining alarm thresholds of multiple levels according to the first threshold and the second threshold.
As an alternative embodiment, the third obtaining module includes:
The acquisition subunit is used for acquiring an adjustment coefficient, wherein the adjustment coefficient is used for carrying out numerical adjustment on the first threshold value and the second threshold value;
and the obtaining subunit is used for obtaining alarm thresholds of a plurality of levels according to the first threshold, the second threshold and the adjustment coefficient, wherein the sum of the first threshold and the second threshold is the number of the generated alarm thresholds.
As an alternative embodiment, the acquiring subunit comprises:
the acquisition sub-module is used for acquiring the mean value and standard deviation of the historical operation data;
the determining submodule is used for determining the quotient of the standard deviation and the mean value, and determining the adjustment coefficient according to the quotient and a preset parameter, wherein the preset parameter is a self-defined numerical value and is used for generating the adjustment coefficient.
It should be noted that the above modules are the same as examples and application scenarios implemented by the corresponding steps, but are not limited to what is disclosed in the above embodiments. It should be noted that the above modules may be implemented in software or in hardware as part of the apparatus shown in fig. 1, where the hardware environment includes a network environment.
According to still another aspect of the embodiments of the present application, there is further provided an electronic device for implementing the method for generating an alarm threshold, where the electronic device may be a server, a terminal, or a combination thereof.
Fig. 5 is a block diagram of an alternative electronic device, according to an embodiment of the present application, including a processor 501, a communication interface 502, a memory 503, and a communication bus 504, as shown in fig. 5, wherein the processor 501, the communication interface 502, and the memory 503 communicate with each other via the communication bus 504, wherein,
a memory 503 for storing a computer program;
the processor 501, when executing the computer program stored on the memory 503, performs the following steps:
acquiring historical operation data of a target unit within a preset time period;
determining a target density calculation function according to the distribution characteristics of the historical operation data;
obtaining an upper quantile and a lower quantile according to the historical operation parameters, the target density calculation function and the parameter adjustment parameters, wherein the upper quantile is data distributed above an abscissa generated by the target density calculation function, the lower quantile is data distributed below the abscissa generated by the target density calculation function, and the parameter adjustment parameters are used for adjusting and acquiring a numerical range of the upper quantile and the lower quantile;
and determining early warning thresholds of a plurality of levels according to the upper quantile and the lower quantile.
Alternatively, in the present embodiment, the above-described communication bus may be a PCI (Peripheral Component Interconnect, peripheral component interconnect standard) bus, or an EISA (Extended Industry Standard Architecture ) bus, or the like. The communication bus may be classified as an address bus, a data bus, a control bus, or the like. For ease of illustration, only one thick line is shown in fig. 5, but not only one bus or one type of bus.
The communication interface is used for communication between the electronic device and other devices.
The memory may include RAM or may include non-volatile memory (non-volatile memory), such as at least one disk memory. Optionally, the memory may also be at least one memory device located remotely from the aforementioned processor.
As an example, as shown in fig. 5, the memory 503 may include, but is not limited to, an acquisition unit 401, a first determination unit 402, an obtaining unit 403, and a second determination unit 404 in the generation apparatus including the alarm threshold. In addition, other module units in the generation device of the alarm threshold may be further included, but are not limited to, and are not described in detail in this example.
The processor may be a general purpose processor and may include, but is not limited to: CPU (Central Processing Unit ), NP (Network Processor, network processor), etc.; but also DSP (Digital Signal Processing, digital signal processor), ASIC (Application Specific Integrated Circuit ), FPGA (Field-Programmable Gate Array, field programmable gate array) or other programmable logic device, discrete gate or transistor logic device, discrete hardware components.
In addition, the electronic device further includes: and the display is used for displaying the generation result of the alarm threshold value.
Alternatively, specific examples in this embodiment may refer to examples described in the foregoing embodiments, and this embodiment is not described herein.
It will be understood by those skilled in the art that the structure shown in fig. 5 is only schematic, and the device implementing the method for generating the alarm threshold may be a terminal device, where the terminal device may be a smart phone (such as an Android mobile phone, an iOS mobile phone, etc.), a tablet computer, a palmtop computer, a mobile internet device (Mobile Internet Devices, MID), a PAD, etc. Fig. 5 is not limited to the structure of the electronic device described above. For example, the terminal device may also include more or fewer components (e.g., network interfaces, display devices, etc.) than shown in fig. 5, or have a different configuration than shown in fig. 5.
Those of ordinary skill in the art will appreciate that all or part of the steps in the various methods of the above embodiments may be implemented by a program for instructing a terminal device to execute in association with hardware, the program may be stored in a computer readable storage medium, and the storage medium may include: flash disk, ROM, RAM, magnetic or optical disk, etc.
According to yet another aspect of embodiments of the present application, there is also provided a storage medium. Alternatively, in the present embodiment, the above-described storage medium may be used for executing the program code of the generation method of the alarm threshold value.
Alternatively, in this embodiment, the storage medium may be located on at least one network device of the plurality of network devices in the network shown in the above embodiment.
Alternatively, in the present embodiment, the storage medium is configured to store program code for performing the steps of:
acquiring historical operation data of a target unit within a preset time period;
determining a target density calculation function according to the distribution characteristics of the historical operation data;
obtaining an upper quantile and a lower quantile according to the historical operation parameters, the target density calculation function and the parameter adjustment parameters, wherein the upper quantile is data distributed above an abscissa generated by the target density calculation function, the lower quantile is data distributed below the abscissa generated by the target density calculation function, and the parameter adjustment parameters are used for adjusting and acquiring a numerical range of the upper quantile and the lower quantile;
and determining early warning thresholds of a plurality of levels according to the upper quantile and the lower quantile.
Alternatively, specific examples in the present embodiment may refer to examples described in the above embodiments, which are not described in detail in the present embodiment.
Alternatively, in the present embodiment, the storage medium may include, but is not limited to: various media capable of storing program codes, such as a U disk, ROM, RAM, a mobile hard disk, a magnetic disk or an optical disk.
According to yet another aspect of embodiments of the present application, there is also provided a computer program product or computer program comprising computer instructions stored in a computer readable storage medium; the processor of the computer device reads the computer instructions from the computer readable storage medium, and the processor executes the computer instructions, so that the computer device performs the steps of the method for generating an alarm threshold in any of the embodiments described above.
The foregoing embodiment numbers of the present application are merely for describing, and do not represent advantages or disadvantages of the embodiments.
The integrated units in the above embodiments may be stored in the above-described computer-readable storage medium if implemented in the form of software functional units and sold or used as separate products. Based on such understanding, the technical solution of the present application may be embodied essentially or in a part contributing to the prior art or all or part of the technical solution, in the form of a software product stored in a storage medium, comprising several instructions for causing one or more computer devices (which may be personal computers, servers or network devices, etc.) to perform all or part of the steps of the method for generating an alarm threshold according to the various embodiments of the present application.
In the foregoing embodiments of the present application, the descriptions of the embodiments are emphasized, and for a portion of this disclosure that is not described in detail in this embodiment, reference is made to the related descriptions of other embodiments.
In several embodiments provided in the present application, it should be understood that the disclosed client may be implemented in other manners. The above-described embodiments of the apparatus are merely exemplary, and are merely a logical functional division, and there may be other manners of dividing the apparatus in actual implementation, for example, multiple units or components may be combined or integrated into another system, or some features may be omitted, or not performed. Alternatively, the coupling or direct coupling or communication connection shown or discussed with each other may be through some interfaces, units or modules, or may be in electrical or other forms.
The units described as separate units may or may not be physically separate, and units shown as units may or may not be physical units, may be located in one place, or may be distributed over a plurality of network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution provided in the present embodiment.
In addition, each functional unit in each embodiment of the present application may be integrated in one processing unit, or each unit may exist alone physically, or two or more units may be integrated in one unit. The integrated units may be implemented in hardware or in software functional units.
The foregoing is merely a preferred embodiment of the present application and it should be noted that modifications and adaptations to those skilled in the art may be made without departing from the principles of the present application and are intended to be comprehended within the scope of the present application.
Claims (10)
1. A method for generating an alarm threshold, the method comprising:
acquiring historical operation data of a target unit within a preset time period;
determining a target density calculation function according to the distribution characteristics of the historical operation data;
obtaining an upper quantile and a lower quantile according to the historical operation parameters, the target density calculation function and parameter adjustment parameters, wherein the upper quantile is data distributed above an abscissa generated by the target density calculation function, the lower quantile is data distributed below an abscissa generated by the target density calculation function, and the parameter adjustment parameters are used for adjusting and acquiring a numerical range of the upper quantile and the lower quantile;
And determining early warning thresholds of a plurality of grades according to the upper quantile and the lower quantile.
2. The method of claim 1, wherein after obtaining historical operating data of the target unit for a preset period of time, the method comprises:
preprocessing the historical operation data to obtain preprocessed target operation data, wherein the target operation data is effective data for generating the alarm threshold;
and integrating the target operation data to obtain the distribution characteristics of the target operation data, wherein the target operation data is a subset of the historical operation data.
3. The method of claim 2, wherein preprocessing the historical operating data to obtain preprocessed target operating data comprises:
removing shutdown data in the historical operation data to obtain first operation data;
and clearing or replacing outlier data in the first operation data to obtain the target operation data.
4. The method of claim 3, wherein said replacing outlier data in said first operational data comprises:
acquiring data of a first preset distance away from the first operation data as the outlier data;
Acquiring target sub-operation data falling within a second preset distance range of the outlier data, wherein the target sub-operation data is a subset of the target operation data;
replacing the outlier data with the target sub-run data.
5. The method of claim 1, wherein the determining the early warning thresholds for a plurality of levels based on the upper quantile and the lower quantile comprises:
according to the mapping relation between the upper quantile and each numerical value on the ordinate generated by the target density calculation function, obtaining the numerical value corresponding to the ordinate by the upper quantile as a first threshold;
according to the mapping relation between the lower quantile and each numerical value on the ordinate generated by the target density calculation function, obtaining the numerical value corresponding to the ordinate by the lower quantile as a second threshold;
and obtaining the alarm thresholds of a plurality of levels according to the first threshold and the second threshold.
6. The method of claim 5, wherein deriving the alarm thresholds for the plurality of levels based on the first threshold and the second threshold comprises:
Obtaining an adjustment coefficient, wherein the adjustment coefficient is used for carrying out numerical adjustment on the first threshold value and the second threshold value;
and obtaining the alarm thresholds of a plurality of levels according to the first threshold, the second threshold and the adjustment coefficient, wherein the sum of the first threshold and the second threshold is the number of the generated alarm thresholds.
7. The method of claim 6, wherein the obtaining adjustment coefficients comprises:
acquiring the mean value and standard deviation of the historical operation data;
and determining a quotient of the standard deviation and the mean value, and determining the adjustment coefficient according to the quotient and a preset parameter, wherein the preset parameter is a self-defined numerical value and is used for generating the adjustment coefficient.
8. A method for generating an alarm threshold, the method comprising:
the acquisition unit is used for acquiring historical operation data of the target unit within a preset time length;
the first determining unit is used for determining a target density calculating function according to the distribution characteristics of the historical operation data;
the obtaining unit is used for obtaining an upper quantile and a lower quantile according to the historical operation parameters, the target density calculation function and the parameter adjustment parameter, wherein the upper quantile is data distributed above an abscissa generated by the target density calculation function, the lower quantile is data distributed below an abscissa generated by the target density calculation function, and the parameter adjustment parameter is used for adjusting and obtaining a numerical range of the upper quantile and the lower quantile;
And the second determining unit is used for determining early warning thresholds of a plurality of grades according to the upper quantile and the lower quantile.
9. An electronic device comprising a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other via the communication bus, characterized in that,
the memory is used for storing a computer program;
the processor is configured to perform the method steps of any of claims 1 to 7 by running the computer program stored on the memory.
10. A computer-readable storage medium, characterized in that the storage medium has stored therein a computer program, wherein the computer program is arranged to perform the method steps of any of claims 1 to 7 when run.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202111662609.1A CN116416764A (en) | 2021-12-31 | 2021-12-31 | Alarm threshold generation method and device, electronic equipment and storage medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202111662609.1A CN116416764A (en) | 2021-12-31 | 2021-12-31 | Alarm threshold generation method and device, electronic equipment and storage medium |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN116416764A true CN116416764A (en) | 2023-07-11 |
Family
ID=87048263
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202111662609.1A Pending CN116416764A (en) | 2021-12-31 | 2021-12-31 | Alarm threshold generation method and device, electronic equipment and storage medium |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN116416764A (en) |
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN117034109A (en) * | 2023-08-03 | 2023-11-10 | 中国人民解放军95616部队保障部 | Engine oil abrasive grain analysis method and system based on segmentation threshold and computer readable storage medium |
-
2021
- 2021-12-31 CN CN202111662609.1A patent/CN116416764A/en active Pending
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN117034109A (en) * | 2023-08-03 | 2023-11-10 | 中国人民解放军95616部队保障部 | Engine oil abrasive grain analysis method and system based on segmentation threshold and computer readable storage medium |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN112162878B (en) | Database fault discovery method and device, electronic equipment and storage medium | |
| CN108564181B (en) | Power equipment fault detection and maintenance method and terminal equipment | |
| CN110191094B (en) | Abnormal data monitoring method and device, storage medium and terminal | |
| CN113176978B (en) | Monitoring method, system, equipment and readable storage medium based on log file | |
| CN112311617A (en) | Configured data monitoring and alarming method and system | |
| CN112463543B (en) | Monitoring method of service data, rule data generation method, device and system | |
| CN111147306B (en) | Fault analysis method and device of Internet of things equipment and Internet of things platform | |
| CN112953738B (en) | Root cause alarm positioning system, method and device and computer equipment | |
| CN113010374B (en) | Quantum device monitoring method and system based on monitoring platform | |
| CN112395156A (en) | Fault warning method and device, storage medium and electronic equipment | |
| CN105681128A (en) | Method and device for monitoring big data system state | |
| CN114553682B (en) | Real-time alarm method, system, computer equipment and storage medium | |
| CN114691662A (en) | Data quality inspection rule self-adaption method, storage medium and system | |
| CN116416764A (en) | Alarm threshold generation method and device, electronic equipment and storage medium | |
| CN108039971A (en) | A kind of alarm method and device | |
| CN111062503A (en) | Power grid monitoring alarm processing method, system, terminal and storage medium | |
| CN113656252A (en) | Fault positioning method and device, electronic equipment and storage medium | |
| CN112395155A (en) | Service monitoring method and device, storage medium and electronic device | |
| CN117118739A (en) | Evaluation method and device of network security rules, storage medium and electronic equipment | |
| CN110928942A (en) | Index data monitoring and management method and device | |
| CN113593074B (en) | Method and device for generating monitoring video | |
| CN115223344A (en) | Monitoring alarm method and device for meter equipment, electronic equipment and storage medium | |
| CN114253819A (en) | User operation monitoring method and device and related equipment | |
| CN113411217A (en) | Method and device for monitoring and alarming call system | |
| CN113835961A (en) | Alarm information monitoring method, device, server and storage medium |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination |