WO2020134783A1 - 告警派单方法、装置、系统及计算机可读存储介质 - Google Patents

告警派单方法、装置、系统及计算机可读存储介质 Download PDF

Info

Publication number
WO2020134783A1
WO2020134783A1 PCT/CN2019/120611 CN2019120611W WO2020134783A1 WO 2020134783 A1 WO2020134783 A1 WO 2020134783A1 CN 2019120611 W CN2019120611 W CN 2019120611W WO 2020134783 A1 WO2020134783 A1 WO 2020134783A1
Authority
WO
WIPO (PCT)
Prior art keywords
alarm information
alarm
information
dispatch
life cycle
Prior art date
Application number
PCT/CN2019/120611
Other languages
English (en)
French (fr)
Inventor
杜家强
周波
宋汉增
周艳
赵松
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2020134783A1 publication Critical patent/WO2020134783A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q10/00—Administration; Management
    • G06Q10/06—Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
    • G06Q10/063—Operations research, analysis or management
    • G06Q10/0631—Resource planning, allocation, distributing or scheduling for enterprises or organisations
    • G06Q10/06311—Scheduling, planning or task assignment for a person or group
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F18/00—Pattern recognition
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F18/00—Pattern recognition
    • G06F18/20—Analysing
    • G06F18/21—Design or setup of recognition systems or techniques; Extraction of features in feature space; Blind source separation
    • G06F18/214—Generating training patterns; Bootstrap methods, e.g. bagging or boosting
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F18/00—Pattern recognition
    • G06F18/20—Analysing
    • G06F18/24—Classification techniques
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q10/00—Administration; Management
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q10/00—Administration; Management
    • G06Q10/06—Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q10/00—Administration; Management
    • G06Q10/20—Administration of product repair or maintenance

Definitions

  • the present disclosure relates to the technical field of network operation and maintenance, and in particular, to an alarm dispatch method, device, system, and computer-readable storage medium.
  • a telecommunication device fails, device alarm information will be generated and reported to the network management monitoring system layer by layer, and further judge whether the device failure corresponding to the reported alarm information will affect service quality or business process.
  • the equipment failure corresponding to the reported alarm information affects the service quality or business process, and a work order will be dispatched to the operation and maintenance work order system, and then the operation and maintenance work order system will distribute the work order to the equipment corresponding to the outside operation and maintenance personnel, so that Corresponding operation and maintenance personnel go to the fault site to troubleshoot, thus forming a closed-loop process to ensure the normal operation of telecommunications equipment to the greatest extent.
  • the dispatch of alarm work orders is divided into manual dispatch, automatic dispatch and automatic delayed dispatch.
  • manual dispatch requires O&M personnel to judge whether the alarm needs to be dispatched to the work order system based on experience. This method depends on the operation and maintenance personnel. Experience, and occupy a lot of human resources, the efficiency is not high.
  • the automatic dispatch is based on the accumulated experience and knowledge of dispatching work orders to establish automatic dispatch rules.
  • the network management monitoring system automatically dispatches it to the operation and maintenance work order system. As long as it is the alarm information
  • the dispatch is low in intelligence, and for some alarm devices that can be automatically recovered, it can be solved after waiting for a while.
  • the automatic delayed dispatch is for the case where some fault documents can be automatically recovered within a certain period of time. It is understandable that if the equipment failure corresponding to a certain alarm message is automatically recovered within a certain time, then no O&M personnel are required. On-site maintenance, thereby saving operation and maintenance costs. These experiences will be precipitated to form the knowledge of the expert library, and will be further converted into dispatch delay rules, and the dispatch of alarm information that meets the conditions of automatic recovery will be delayed for a fixed time, which can greatly reduce the number of dispatches and save operation and maintenance costs. Operation and maintenance efficiency, but there are still two shortcomings in the automatic delay of dispatching rules, one is dependent on the accumulation of experience, and the other is insufficient flexibility.
  • the main purpose of the present disclosure is to provide an alarm dispatch method, device, system, and computer-readable storage medium, which aims to solve the problem of insufficient analysis of equipment failures in the current network operation and maintenance management, resulting in high operation and maintenance costs and operation and maintenance methods Technical problems that are not flexible enough.
  • the present disclosure provides an alarm dispatch method, which includes: when receiving alarm information, determining whether the alarm information is an alarm information that can be automatically eliminated; The suppression time corresponding to the alarm information; based on the suppression time, suppress the alarm information and determine whether the alarm information is eliminated within the suppression time; if not, the work order corresponding to the alarm information Send to the device corresponding to the operation and maintenance personnel.
  • the present disclosure also proposes an alarm dispatching device, the alarm dispatching device includes: a judging module for determining whether the alarm information is an automatically clearable alarm when the alarm information is received Information; the determination module is used to determine the suppression time corresponding to the alarm information if it is; the suppression module is used to suppress the alarm information based on the suppression time and determine that the alarm information is at the suppression time Whether to eliminate it; the sending module is used to send the work order corresponding to the alarm information to the equipment corresponding to the operation and maintenance personnel if not.
  • a judging module for determining whether the alarm information is an automatically clearable alarm when the alarm information is received Information
  • the determination module is used to determine the suppression time corresponding to the alarm information if it is
  • the suppression module is used to suppress the alarm information based on the suppression time and determine that the alarm information is at the suppression time Whether to eliminate it
  • the sending module is used to send the work order corresponding to the alarm information to the equipment corresponding to the operation and maintenance personnel if not.
  • the present disclosure also provides an alarm dispatch system, which includes a memory, a processor, and an alarm dispatch program stored on the memory and executable on the processor When the alarm dispatch program is executed by the processor, the steps of the alarm dispatch method described above are implemented.
  • the present disclosure also provides a computer-readable storage medium on which an alarm dispatch program is stored, and the alarm dispatch program is implemented as described above when executed by the processor The steps of the alarm dispatch method.
  • FIG. 1 is a schematic structural diagram of a server in a hardware operating environment involved in an embodiment of the present disclosure
  • FIG. 2 is a schematic flowchart of the first embodiment of the alarm dispatch method of the present disclosure
  • FIG. 3 is a schematic diagram of setting the alarm dispatch interface in the first embodiment of the alarm dispatch method of the present disclosure to three preset split screen areas;
  • FIG. 4 is a schematic flowchart of a third embodiment of the alarm dispatch method of the present disclosure.
  • FIG. 5 is a schematic flowchart of a fourth embodiment of the alarm dispatch method of the present disclosure.
  • FIG. 6 is a schematic diagram of functional modules of an embodiment of an alarm dispatch device of the present disclosure.
  • the solution of the embodiments of the present disclosure is mainly: when receiving the alarm information, determine whether the alarm information is an alarm information that can be automatically eliminated; if so, determine the suppression time corresponding to the alarm information; based on the suppression time, Suppress the alarm information, and determine whether the alarm information is eliminated within the suppression time; if not, send the work order corresponding to the alarm information to the equipment corresponding to the operation and maintenance personnel.
  • An embodiment of the present disclosure proposes an alarm dispatch system.
  • FIG. 1 is a schematic structural diagram of an alarm dispatch system of a hardware operating environment according to an embodiment of the present disclosure.
  • the alarm dispatch system may include: a processor 1001, such as a CPU, a communication bus 1002, a user interface 1003, a network interface 1004, and a memory 1005.
  • the communication bus 1002 is used to implement connection communication between these components.
  • the owner interface 1003 may include a display, an input unit such as a keyboard, and in one embodiment, the owner interface 1003 may also include a standard wired interface (eg, for connecting a wired keyboard, wired mouse, etc.), a wireless interface (For example to connect a wireless keyboard, wireless mouse).
  • the network interface 1004 may optionally include a standard wired interface (used to connect a wired network) and a wireless interface (such as a WI-FI interface, a Bluetooth interface, an infrared interface, etc., used to connect a wireless network).
  • the memory 1005 may be a high-speed RAM memory, or may be a non-volatile memory (non-volatile memory), such as a disk memory.
  • the memory 1005 may optionally be a storage device independent of the foregoing processor 1001.
  • the alarm dispatch system shown in FIG. 1 does not constitute a limitation on the alarm dispatch system, and may include more or less components than the illustration, or a combination of certain components, or different Parts layout.
  • the memory 1005 as a computer-readable storage medium may include an operating system, a network communication module, an owner interface module, and an alarm dispatch program.
  • the operating system is a program that manages and controls the alarm dispatch system and software resources, and supports the operation of the network communication module, owner interface module, alarm dispatch program, and other programs or software;
  • the network communication module is used to manage and control the network interface 1002 ;
  • Owner interface module is used to manage and control the owner interface 1003.
  • the alarm dispatch system calls the alarm dispatch program stored in the memory 1005 through the processor 1001 and performs the following steps: when the alarm information is received, the alarm information is determined Whether the alarm information can be automatically eliminated; if it is, determine the suppression time corresponding to the alarm information; based on the suppression time, suppress the alarm information and determine whether the alarm information is eliminated within the suppression time ; If not, send the work order corresponding to the alarm information to the equipment corresponding to the operation and maintenance personnel.
  • the step of determining whether the alarm information is an automatically erasable alarm information when receiving the alarm information includes: when the alarm information is received, preprocessing the alarm information to obtain a pending Classified alarm information; input the alarm information to be classified into a classification model to generate corresponding label information; according to the label information, determine whether the alarm information is an alarm information that can be automatically eliminated.
  • the processor 110 before the step of determining whether the alarm information is an automatically erasable alarm information when the alarm information is received, the processor 110 is further used to call an alarm dispatch program stored in the memory 109, and Perform the following operations: collect multiple different alarm information, preprocess each alarm information to obtain multiple different alarm information to be classified; based on the alarm information to be classified, construct a training set for training the classification model to be trained; Obtain the label information corresponding to the alarm information to be classified; use the alarm information to be classified in the training set as the input of the classification model to be trained, and use the label information corresponding to the label as the output of the classification model to be trained.
  • the classification model is further used to call an alarm dispatch program stored in the memory 109, and Perform the following operations: collect multiple different alarm information, preprocess each alarm information to obtain multiple different alarm information to be classified; based on the alarm information to be classified, construct a training set for training the classification model to be trained; Obtain the label information corresponding to the alarm information to be classified; use the alarm information to be classified in the training
  • the step of determining the suppression time corresponding to the alarm information includes: if yes, inputting the alarm information into a pre-trained life cycle prediction model to generate a corresponding alarm elimination time; Calculate the life cycle of the alarm information based on the alarm elimination time and the alarm time corresponding to the alarm information; determine whether the life cycle exceeds a preset life cycle; if not, determine the life cycle based on the life cycle The suppression time corresponding to the alarm information.
  • the step of entering the alarm information into a pre-trained life-cycle prediction model and generating the corresponding alarm elimination time includes: if yes, acquiring attribute information corresponding to the alarm information; Based on the attribute information, the alarm elimination time corresponding to the alarm information is calculated through the life cycle prediction model.
  • the processor 110 is further used to call an alarm dispatch program stored in the memory 109 and perform the following operations: if the life cycle If the preset life cycle is exceeded, the suppression time corresponding to the alarm information is determined to be 0.
  • the processor 110 is further used to call an alarm dispatch program stored in the memory 109, and Perform the following operations: If the alarm information is an alarm information that cannot be automatically eliminated, send the work order corresponding to the alarm information to the equipment corresponding to the operation and maintenance personnel.
  • the alarm dispatch system 100 may also include a power supply 111 (such as a battery) that supplies power to various components.
  • the power supply 111 may be logically connected to the processor 110 through a power management system, thereby managing charge and discharge through the power management system , And power management functions.
  • the alarm dispatch system 100 may further include a Bluetooth module and the like, which will not be repeated here.
  • the present disclosure provides an alarm dispatch method.
  • FIG. 2 is a schematic flowchart of a first embodiment of an alarm dispatch method of the present disclosure.
  • an embodiment of the alarm dispatch method is provided. It should be noted that although the logic sequence is shown in the flowchart, in some cases, the order shown here may be executed in a different order. Out or describe the steps.
  • the alarm dispatch method may be optionally applied to the alarm dispatch system.
  • the alarm dispatch system is hereinafter referred to as the system.
  • the alarm dispatch method includes: Step S10. When the alarm information is received, determine Whether the alarm information is an alarm information that can be automatically eliminated; step S20, if so, determine the suppression time corresponding to the alarm information; step S30, suppress the alarm information based on the suppression time and determine the alarm Whether the information is eliminated within the suppression time; step S40, if not, send the work order corresponding to the alarm information to the equipment corresponding to the operation and maintenance personnel.
  • the alarm dispatch system when the alarm dispatch system receives the alarm information, it first determines whether the alarm information can be automatically eliminated. If it can, it determines the corresponding suppression time and suppresses the alarm information for the alarm information to It is automatically eliminated within the suppression time. If the alarm information cannot be automatically eliminated within the suppression time, the work order corresponding to the alarm information is sent to the equipment corresponding to the operation and maintenance personnel to realize the adaptive dispatch of the alarm information.
  • step S10 when the alarm information is received, it is determined whether the alarm information is an alarm information that can be automatically eliminated.
  • the system includes a monitoring device, which is responsible for monitoring the operation of the on-site telecommunications equipment.
  • a monitoring device which is responsible for monitoring the operation of the on-site telecommunications equipment.
  • the equipment When there is an abnormal operation of the equipment on the site, it receives the abnormal response of the abnormal equipment and sends the corresponding alarm information to the system.
  • the system When the system receives the alarm information, it determines the type of the alarm information. In one embodiment, the system determines whether the alarm information is automatically erasable or not.
  • alarm information For soft fault alarm information, it can usually be automatically recovered through background intelligent processing or without any processing.
  • This type of alarm information is an alarm information that can be automatically eliminated; for hard faults, it involves damaged board, equipment, and fiber. The situation is obviously unable to be solved through the background intelligent processing. This type of fault can only be dispatched to the scene for processing in time. Such alarm information is the alarm information that cannot be automatically eliminated.
  • step S10 includes:
  • Step S11 When receiving the alarm information, pre-process the alarm information to obtain the alarm information to be classified.
  • the system When the system receives the alarm information, it preprocesses the alarm information to obtain the alarm information to be classified.
  • the preprocessing includes the steps of filtering abnormal alarm information, extracting attribute information, and converting values.
  • the filtering of abnormal alarm information refers to that the system filters some alarm information of repeated alarms, etc., to avoid repeatedly processing the same alarm information, resulting in a waste of resources.
  • the system judges whether the alarm information is For repeated alarm information, if yes, delete the alarm information.
  • the extraction of attribute information refers to that the system obtains corresponding attribute information according to the received alarm information, where the attribute information includes the alarm title, alarm level, the manufacturer corresponding to the alarm device, the alarm time, and the network element identification.
  • Value conversion means that the system converts the attribute information into a numerical value or a letter representation.
  • the network management alarm level uses digital coding, which is divided into four levels of alarms.
  • the first level alarm value is 4, the second level alarm value is 3, the third level alarm value is 2, and the fourth level alarm value is 1.
  • the level is mapped from low to high as a natural number from 1 to 4. The larger the number, the more serious the level. If the alarm information in this embodiment is a three-level alarm, the value is 2.
  • Step S12 Input the alarm information to be classified into the classification model to generate corresponding label information.
  • the system inputs the warning information to be classified into the pre-trained classification model, and the corresponding label information is output by the classification model.
  • the label information is divided into automatically erasable labels and non-automatic erasable labels in this embodiment: the original value is TRUE or FALSE, indicating that it can be automatically eliminated or not automatically erasable, TRUE is converted to 1, indicating that it can be automatically eliminated, FALSE is 0 , Indicating that it cannot be automatically eliminated.
  • the labels of all samples are converted into vectors containing only 0,1, and a binary classification model can be trained based on this.
  • the system only needs to input the information to be alarmed into the previously trained classification model to generate the corresponding label information.
  • Step S130 determine whether the alarm information is an alarm information that can be automatically eliminated.
  • the system determines the type of alarm information based on the tag information. In one embodiment, it determines whether the alarm information is automatically erasable or not.
  • Step S20 if so, determine the suppression time corresponding to the alarm information.
  • the suppression time corresponding to the alarm information is determined. Understandably, if the current alarm information is an alarm information that can be automatically eliminated, it means that the device corresponding to the alarm information can be automatically restored within a certain period of time, then the system should allow the device to self-recover, then the alarm information is not The order needs to be dispatched, so during the period of time when the device is self-recovering, the system needs to suppress the alarm information to ensure that the alarm information will not be processed immediately.
  • step S20 includes:
  • step S21 if yes, the alarm information is input into a pre-trained life cycle prediction model to generate a corresponding alarm elimination time.
  • the system determines that the current alarm information is an alarm information that can be automatically eliminated, the system inputs the alarm information into a pre-trained life cycle prediction model to generate the corresponding alarm elimination time.
  • step S21 includes:
  • Step a If yes, obtain attribute information corresponding to the alarm information.
  • the system determines that the current alarm information is an alarm information that can be automatically eliminated, it obtains the attribute information corresponding to the alarm information, where the attribute information includes the alarm title, alarm level, the manufacturer corresponding to the alarm device, the alarm time, and the network element identification.
  • Step b Based on the attribute information, calculate the alarm elimination time corresponding to the alarm information through the life cycle prediction model.
  • the system calculates the alarm elimination time corresponding to the alarm information through a life cycle prediction model.
  • the system corresponds to the alarm title, alarm level, and alarm device in the attribute information.
  • the preset weights of the entanglement, alarm time, and network element identification in the attribute information calculate the score of the alarm information, and obtain the alarm elimination time corresponding to the alarm information according to the mapping relationship between the score and the alarm elimination time.
  • Step S22 Calculate the life cycle of the alarm information based on the alarm elimination time and the alarm time corresponding to the alarm information.
  • the system calculates the life cycle of the alarm information based on the calculated alarm elimination time and the alarm time corresponding to the alarm information.
  • the life cycle refers to the survival time of the alarm information, specifically the time from the alarm information to the automatic elimination of the alarm information.
  • Step S23 Determine whether the life cycle exceeds a preset life cycle.
  • the device failure corresponding to the alarm information can be eliminated by itself, but the time taken is too long, if it takes more than one day to return to the normal state, then the time for the alarm to be cleared too long will affect the progress of the corresponding business, then The warning information should not be suppressed, but should be promptly notified to the operation and maintenance personnel. Therefore, after calculating the life cycle of the alarm information, the system needs to determine whether the life cycle exceeds the preset life cycle.
  • the preset life cycle needs to be set according to the actual situation due to different field devices and corresponding services.
  • Step S24 if not, determine the suppression time corresponding to the alarm information based on the life cycle.
  • the suppression time corresponding to the alarm information is determined according to the calculated life cycle of the alarm information. Understandably, the life cycle of the alarm information is inconsistent with the suppression time. In the actual processing process, the suppression time will be longer than the corresponding life cycle of the alarm information. If the system calculates that the life cycle of the alarm information is 3 seconds, the suppression time is 5 seconds to ensure that the alarm information has enough time to self eliminate. That is, the suppression time is equal to the life cycle corresponding to the alarm information plus a preset fixed time.
  • step S23 the method further includes:
  • Step S25 if the life cycle exceeds a preset life cycle, it is determined that the suppression time corresponding to the alarm information is 0.
  • the system determines that the calculated life cycle exceeds the preset life cycle, it means that the time for the alarm information to self-eliminate is too long, which may affect the progress of the corresponding business, so the system directly determines that the suppression time of the alarm information is 0, that is, the system Obtain the work order corresponding to the alarm information directly, and send the work order to the equipment corresponding to the outside operation and maintenance personnel.
  • Step S30 based on the suppression time, suppressing the alarm information, and determining whether the alarm information is eliminated within the suppression time.
  • the system suppresses the corresponding alarm information based on the calculated suppression time.
  • the alarm information is delayed, and the delayed time is the suppression time. The system determines whether the warning message is eliminated within the suppression time
  • the device corresponding to the alarm information self-recovers.
  • the alarm information always exists when the device is abnormal, and when the device self-recovers successfully, from the abnormal state to the normal state, no longer When an alarm is issued, the corresponding alarm message is eliminated.
  • the system determines that the current alarm information is eliminated, it will put the alarm information into the processing list without processing the alarm information.
  • Step S40 if not, send the work order corresponding to the alarm information to the equipment corresponding to the operation and maintenance personnel.
  • the system determines that the alarm information has not been eliminated within the suppression time, it means that the device corresponding to the alarm information cannot recover itself within the suppression time, and the system generates the corresponding work order for the alarm information, and The work order is sent to the equipment corresponding to the operation and maintenance personnel to troubleshoot by the operation and maintenance personnel to the site.
  • the alarm information when the alarm information is received, it is determined whether the alarm information is an alarm information that can be automatically eliminated; if so, the suppression time corresponding to the alarm information is determined; based on the suppression time, the alarm information is performed Suppress, and determine whether the alarm information is eliminated within the suppression time; if not, send the work order corresponding to the alarm information to the equipment corresponding to the operation and maintenance personnel.
  • the alarm information is received in the present disclosure, it is first determined whether the alarm information can be automatically eliminated. If it can, the corresponding suppression time is determined and the alarm information is suppressed for the automatic elimination of the alarm information. If the alarm information cannot be eliminated within the suppression time If it is automatically eliminated, the work order corresponding to the alarm information is sent to the equipment corresponding to the operation and maintenance personnel to realize the adaptive dispatch of the alarm information.
  • a second embodiment of the alarm dispatch method of the present disclosure is proposed based on the first embodiment.
  • the difference between the second embodiment of the alarm dispatch method and the first embodiment of the alarm dispatch method is that before step S10, the method further includes: step S50, collecting a plurality of different alarm information, and pre-training each alarm information Processing to obtain a plurality of different alarm information to be classified; step S60, based on the alarm information to be classified, a training set for training a classification model to be trained is constructed; step S70, obtaining label information corresponding to each alarm information to be classified; In step S80, the warning information to be classified in the training set is used as the input of the classification model to be trained, and the corresponding labeled information is used as the output of the classification model to be trained, and the classification model is obtained by training.
  • the system first collects multiple different alarm information through the collection module as a training sample, and based on the label information corresponding to the alarm information, through model training, the training obtains a classification model to help subsequent alarm information Classification.
  • the solution of the present disclosure relates to a classification model and a life cycle prediction model.
  • the training of these two models can be performed simultaneously, and the training method class is, and the classification model is mainly used for detailed description here.
  • Step S50 Collect multiple different alarm information, preprocess each alarm information, and obtain multiple different alarm information to be classified.
  • the system collects multiple different alarm information and preprocesses all the alarm information to obtain multiple different alarm information to be classified, where the alarm information is historical alarm information recorded in the database corresponding to the system .
  • the alarm information collected by the system is updated at any time, that is, when the system automatically judges the current alarm information, the alarm information record before the current alarm information is collected, and after processing the current alarm information When receiving the next alarm information, the alarm information collected by the system includes the currently processed alarm information in addition to the previous alarm information record.
  • the system includes a monitoring system, a classification model, a life cycle prediction model, a suppression dispatch unit, a document system, a DB (training set), and operation and maintenance personnel.
  • the processing flow is as follows: the system receives real-time alarm information from the health system, converts the alarm information as a sample into a numeric vector, and enters the classification model MODEL for classification. If the output classification result is yes (can be automatically eliminated), the alarm information is transmitted to life Period prediction model, continue to predict; if the output of the classification result is no (can not be automatically eliminated) alarm information, it is directly sent to the suppression order unit, the suppression time of the alarm information at this time is 0, the suppression order unit is based on the suppression time, The alarm information is sent to the document system, and the document system generates a work order and sends it to the operation and maintenance personnel. At this time, the alarm information is also recorded and used as the training set of the model for model training to obtain the classification model and life cycle prediction model.
  • preprocessing includes several steps such as filtering of abnormal alarm information, extraction of attribute information, and numerical conversion.
  • the filtering of abnormal alarm information refers to that the system filters some alarm information of repeated alarms, etc., to avoid repeatedly processing the same alarm information, resulting in waste of resources.
  • the extraction of attribute information refers to that the system obtains corresponding attribute information according to the received alarm information, where the attribute information includes the alarm title, alarm level, the manufacturer corresponding to the alarm device, the alarm time, and the network element identification.
  • the value conversion refers to that the system converts the attribute information into a value or a letter representation.
  • the value conversion is divided into direct value conversion, direct dumb encoding, and indirect dumb encoding.
  • the service value is directly used.
  • the alarm level uses the digital coding in the network management alarm level, which is divided according to the level 4 alarm, the first level alarm value is 4, and the second level alarm value is 3.
  • the value of the third-level alarm is 2, and the value of the fourth-level alarm is 1.
  • the severity level of the alarm level the level is mapped from low to high as a natural number from 1 to 4. The larger the number, the more serious the level.
  • Direct dumb coding ONE-HOT coding (one-hot coding) is required for fields that belong to a certain category or have a certain type of characteristics: each value of discrete features is regarded as a state, if a feature There are N different values in it, then the feature can be abstracted into N different states.
  • the ONE-HOT coding ensures that each value will only make one state in the "activated state", that is to say this Only one of the N states has a status bit value of 1, and the other status bits are all 0s.
  • the alarm title, equipment manufacturer, equipment type, network element identification, and label fields are processed and converted using direct dumb coding.
  • Indirect dumb coding For time-related features such as fault occurrence time and fault recovery time, you need to segment the time first and then use dumb coding to process it. For example, the day is divided into the morning, morning, noon, afternoon, evening, evening and late night, and a characteristic of whether it is a holiday is derived. For example, the time when the fault occurs is reflected in the following table after indirect dumb coding:
  • the processed data is output to the X matrix, and the processed data dimension is (18537,1282), that is, 18537 samples, each sample has a total of 1282 attribute values, as follows Show:
  • Step S60 based on the alarm information to be classified, a training set for training the classification model to be trained is constructed.
  • the system constructs a training set for training the classification model according to the alarm information to be classified, where each alarm information to be classified is a training sample in the training set.
  • Step S70 Obtain label information corresponding to each alarm information to be classified.
  • the system obtains the label information corresponding to the alarm information to be classified.
  • the label information comes from the label of the operation and maintenance personnel (whether it is automatically eliminated) to generate the corresponding label information Y. If it is automatically eliminated, Y is 1, otherwise Y is 0.
  • Model training is to further analyze the degree of influence of the different values of each attribute information of the alarm on whether the ticket is automatically restored (label value) from the filtered alarm information, that is, the weight, which is reflected as the weight parameter matrix W. In this way, you can understand whether a certain attribute has a significant impact on whether the work order can be automatically recovered or the life cycle length.
  • the training alarm information is historical alarm information that has been processed, then it means that the user can manually label it, that is, each alarm information to be classified has a label information that is artificially labeled, the label
  • the information is that the label can be automatically eliminated and the label cannot be automatically eliminated.
  • step S80 the warning information to be classified in the training set is used as the input of the classification model to be trained, and the corresponding labeled information is used as the output of the classification model to be trained, and the classification model is obtained by training.
  • the system takes the alarm information to be classified in the training set as the input of the classification model, and uses the corresponding labeled label information as the output of the classification model to train to obtain a classification model.
  • the classification model is a dichotomous model, that is, the alarm information corresponds to It is classified into alarm information that can be automatically eliminated and alarm information that cannot be automatically eliminated.
  • the model training in this embodiment uses a neural network for learning.
  • the neural network is composed of an input layer, multiple hidden layers, and an output layer.
  • the hidden layer is composed of multiple nodes (each node corresponds to a neuron).
  • the output layer is a continuous function of the input layer, which completes the regression function.
  • Each node generates the output of the neuron by weighting multiple inputs and applying an activation function as the input of the lower layer.
  • the neuron is weighted and summed from multiple inputs and uses an activation function to generate the output.
  • the output of each layer is connected as the input layer of the next layer to form a multi-layer multi-node neural network model.
  • a multi-layer neural network model is trained.
  • the neural network consists of many layers and nodes. Initialize the model parameters randomly, and set the MINI-BATCH (small batch) size and the number of iterations EPOCH (when a complete training set passes through the neural network once and returns once, this process is called an EPOCH).
  • the neural network model is trained in EPOCH iterations. Each EPOCH performs a forward propagation on the mini-batches of MINI-BATCH data. Each layer obtains data from each node in the previous layer, and multiplies these data by the weight.
  • the role of the classification model is to classify whether the alarm information can be automatically eliminated (can be automatically eliminated or not), which is obtained through training and is a multi-layer neural network model: 1 input layer, multiple hidden layers, and one output layer .
  • Corresponding function y f(x), both y and x are vectors, the parameter of f(x) is W, which is in matrix form, please refer to the classification model diagram in FIG. 4.
  • the training method of the life cycle prediction model is based on the classification model training, and the score of the alarm information is calculated through the attribute information corresponding to the alarm information, and the score of the alarm information is used as the input of the life cycle prediction model, corresponding to the association
  • the alarm elimination time is obtained as the output training of the life cycle prediction model.
  • the role of the life cycle prediction model is to predict the life cycle of the alarm information that can be automatically eliminated. It is a multi-layer neural network model obtained by training: the neural network is composed of many layers and nodes. Each layer obtains the attribute information from each node of the previous layer, multiplies these attribute information by the weight and adds the data from different nodes, and finally generates the result of the layer through a nonlinear function. Each layer will have many nodes, so as to reduce or expand the size.
  • the training process is to extract the attribute information of the historical alarm information, and input it as a sample.
  • the weight parameter W of the model is gradually adjusted to make the model The loss is the smallest, and the model that best fits the training sample and has a strong generalization ability comes out.
  • the processing flow is as follows:
  • Sample X (18537,1282) is split into training data X_TRAIN (50%), verification data X_VAL (30%) and test data X_TEST (20%), label Y (18537) is split into training data Y_TRAIN (50%), Verification data Y_VAL (30%) test data Y_TEST (20%).
  • Adopt XAVIER UNIFORM initialization method one of deep learning methods, including INPUT_SHAPE: 1282, network structure: 1282*512(dropout(0.5))*256*1, activation function Activation(relu, relu, sigmoid ), OUTPUT is two categories.
  • the system of this embodiment includes an acquisition module. Before receiving the alarm information, the historical alarm information correspondingly recorded by the system is first collected, and the historical alarm information is used as a training sample to obtain a dichotomous classification model for subsequent training when the alarm information is received.
  • the classification model can be used to quickly determine whether the current alarm information can be automatically eliminated or cannot be automatically eliminated, and the classification model is always updated, which improves the intelligence of the alarm method.
  • a third embodiment of the alarm dispatch method of the present disclosure is proposed.
  • the difference between the third embodiment of the alarm dispatch method and the first or second embodiment of the alarm dispatch method is that after step S10, the method further includes:
  • step S90 if the alarm information is an alarm information that cannot be automatically eliminated, the work order corresponding to the alarm information is sent to the equipment corresponding to the operation and maintenance personnel.
  • a corresponding work order is generated according to the attribute information corresponding to the alarm information, and the work order includes an alarm occurrence time, an alarm device, and an alarm problem.
  • the system sends the work order corresponding to the alarm information to the equipment corresponding to the operation and maintenance personnel, so that the operation and maintenance personnel can understand the current alarm information and go to the site for troubleshooting.
  • the system can make a preliminary judgment on the alarm problem corresponding to the alarm information and determine the tools required to solve the alarm problem, so as to solve the alarm problem according to Generate the tool list for the required tools, and send the tool list and the corresponding work order to the equipment corresponding to the operation and maintenance personnel, so that the operation and maintenance personnel can prepare the corresponding maintenance tools according to the tool list before arriving at the site.
  • the work order corresponding to the alarm information is directly sent to the equipment corresponding to the operation and maintenance personnel, and the operation and maintenance personnel are notified to the site for troubleshooting in a timely manner, which improves the dispatch of alarms.
  • the intelligence of the method realizes the adaptive dispatching of alarm information by the alarm dispatching system.
  • the present disclosure further provides an alarm dispatch device, as shown in FIG. 6, which is a schematic diagram of a functional module of an embodiment of the alarm dispatch device of the present disclosure.
  • the alarm dispatching device includes: a judgment module 10 for determining whether the alarm information is an automatically erasable alarm information when receiving the alarm information; and a determination module 20 for determining if it is A suppression time corresponding to the alarm information; a suppression module 30, used to suppress the alarm information based on the suppression time, and determining whether the alarm information is eliminated within the suppression time; a sending module 40, used to If not, the work order corresponding to the alarm information is sent to the equipment corresponding to the operation and maintenance personnel.
  • the judgment module 10 further includes: a pre-processing unit for pre-processing the alarm information when the alarm information is received to obtain alarm information to be classified; a first generating unit for The alarm information to be classified is input into the classification model to generate corresponding label information; the first judgment unit is configured to determine whether the alarm information is an alarm information that can be automatically eliminated according to the label information.
  • the alarm dispatching device further includes: a collection module for collecting multiple different alarm information, pre-processing each alarm information to obtain multiple different alarm information to be classified; a building module for The alarm information to be classified constructs a training set for training the classification model to be trained; an acquisition module is used to acquire label information corresponding to each alarm information to be classified; a training module is used to alarm to be classified in the training set The information is used as the input of the classification model to be trained, and the corresponding labeled label information is used as the output of the classification model to be trained to obtain the classification model by training.
  • the determination module 20 includes: a second generation unit for inputting the alarm information into a pre-trained life cycle prediction model to generate a corresponding alarm elimination time; the first calculation unit is used Calculate the life cycle of the alarm information based on the alarm elimination time and the alarm time corresponding to the alarm information; a second judgment unit, used to determine whether the life cycle exceeds a preset life cycle; a first determination unit, If not, determine the suppression time corresponding to the alarm information based on the life cycle.
  • the second generation unit includes: an acquisition unit for acquiring attribute information corresponding to the alarm information if it is; a second calculation unit for calculating the life cycle prediction model based on the attribute information , Calculate the alarm elimination time corresponding to the alarm information.
  • the alarm dispatching device further includes: a second determining unit, configured to determine that the suppression time corresponding to the alarm information is 0 if the life cycle exceeds a preset life cycle.
  • the sending module is further configured to send the work order corresponding to the alarm information to the device corresponding to the operation and maintenance personnel if the alarm information corresponds to the alarm information that cannot be automatically eliminated.
  • embodiments of the present disclosure also propose a computer-readable storage medium.
  • An alarm dispatch program is stored on the computer-readable storage medium, and when the alarm dispatch program is executed by the processor, the steps of the alarm dispatch method in any one of the foregoing embodiments are implemented.
  • the alarm information When the alarm information is received in the present disclosure, it is first determined whether the alarm information can be automatically eliminated. If it can, the corresponding suppression time is determined and the alarm information is suppressed for the automatic elimination of the alarm information. If the alarm information cannot be eliminated within the suppression time If it is automatically eliminated, the work order corresponding to the alarm information is sent to the equipment corresponding to the operation and maintenance personnel to realize the adaptive dispatch of the alarm information.
  • the alarm information when the alarm information is received, it is determined whether the alarm information is an alarm information that can be automatically eliminated; if so, the suppression time corresponding to the alarm information is determined; based on the suppression time, the alarm The information is suppressed, and it is determined whether the alarm information is eliminated within the suppression time; if not, the work order corresponding to the alarm information is sent to the equipment corresponding to the operation and maintenance personnel.
  • the alarm information is received in the present disclosure, it is first determined whether the alarm information can be automatically eliminated. If it can, the corresponding suppression time is determined and the alarm information is suppressed for the automatic elimination of the alarm information. If the alarm information cannot be eliminated within the suppression time If it is automatically eliminated, the work order corresponding to the alarm information is sent to the equipment corresponding to the operation and maintenance personnel to realize the adaptive dispatch of the alarm information.

Abstract

本公开公开了一种告警派单方法，该方法包括以下步骤：当接收到告警信息时，确定所述告警信息是否为可自动消除的告警信息；若是，则确定所述告警信息对应的抑制时间；基于所述抑制时间，对所述告警信息进行抑制，并确定所述告警信息在所述抑制时间内是否消除；若否，则将所述告警信息对应的工单发送至运维人员对应的设备。本公开还公开了一种告警派单装置、系统及计算机可读存储介质。

Description

告警派单方法、装置、系统及计算机可读存储介质
本公开要求享有2018年12月26日提交的名称为“告警派单方法、装置、系统及计算机可读存储介质”的中国专利申请CN201811609417.2的优先权，其全部内容通过引用并入本文中。
技术领域
本公开涉及网络运维技术领域，尤其涉及一种告警派单方法、装置、系统及计算机可读存储介质。
背景技术
在网络运维管理中，如果电信设备出现故障，会产生设备告警信息，并层层上报到网管监控系统，并进一步判断上报的告警信息对应的设备故障是否会影响业务质量或者业务流程，如果判定上报的告警信息对应的设备故障影响到业务质量或者业务流程，则会派发工单到运维工单系统，再由运维工单系统将工单派发给外线运维人员对应的设备，以使对应的运维人员到故障现场进行排障,从而形成一个闭环流程，最大程度的保障电信设备的正常运转。
目前告警工单的派发分为手工派单、自动派单和自动延迟派单，其中手工派单需要运维人员根据经验判断告警是否需要派发到工单系统，这种方式依赖于运维人员的经验，并且占用大量人力资源，效率不高。而自动派单是根据积累的派发工单的经验知识，建立自动派单规则，当影响业务的告警信息上来时，网管监控系统自动派发到运维工单系统，这种方式只要是告警信息就派单，智能性较低，对于某些能自动恢复的告警设备来说，完全可以等一等就可以解决了。而自动延迟派单则是针对某些故障单据在一定时间段内能自动恢复的情况，可以理解的，若某告警信息对应的设备故障在一定时间内自动恢复了，那么就不需要运维人员上站维护，从而节约运维成本。这些经验会沉淀下来形成专家库知识，并进一步转换成派单延迟规则，对于符合自动恢复条件的告警信息延迟固定的时间再进行派单，这样可以大幅度降低派单量，节约运维成本提升运维效率，但自动延迟派单规则依旧存在两个缺点，一个是依赖于经验的积累，一个是灵活度不够。
发明内容
本公开的主要目的在于提供一种告警派单方法、装置、系统及计算机可读存储介质， 旨在解决现有网络运维管理中，设备故障分析不足，导致运维成本高，且运维方式不够灵活智能的技术问题。
为实现上述目的，本公开提供了一种告警派单方法，所述告警派单方法包括：当接收到告警信息时，确定所述告警信息是否为可自动消除的告警信息；若是，则确定所述告警信息对应的抑制时间；基于所述抑制时间，对所述告警信息进行抑制，并确定所述告警信息在所述抑制时间内是否消除；若否，则将所述告警信息对应的工单发送至运维人员对应的设备。
此外，为实现上述目的，本公开还提出一种告警派单装置，所述告警派单装置包括：判断模块，用于当接收到告警信息时，确定所述告警信息是否为可自动消除的告警信息；确定模块，用于若是，则确定所述告警信息对应的抑制时间；抑制模块，用于基于所述抑制时间，对所述告警信息进行抑制，并确定所述告警信息在所述抑制时间内是否消除；发送模块，用于若否，则将所述告警信息对应的工单发送至运维人员对应的设备。
此外，为实现上述目的，本公开还提供一种告警派单系统，所述告警派单系统包括存储器、处理器及存储在所述存储器上并可在所述处理器上运行的告警派单程序，所述告警派单程序被所述处理器执行时实现如上文所述的告警派单方法的步骤。
此外，为实现上述目的，本公开还提供一种计算机可读存储介质，所述计算机可读存储介质上存储有告警派单程序，所述告警派单程序被处理器执行时实现如上文所述的告警派单方法的步骤。
附图说明
图1是本公开实施例方案涉及的硬件运行环境的服务器结构示意图；
图2为本公开告警派单方法第一实施例的流程示意图；
图3为本本公开告警派单方法第一实施例中告警派单界面设置为三个预设分屏区域的示意图；
图4为本公开告警派单方法第三实施例的流程示意图；
图5为本公开告警派单方法第四实施例的流程示意图；
图6为本公开的告警派单装置实施例的功能模块示意图。
本公开目的的实现、功能特点及优点将结合实施例，参照附图做说明。
具体实施方式
应当理解，此处所描述的实施例仅用以解释本公开，并不用于限定本公开。
本公开实施例的解决方案主要是：当接收到告警信息时，确定所述告警信息是否为可自动消除的告警信息；若是，则确定所述告警信息对应的抑制时间；基于所述抑制时间，对所述告警信息进行抑制，并确定所述告警信息在所述抑制时间内是否消除；若否，则将所述告警信息对应的工单发送至运维人员对应的设备。以解决现有网络运维管理中，设备故障分析不足，导致运维成本高，且运维方式不够灵活智能的技术问题。
本公开实施例提出一种告警派单系统。
如图1所示，图1是本公开实施例方案涉及的硬件运行环境的告警派单系统的结构示意图。
在后续的描述中，使用用于表示元件的诸如“模块”、“部件”或“单元”的后缀仅为了有利于本公开的说明，其本身没有特定的意义。因此，“模块”、“部件”或“单元”可以混合地使用。
该告警派单系统可以包括：处理器1001，例如CPU，通信总线1002、用户接口1003，网络接口1004，存储器1005。其中，通信总线1002用于实现这些组件之间的连接通信。业主接口1003可以包括显示屏(Display)、输入单元比如键盘(Keyboard)，在一个实施例中，业主接口1003还可以包括标准的有线接口(例如用于连接有线键盘、有线鼠标等)、无线接口(例如用于连接无线键盘、无线鼠标)。网络接口1004可选的可以包括标准的有线接口(用于连接有线网络)、无线接口(如WI-FI接口、蓝牙接口、红外线接口等，用于连接无线网络)。存储器1005可以是高速RAM存储器，也可以是稳定的存储器(non-volatile memory)，例如磁盘存储器。存储器1005可选的还可以是独立于前述处理器1001的存储装置。
本领域技术人员可以理解，图1中示出的告警派单系统并不构成对告警派单系统的限定，可以包括比图示更多或更少的部件，或者组合某些部件，或者不同的部件布置。
如图1所示，作为一种计算机可读存储介质的存储器1005中可以包括操作系统、网络通信模块、业主接口模块以及告警派单程序。其中，操作系统是管理和控制告警派单系统与软件资源的程序，支持网络通信模块、业主接口模块、告警派单程序以及其他程序或软件的运行；网络通信模块用于管理和控制网络接口1002；业主接口模块用于管理和控制业主接口1003。
在图1所示的告警派单系统中，所述告警派单系统通过处理器1001调用存储器1005中存储的告警派单程序，并执行以下步骤：当接收到告警信息时，确定所述告警信息是否为可自动消除的告警信息；若是，则确定所述告警信息对应的抑制时间；基于所述抑制时 间，对所述告警信息进行抑制，并确定所述告警信息在所述抑制时间内是否消除；若否，则将所述告警信息对应的工单发送至运维人员对应的设备。
在一个实施例中，所述当接收到告警信息时，确定所述告警信息是否为可自动消除的告警信息的步骤包括：当接收到告警信息时，对所述告警信息进行预处理，得到待分类告警信息；将所述待分类告警信息输入分类模型中，生成对应的标签信息；根据所述标签信息，确定所述告警信息是否为可自动消除的告警信息。
在一个实施例中，所述当接收到告警信息时，确定所述告警信息是否为可自动消除的告警信息的步骤之前，处理器110还用于调用存储器109中存储的告警派单程序，并执行以下操作：采集多个不同的告警信息，将各个告警信息进行预处理，得到多个不同的待分类告警信息；基于所述待分类告警信息，构建用于训练待训练分类模型的训练集；获取各个待分类告警信息对应标注的标签信息；将所述训练集中的待分类告警信息作为所述待训练分类模型的输入，将对应标注的标签信息作为所述待训练分类模型的输出，训练得到所述分类模型。
在一个实施例中，所述若是，则确定所述告警信息对应的抑制时间的步骤包括：若是，则将所述告警信息输入预先训练好的生命周期预测模型中，生成对应的告警消除时间；基于所述告警消除时间和所述告警信息对应的告警时间，计算所述告警信息的生命周期；确定所述生命周期是否超过预设生命周期；若否，则基于所述生命周期，确定所述告警信息对应的抑制时间。
在一个实施例中，所述若是，则将所述告警信息输入预先训练好的生命周期预测模型中，生成对应的告警消除时间的步骤包括：若是，则获取所述告警信息对应的属性信息；基于所述属性信息，通过所述生命周期预测模型，计算所述告警信息对应的告警消除时间。
在一个实施例中，所述确定所述生命周期是否超过预设生命周期的步骤之后，处理器110还用于调用存储器109中存储的告警派单程序，并执行以下操作：若所述生命周期超过预设生命周期，则确定所述告警信息对应的抑制时间为0。
在一个实施例中，所述当接收到告警信息时，确定所述告警信息是否为可自动消除的告警信息的步骤之后，处理器110还用于调用存储器109中存储的告警派单程序，并执行以下操作：若所述告警信息为不可自动消除的告警信息，则将所述告警信息对应的工单发送至运维人员对应的设备。
告警派单系统100还可以包括给各个部件供电的电源111(比如电池)，在一个实施例中，电源111可以通过电源管理系统与处理器110逻辑相连，从而通过电源管理系统实现管理充电、放电、以及功耗管理等功能。
尽管图1未示出，告警派单系统100还可以包括蓝牙模块等，在此不再赘述。
基于上述告警派单系统硬件结构，提出本公开告警派单方法的各个实施例。
本公开提供一种告警派单方法。
参照图2，图2为本公开告警派单方法第一实施例的流程示意图。
在本实施例中，提供了告警派单方法的实施例，需要说明的是，虽然在流程图中示出了逻辑顺序，但是在某些情况下，可以以不同于此处的顺序执行所示出或描述的步骤。
在本实施例中，告警派单方法可选应用于告警派单系统中，为方便描述，告警派单系统以下简称系统，告警派单方法包括：步骤S10，当接收到告警信息时，确定所述告警信息是否为可自动消除的告警信息；步骤S20，若是，则确定所述告警信息对应的抑制时间；步骤S30，基于所述抑制时间，对所述告警信息进行抑制，并确定所述告警信息在所述抑制时间内是否消除；步骤S40，若否，则将所述告警信息对应的工单发送至运维人员对应的设备。
在本实施例中，当告警派单系统在接收到告警信息时，先判断该告警信息是否能自动消除，若能，则确定对应的抑制时间，并抑制该告警信息，以供告警信息在该抑制时间内自动消除，若在抑制时间内告警信息无法自动消除，则将告警信息对应的工单发送给运维人员对应的设备，实现告警信息的自适应派单。
以下针对每个步骤进行详细说明：
步骤S10，当接收到告警信息时，确定所述告警信息是否为可自动消除的告警信息。
在本实施例中，系统该包括监控装置，负责监控现场电信设备的运行情况，当现场有设备运行出现异常时，接收异常设备的异常响应，并将对应的告警信息发送给系统。
当系统接收到告警信息时，确定该告警信息的类别，在一个实施例中，系统判断该告警信息为可自动消除的告警信息，还是不可自动消除的告警信息。
对于软故障告警信息，通常可以通过后台智能处理或者不经过任何处理就可以自动恢复，这类告警信息即为可自动消除的告警信息；对于硬故障，涉及板卡坏、设备坏、光纤断等情况显然是通过后台智能处理无法进行解决的。这类故障只能及时派发工单到现场处理，这类告警信息即为不可自动消除的告警信息。
在一个实施例中，步骤S10包括：
步骤S11，当接收到告警信息时，对所述告警信息进行预处理，得到待分类告警信息。
当系统接收到告警信息时，对该告警信息进行预处理，得到待分类告警信息，其中，预处理包括异常告警信息过滤，属性信息的提取，以及数值转换等几个步骤。
在一个实施例中，异常告警信息过滤指的是，系统对一些重复报警的告警信息等进行过滤，避免重复处理同一条告警信息，造成资源浪费，在本实施例中，系统判断该告警信息是否为重复告警信息，若是，则删除该告警信息。
属性信息的提取指的是，系统根据接收到的告警信息，获取对应的属性信息，其中，属性信息包括告警标题、告警级别、告警设备对应的厂商、告警时间和网元标识等。
数值转化指的是，系统将属性信息转化为数值或者字母表示。
如告警级别其中网管告警级别中采用数字编码，按照4级告警划分，一级告警取值4，二级告警取值3，三级告警取值2，四级告警取值1。根据告警级别的严重程度级别从低到高映射为从1到4的自然数，数字越大表示级别越严重。如本实施例中的告警信息若为三级告警时，则取值2。
步骤S12，将所述待分类告警信息输入分类模型中，生成对应的标签信息。
系统将待分类告警信息输入预先训练好的分类模型中，由分类模型输出对应的标签信息。其中，标签信息在本实施例中分为可自动消除标签和不可自动消除标签:原始值为TRUE或FALSE，表示可自动消除或不可自动消除,TRUE转换为1，表示可自动消除，FALSE为0，表示不可自动消除。在分类模型中，所有样本的标签转换后即为只含0,1的向量，基于此可以训练一个二分的分类模型。
在本实施例中，系统只需将待告警信息输入事先训练好的分类模型中，即可生成对应的标签信息。
步骤S130，根据所述标签信息，确定所述告警信息是否为可自动消除的告警信息。
系统根据标签信息，确定告警信息的类型，在一个实施例中，判断告警信息是可自动消除的告警信息，还是不可自动消除的告警信息。
步骤S20，若是，则确定所述告警信息对应的抑制时间。
在本实施例中，若系统判定当前告警信息为可自动消除的告警信息，则确定该告警信息对应的抑制时间。可以理解的，若当前的告警信息是可自动消除的告警信息，则表示该告警信息对应的设备在一段时候内能自动进行恢复，那么系统应当允许该设备进行自我恢复，那么该告警信息就不需要进行派单，故在该设备进行自我恢复的这段时间里，系统需要对该告警信息进行抑制，以确保该告警信息不会马上被处理。
在一个实施例中，步骤S20包括：
步骤S21，若是，则将所述告警信息输入预先训练好的生命周期预测模型中，生成对应的告警消除时间。
若系统判定当前的告警信息为可自动消除的告警信息，则将该告警信息输入预先训练好的生命周期预测模型中，生成对应的告警消除时间。
在一个实施例中，步骤S21包括：
步骤a，若是，则获取所述告警信息对应的属性信息。
若系统判定当前的告警信息为可自动消除的告警信息，则获取该告警信息对应的属性信息，其中，属性信息包括告警标题、告警级别、告警设备对应的厂商、告警时间和网元 标识等。
步骤b，基于所述属性信息，通过所述生命周期预测模型，计算所述告警信息对应的告警消除时间。
系统根据获得的属性信息，通过生命周期预测模型，计算该告警信息对应的告警消除时间，在一个实施例中，系统在获得属性信息后，根据属性信息中的告警标题、告警级别、告警设备对应的缠上、告警时间和网元标识等各自在属性信息中所占的预设权重，计算该告警信息的得分，根据得分与告警消除时间的映射关系，得到告警信息对应的告警消除时间。
步骤S22，基于所述告警消除时间和所述告警信息对应的告警时间，计算所述告警信息的生命周期。
系统根据计算得出的告警消除时间和告警信息对应的告警时间，计算告警信息的生命周期，生命周期即指该告警信息的存活时间，具体指该告警信息从发出告警到自动消除的时间。
步骤S23，确定所述生命周期是否超过预设生命周期。
可以理解的，如果该告警信息对应的设备故障可以自我消除，但是所用时间过长，如需要一天以上的时间才能恢复成正常状态，此时告警消除时间过长，会影响对应业务的进程，则该告警信息是不应当进行抑制的，而是应当及时通知运维人员。故系统在计算出告警信息的生命周期后，需要确定该生命周期是否超过了预设生命周期，由于现场设备不同，以及对应处理的业务不同，该预设生命周期需要根据实际情况进行设定。
步骤S24，若否，基于所述生命周期，确定所述告警信息对应的抑制时间。
若系统判定计算出来的生命周期未超过预设生命周期，则根据计算得出的告警信息的生命周期，确定该告警信息对应的抑制时间，可以理解的，告警信息的生命周期与抑制时间不一致，在实际处理过程中，抑制时间会比告警信息对应的生命周期要长一些，如系统计算得出告警信息的生命周期为3秒，则抑制时间为5秒，确保告警信息有足够的时间进行自我消除。即抑制时间等于告警信息对应的生命周期加上一个预设的固定时间。
在一个实施例中，步骤S23之后，所述方法还包括：
步骤S25，若所述生命周期超过预设生命周期，则确定所述告警信息对应的抑制时间为0。
若系统判定计算出来的生命周期超过了预设生命周期，则表示该告警信息自我消除的时间过长，可能会影响对应业务的进程，故系统直接确定该告警信息的抑制时间为0，即系统直接获取该告警信息对应的工单，并将该告工单发送至外线运维人员对应的设备。
步骤S30，基于所述抑制时间，对所述告警信息进行抑制，并确定所述告警信息在所述抑制时间内是否消除。
在本实施例中，系统基于计算得出的抑制时间，对对应的告警信息进行抑制，在一个实施例中，是对该告警信息进行延迟处理，延迟的时间即为抑制时间。系统在抑制时间内确定该告警信息是否消除
可以理解的，在抑制时间内，告警信息对应的设备进行自我恢复，在该设备处于异常的情况下，告警信息一直存在，当该设备自我恢复成功，从异常状态变为正常状态时，不再发出告警，对应的告警信息即被消除。
若系统确定当前告警信息消除时，则将该告警信息提出处理名单，不用再对该告警信息进行处理。
步骤S40，若否，则将所述告警信息对应的工单发送至运维人员对应的设备。
在本实施例中，若系统判定在抑制时间内，告警信息还不消除，则说明该告警信息对应的设备在抑制时间内无法自我恢复，系统则将告警信息生成对应的工单，并将该工单发送至运维人员对应的设备，以通过运维人员到现场进行排障。
本实施例在当接收到告警信息时，确定所述告警信息是否为可自动消除的告警信息；若是，则确定所述告警信息对应的抑制时间；基于所述抑制时间，对所述告警信息进行抑制，并确定所述告警信息在所述抑制时间内是否消除；若否，则将所述告警信息对应的工单发送至运维人员对应的设备。本公开在接收到告警信息时，先判断该告警信息是否能自动消除，若能，则确定对应的抑制时间，并抑制该告警信息，以供告警信息自动消除，若在抑制时间内告警信息无法自动消除，则将告警信息对应的工单发送给运维人员对应的设备，实现告警信息的自适应派单。
在一个实施例中，基于第一实施例提出本公开告警派单方法的第二实施例。告警派单方法的第二实施例与告警派单方法的第一实施例的区别在于，步骤S10之前，所述方法还包括：步骤S50，采集多个不同的告警信息，将各个告警信息进行预处理，得到多个不同的待分类告警信息；步骤S60，基于所述待分类告警信息，构建用于训练待训练分类模型的训练集；步骤S70，获取各个待分类告警信息对应标注的标签信息；步骤S80，将所述训练集中的待分类告警信息作为所述待训练分类模型的输入，将对应标注的标签信息作为所述待训练分类模型的输出，训练得到所述分类模型。
在本实施例中，系统先通过采集模块采集多个不同的告警信息，作为训练用的样本，并基于告警信息对应的标签信息，通过模型训练，训练得到一个分类模型，以助于后续告警信息的分类。
需要说明的是，本公开方案涉及到分类模型和生命周期预测模型，在实际处理中，这两个模型的训练是可以同步进行的，训练方法类是，这里以分类模型为主进行详细说明。
以下将对各个步骤进行详细说明：
步骤S50，采集多个不同的告警信息，将各个告警信息进行预处理，得到多个不同的待分类告警信息。
在本实施例中，系统采集多个不同的告警信息，并对所有的告警信息进行预处理，得到多个不同的待分类告警信息，其中，告警信息是系统对应的数据库中记录的历史告警信息。需要说明的是，系统采集的告警信息是随时更新的，即系统在对当前的告警信息进行可自动消除判断时，采集是当前的告警信息之前的告警信息记录，在处理完当前的告警信息后，接收到下一条告警信息时，系统采集的告警信息除了之前的告警信息记录，还包括当前已处理完的告警信息。
如图3所示，系统包括监控系统、分类模型、生命周期预测模型、抑制派单单元、单据系统、DB(训练集)、运维人员。
处理流程如下:系统接收健康系统实时告警信息，将告警信息作为一个样本转换为数值向量，并输入分类模型MODEL进行分类，若输出分类结果为是(可自动消除)的告警信息，则传输给生命周期预测模型，继续预测；若输出分类结果为否(不可自动消除)的告警信息，则直接发送给抑制派单单元，此时的告警信息的抑制时间为0，抑制派单单元根据抑制时间，将告警信息发送到单据系统，由单据系统生成工单发给运维人员，此时的告警信息也被记录，作为模型的训练集，用于模型训练，得到分类模型和生命周期预测模型。
其中，预处理包括异常告警信息过滤，属性信息的提取，以及数值转换等几个步骤。
在一个实施例中，异常告警信息过滤指的是，系统对一些重复报警的告警信息等进行过滤，避免重复处理同一条告警信息，造成资源浪费。
属性信息的提取指的是，系统根据接收到的告警信息，获取对应的属性信息，其中，属性信息包括告警标题、告警级别、告警设备对应的厂商、告警时间和网元标识等。
数值转化指的是，系统将属性信息转化为数值或者字母表示，在一个实施例中，数值转化分为直接数值转化、直接哑编码和间接哑编码。
直接数值转化：对于数值大小可以反映业务信息的特征直接采用业务数值，如告警级别其中网管告警级别中采用数字编码，按照4级告警划分，一级告警取值4，二级告警取值3，三级告警取值2，四级告警取值1。根据告警级别的严重程度级别从低到高映射为从1到4的自然数，数字越大表示级别越严重。
直接哑编码：对于属于某一个类别，或具有某一种类的特性的字段需要进行ONE-HOT编码(独热编码):将离散型特征的每一种取值都看成一种状态，若一特征中有N个不相同的取值，那么就可以将该特征抽象成N种不同的状态，ONE-HOT编码保证了每一个取值只会使得一种状态处于“激活态”，也就是说这N种状态中只有一个状态位值为1，其他状态位都是0。告警标题、设备厂商、设备类型、网元标识和标签字段等使用直接哑编 码进行处理转换。
如故障设备厂商字段中的取值有4种取值，厂商A、厂商B、厂商C、厂商D，那么使用0、1编码，1的位置对应取值。映射完成的结果如下：
厂商_A 厂商_B 厂商_C 厂商_D
1 0 0 0
0 1 0 0
0 0 1 0
0 0 0 1
间接哑编码：对于时间相关的特征如故障发生时间和故障恢复时间等，需要先对时间进行分段处理后，再使用哑编码方式进行处理。如将一天分段为临晨、上午、中午、下午、傍晚、晚上和深夜几段，并且衍生一个是否为节假日的特征。如故障发生时间经过间接哑编码后体现为下面的表格：
临晨 上午 中午 下午 傍晚 晚上 深夜 节假日
1 0 0 0 0 0 0 0
0 1 0 0 0 0 0 1
以某运维管理3个月历史告警信息为例，处理完输出到X矩阵中，处理后的数据维度为(18537,1282)，即18537个样本，每个样本共1282个属性值，如下所示：
Figure PCTCN2019120611-appb-000001
步骤S60，基于所述待分类告警信息，构建用于训练待训练分类模型的训练集。
在本实施例中，系统根据待分类告警信息，构建训练分类模型所用的训练集，其中，每一个待分类告警信息都为训练集中的一个训练样本。
步骤S70，获取各个待分类告警信息对应标注的标签信息。
在本实施例中，系统获取各个待分类告警信息对应标注的标签信息，标签信息来自运维人员的标注(是否自动消除)，来生成对应的标签信息Y，如果自动消除则Y为1，否则Y为0。模型训练即从筛选的告警信息中进一步分析告警每个属性信息不同的取值对工单是否自动恢复(标签取值)的影响程度，即权重，体现为权重参数矩阵W。这样可以了解某个属性是否对工单是否可自动恢复或生命周期长短有显著影响。
可以理解的，这些训练用的告警信息是已经被处理过的历史告警信息，那么即说明用户可以对其进行人为标注，即每一个待分类告警信息都带有一个人为标注的标签信息，该 标签信息为可自动消除标签和不可自动消除标签。
步骤S80，将所述训练集中的待分类告警信息作为所述待训练分类模型的输入，将对应标注的标签信息作为所述待训练分类模型的输出，训练得到所述分类模型。
在本实施例中，系统将训练集中的待分类告警信息作为分类模型输入，将对应标注的标签信息作为分类模型的输出，训练得到分类模型，该分类模型是一个二分模型，即告警信息对应的分类为可自动消除的告警信息和不可自动消除的告警信息。
本实施例的模型训练采用神经网络进行学习，神经网络由一个输入层，多个隐藏层和一个输出层组成，隐藏层由多个节点(每个节点对应一个神经元)组成。输出层是输入层的连续函数，这样就完成了回归的功能。其中每个节点通过对多个输入进行加权并适用激活函数产生本神经元的输出，作为下层的输入。神经元由多个输入进行加权求和并运用激活函数产生输出。每一层的输出作为下一层的输入层层连接形成一个多层多节点神经网络模型。
通过标注过的历史告警信息作为输入,训练多层神经网络模型,神经网络由很多层和节点组成。先随机初始化模型参数，并设定MINI-BATCH(小批处理)大小和迭代次数EPOCH(当一个完整的训练集通过了神经网络一次并且返回了一次，这个过程称为一个EPOCH)。对神经网络模型进EPOCH次迭代训练，每次EPOCH中分别对MINI-BATCH的小批量数据进行一次前向传播，每一层从前面一层的每个节点中获取数据，将这些数据乘以权重并且将来自不同节点的数据相加，最后在通过非线性函数产生该层的结果，算出误差，然后反向传播更新一次参数。多次迭代的目的就是最小化预测结果和真实结果的误差，使得最大程度的和数据的结果一致并且具有良好的泛化能力。
分类模型的作用是对告警信息是否可以自动消除进行二分类(可自动消除或不可自动消除)，通过训练获得，为多层神经网络模型：1层输入层，多个隐含层，一个输出层。对应函数y＝f(x),y和x都为向量，f(x)的参数为W，为矩阵形式，参考图4分类模型图。
需要说明的是，生命周期预测模型的训练方式在分类模型训练的基础上，通过告警信息对应的属性信息，计算告警信息的得分，并将告警信息的得分作为生命周期预测模型的输入，对应关联的告警消除时间作为生命周期预测模型的输出训练得到。
生命周期预测模型的作用是对可自动消除的告警信息的生命周期预测，通过训练获得，为多层神经网络模型：神经网络由很多层和节点组成。每一层从前面一层的每个节点中获取属性信息，将这些属性信息乘以权重并且将来自不同节点的数据相加，最后在通过非线性函数产生该层的结果。每一层会有很多节点，从而实现尺寸的缩减或扩展。
对应函数y＝f(x),y和x都为向量，f(x)的参数为W，为矩阵形式。参考图5生命周期预测模型图。
以分类模型为例说明：训练过程为将对历史告警信息进行属性信息提取处理，作为样本进行输入，通过前向传播和后向传播数个迭代过程，逐渐调整模型的权重参数W，使得模型的损失最小，训练出和训练样本最贴合并且泛化能力强的模型出来。
处理流程如下：
训练样本拆分：
样本X(18537,1282)拆分为训练数据X_TRAIN(50％)、验证数据X_VAL(30％)和测试数据X_TEST(20％)，标签Y(18537)拆分为训练数据Y_TRAIN(50％)、验证数据Y_VAL(30％)测试数据Y_TEST(20％)。
生成MODEL：
初始化基本信息：
初始训练参数：采用XAVIER UNIFORM初始化方法(深度学习方法中的一种)，包括INPUT_SHAPE:1282，网络结构:1282*512(dropout(0.5))*256*1，激活函数Activation(relu，relu,sigmoid)，OUTPUT为二分类。
设定超参数：
学习率(rmsprop(lr＝0.001))、MINI-BATCH：128和迭代次数EPOCH：100。
模型训练：
对神经网络模型进行EPOCH次迭代训练,保存最优模型机制，即在验证集上模型不在进化时保存该模型。
模型评估：
采用ACCURACY评价指标。
输出模型MODEL。
本实施例系统包括采集模块，在接收告警信息之前，先采集系统对应记录的历史告警信息，以历史告警信息为训练样本，训练得到一个二分的分类模型，以供后续在接收到告警信息时，可以通过分类模型迅速判断出当前告警信息是可自动消除的告警信息还是不可自动消除的告警信息，并且该分类模型是一直处于更新状态的，提高了告警方法的智能性。
在一个实施例中，提出本公开告警派单方法的第三实施例。告警派单方法的第三实施例与告警派单方法的第一或第二实施例的区别在于，步骤S10之后，所述方法还包括：
步骤S90，若所述告警信息为不可自动消除的告警信息，则将所述告警信息对应的工单发送至运维人员对应的设备。
若系统判定当前的告警信息为不可自动消除的告警信息，则根据所述告警信息对应的属性信息，生成对应的工单，该工单包括告警发生时间、告警设备以及告警问题。
系统将告警信息对应的工单发送至运维人员对应的设备，以供运维人员了解当前的告 警信息，并到现场进行排障。
在一个实施例中，系统在将告警信息生成对应的工单的过程中，系统可对告警信息对应的告警问题进行初步判断，并确定解决该告警问题所需的工具，从而根据解决该告警问题所需的工具，生成工具清单，并将工具清单和对应的工单一并发送至运维人员对应的设备，以供运维人员在到现场之前，根据工具清单准备对应的维修工具。
本实施例当确定告警信息为不可自动消除的告警信息时，直接将告警信息对应的工单发送至运维人员对应的设备，以及时通报运维人员到现场进行排障，提高了告警派单方法的智能性，实现了告警派单系统对告警信息的自适应派单。
本公开进一步提供一种告警派单装置，如图6所示，图6为本公开告警派单装置实施例的功能模块示意图。
在本实施例中，该告警派单装置包括：判断模块10，用于当接收到告警信息时，确定所述告警信息是否为可自动消除的告警信息；确定模块20，用于若是，则确定所述告警信息对应的抑制时间；抑制模块30，用于基于所述抑制时间，对所述告警信息进行抑制，并确定所述告警信息在所述抑制时间内是否消除；发送模块40，用于若否，则将所述告警信息对应的工单发送至运维人员对应的设备。
在一个实施例中，判断模块10还包括：预处理单元，用于当接收到告警信息时，对所述告警信息进行预处理，得到待分类告警信息；第一生成单元，用于将所述待分类告警信息输入分类模型中，生成对应的标签信息；第一判断单元，用于根据所述标签信息，确定所述告警信息是否为可自动消除的告警信息。
在一个实施例中，告警派单装置还包括：采集模块，用于采集多个不同的告警信息，将各个告警信息进行预处理，得到多个不同的待分类告警信息；构建模块，用于基于所述待分类告警信息，构建用于训练待训练分类模型的训练集；获取模块，用于获取各个待分类告警信息对应标注的标签信息；训练模块，用于将所述训练集中的待分类告警信息作为所述待训练分类模型的输入，将对应标注的标签信息作为所述待训练分类模型的输出，训练得到所述分类模型。
在一个实施例中，确定模块20包括：第二生成单元，用于若是，则将所述告警信息输入预先训练好的生命周期预测模型中，生成对应的告警消除时间；第一计算单元，用于基于所述告警消除时间和所述告警信息对应的告警时间，计算所述告警信息的生命周期；第二判断单元，用于确定所述生命周期是否超过预设生命周期；第一确定单元，用于若否，则基于所述生命周期，确定所述告警信息对应的抑制时间。
在一个实施例中，第二生成单元包括：获取单元，用于若是，则获取所述告警信息对应的属性信息；第二计算单元，用于基于所述属性信息，通过所述生命周期预测模型，计 算所述告警信息对应的告警消除时间。
在一个实施例中，告警派单装置还包括：第二确定单元，用于若所述生命周期超过预设生命周期，则确定所述告警信息对应的抑制时间为0。
在一个实施例中，发送模块还用于若所述告警信息对应为不可自动消除的告警信息，则将所述告警信息对应的工单发送至运维人员对应的设备。
此外，本公开实施例还提出一种计算机可读存储介质。
所述计算机可读存储介质上存储有告警派单程序，所述告警派单程序被处理器执行时实现如上述任一项实施例中的告警派单方法的步骤。
本公开计算机可读存储介质实施方式与上述告警派单方法各实施例基本相同，在此不再赘述。
需要说明的是，在本文中，术语“包括”、“包含”或者其任何其它变体意在涵盖非排他性的包含，从而使得包括一系列要素的过程、方法、物品或者系统不仅包括那些要素，而且还包括没有明确列出的其它要素，或者是还包括为这种过程、方法、物品或者系统所固有的要素。在没有更多限制的情况下，由语句“包括一个……”限定的要素，并不排除在包括该要素的过程、方法、物品或者系统中还存在另外的相同要素。
上述本公开实施例序号仅仅为了描述，不代表实施例的优劣。
通过以上的实施方式的描述，本领域的技术人员可以清楚地了解到上述实施例方法可借助软件加必需的通用硬件平台的方式来实现，当然也可以通过硬件，但很多情况下前者是更佳的实施方式。基于这样的理解，本公开的技术方案本质上或者说对一些情况做出贡献的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质(如ROM/RAM、磁碟、光盘)中，包括若干指令用以使得一台系统设备(可以是手机，计算机，服务器，空调器，或者网络设备等)执行本公开各个实施例所述的方法。
本公开在接收到告警信息时，先判断该告警信息是否能自动消除，若能，则确定对应的抑制时间，并抑制该告警信息，以供告警信息自动消除，若在抑制时间内告警信息无法自动消除，则将告警信息对应的工单发送给运维人员对应的设备，实现告警信息的自适应派单。
本公开的技术方案，当接收到告警信息时，确定所述告警信息是否为可自动消除的告警信息；若是，则确定所述告警信息对应的抑制时间；基于所述抑制时间，对所述告警信息进行抑制，并确定所述告警信息在所述抑制时间内是否消除；若否，则将所述告警信息对应的工单发送至运维人员对应的设备。本公开在接收到告警信息时，先判断该告警信息是否能自动消除，若能，则确定对应的抑制时间，并抑制该告警信息，以供告警信息自动 消除，若在抑制时间内告警信息无法自动消除，则将告警信息对应的工单发送给运维人员对应的设备，实现告警信息的自适应派单。
以上仅为本公开的优选实施例，并非因此限制本公开的专利范围，凡是利用本公开说明书及附图内容所作的等效结构或等效流程变换，或直接或间接运用在其它相关的技术领域，均同理包括在本公开的专利保护范围内。

Claims (10)

  1. 一种告警派单方法，其中，所述告警派单方法包括以下步骤：
    当接收到告警信息时，确定所述告警信息是否为可自动消除的告警信息；
    若是，则确定所述告警信息对应的抑制时间；
    基于所述抑制时间，对所述告警信息进行抑制，并确定所述告警信息在所述抑制时间内是否消除；
    若否，则将所述告警信息对应的工单发送至运维人员对应的设备。
  2. 如权利要求1所述的告警派单方法，其中，所述当接收到告警信息时，确定所述告警信息是否为可自动消除的告警信息的步骤包括：
    当接收到告警信息时，对所述告警信息进行预处理，得到待分类告警信息；
    将所述待分类告警信息输入分类模型中，生成对应的标签信息；
    根据所述标签信息，确定所述告警信息是否为可自动消除的告警信息。
  3. 如权利要求2所述的告警派单方法，其中，所述当接收到告警信息时，确定所述告警信息是否为可自动消除的告警信息的步骤之前，所述方法还包括：
    采集多个不同的告警信息，将各个告警信息进行预处理，得到多个不同的待分类告警信息；
    基于所述待分类告警信息，构建用于训练待训练分类模型的训练集；
    获取各个待分类告警信息对应标注的标签信息；
    将所述训练集中的待分类告警信息作为所述待训练分类模型的输入，将对应标注的标签信息作为所述待训练分类模型的输出，训练得到所述分类模型。
  4. 如权利要求1所述的告警派单方法，其中，所述若是，则确定所述告警信息对应的抑制时间的步骤包括：
    若是，则将所述告警信息输入预先训练好的生命周期预测模型中，生成对应的告警消除时间；
    基于所述告警消除时间和所述告警信息对应的告警时间，计算所述告警信息的生命周期；
    确定所述生命周期是否超过预设生命周期；
    若否，则基于所述生命周期，确定所述告警信息对应的抑制时间。
  5. 如权利要求4所述的告警派单方法，其中，所述若是，则将所述告警信息输入预先训练好的生命周期预测模型中，生成对应的告警消除时间的步骤包括：
    若是，则获取所述告警信息对应的属性信息；
    基于所述属性信息，通过所述生命周期预测模型，计算所述告警信息对应的告警消除时间。
  6. 如权利要求4所述的告警派单方法，其中，所述确定所述生命周期是否超过预设生命周期的步骤之后，所述方法还包括：
    若所述生命周期超过预设生命周期，则确定所述告警信息对应的抑制时间为0。
  7. 如权利要求1-6任一项所述的告警派单方法，其中，所述当接收到告警信息时，确定所述告警信息是否为可自动消除的告警信息的步骤之后，所述方法还包括：
    若所述告警信息为不可自动消除的告警信息，则将所述告警信息对应的工单发送至运维人员对应的设备。
  8. 一种告警派单装置，其中，所述告警派单装置包括：
    判断模块，用于当接收到告警信息时，确定所述告警信息是否为可自动消除的告警信息；
    确定模块，用于若是，则确定所述告警信息对应的抑制时间；
    抑制模块，用于基于所述抑制时间，对所述告警信息进行抑制，并确定所述告警信息在所述抑制时间内是否消除；
    发送模块，用于若否，则将所述告警信息对应的工单发送至运维人员对应的设备。
  9. 一种告警派单系统，其中，所述告警派单系统包括：存储器、处理器及存储在所述存储器上并可在所述处理器上运行的告警派单程序；所述告警派单程序被所述处理器执行时实现如权利要求1-7中任一项所述的告警派单方法的步骤。
  10. 一种计算机可读存储介质，其中，所述计算机可读存储介质上存储有告警派单程序，所述告警派单程序被处理器执行时实现如权利要求1-7中任一项所述的告警派单方法的步骤。
PCT/CN2019/120611 2018-12-26 2019-11-25 告警派单方法、装置、系统及计算机可读存储介质 WO2020134783A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201811609417.2A CN111369094A (zh) 2018-12-26 2018-12-26 告警派单方法、装置、系统及计算机可读存储介质
CN201811609417.2 2018-12-26

Publications (1)

Publication Number Publication Date
WO2020134783A1 true WO2020134783A1 (zh) 2020-07-02

Family

ID=71128319

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/120611 WO2020134783A1 (zh) 2018-12-26 2019-11-25 告警派单方法、装置、系统及计算机可读存储介质

Country Status (2)

Country Link
CN (1) CN111369094A (zh)
WO (1) WO2020134783A1 (zh)

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112699681A (zh) * 2020-12-17 2021-04-23 国网冀北电力有限公司信息通信分公司 基于知识图谱的电力通信系统缺陷故障派单方法及装置
WO2022170922A1 (zh) * 2021-02-09 2022-08-18 华为技术有限公司 一种网络问题处理方法、设备及系统
CN114978865A (zh) * 2022-05-19 2022-08-30 中国联合网络通信集团有限公司 基于itsm故障服务的智能派单方法、设备及介质
CN115834221A (zh) * 2022-11-28 2023-03-21 国网山东省电力公司信息通信公司 一种网络安全智能分析方法、系统、设备和存储介质

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112200603A (zh) * 2020-09-25 2021-01-08 微梦创科网络科技（中国）有限公司 一种用于社交广告投放的报警方法及系统
CN112966838B (zh) * 2021-03-03 2024-02-20 中国联合网络通信集团有限公司 灾害智能运维派单方法、装置及设备
CN113657627B (zh) * 2021-08-17 2024-01-12 国网江苏省电力有限公司信息通信分公司 电力通信网中缺陷单生成方法和系统

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106330490A (zh) * 2015-06-19 2017-01-11 中兴通讯股份有限公司 告警的方法及装置
CN106936621A (zh) * 2015-12-31 2017-07-07 中国移动通信集团广东有限公司 一种工单风暴控制方法、装置及系统
KR101808993B1 (ko) * 2017-10-24 2017-12-13 박상수 메시지 우선 발송을 위한 메시지 발송 시스템 및 방법

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6317058B1 (en) * 1999-09-15 2001-11-13 Jerome H. Lemelson Intelligent traffic control and warning system and method
CN101222742B (zh) * 2007-11-22 2010-12-01 中国移动通信集团山东有限公司 移动通信网管系统中告警自定位和自处理的方法及系统
CN101917297B (zh) * 2010-08-30 2012-06-13 烽火通信科技股份有限公司 基于贝叶斯网络的核心网故障诊断方法及系统
CN105868876A (zh) * 2015-01-21 2016-08-17 国家电网公司 一种基于过程监视的集中运维故障闭环处理方法

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106330490A (zh) * 2015-06-19 2017-01-11 中兴通讯股份有限公司 告警的方法及装置
CN106936621A (zh) * 2015-12-31 2017-07-07 中国移动通信集团广东有限公司 一种工单风暴控制方法、装置及系统
KR101808993B1 (ko) * 2017-10-24 2017-12-13 박상수 메시지 우선 발송을 위한 메시지 발송 시스템 및 방법

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112699681A (zh) * 2020-12-17 2021-04-23 国网冀北电力有限公司信息通信分公司 基于知识图谱的电力通信系统缺陷故障派单方法及装置
WO2022170922A1 (zh) * 2021-02-09 2022-08-18 华为技术有限公司 一种网络问题处理方法、设备及系统
CN114978865A (zh) * 2022-05-19 2022-08-30 中国联合网络通信集团有限公司 基于itsm故障服务的智能派单方法、设备及介质
CN114978865B (zh) * 2022-05-19 2023-07-18 中国联合网络通信集团有限公司 基于itsm故障服务的智能派单方法、设备及介质
CN115834221A (zh) * 2022-11-28 2023-03-21 国网山东省电力公司信息通信公司 一种网络安全智能分析方法、系统、设备和存储介质

Also Published As

Publication number Publication date
CN111369094A (zh) 2020-07-03

Similar Documents

Publication Publication Date Title
WO2020134783A1 (zh) 告警派单方法、装置、系统及计算机可读存储介质
WO2021057576A1 (zh) 一种构造云化网络告警根因关系树模型方法、装置和存储介质
US20200125465A1 (en) Automatic prediction system for server failure and method of automatically predicting server failure
CN110929648A (zh) 监控数据处理方法、装置、计算机设备以及存储介质
CN110428018A (zh) 一种全链路监控系统中的异常预测方法及装置
CN107423205B (zh) 一种用于数据防泄漏系统的系统故障预警方法及系统
CN103744977A (zh) 一种云计算系统平台中的监控方法及系统
CN108989075A (zh) 一种网络故障定位方法及系统
CN110942086A (zh) 数据预测优化方法、装置、设备及可读存储介质
CN111290913A (zh) 一种基于运维数据预测的故障定位可视化系统和方法
CN110891283A (zh) 一种基于边缘计算模型的小基站监控装置及方法
TWI684139B (zh) 基於自動學習的基地台異常之預測的系統與方法
JPH07183948A (ja) 通信システムで生じる事象を予測する規則を生成するデータの処理方法
US20220131766A1 (en) Cognitive model determining alerts generated in a system
CN107657369A (zh) 一种基于智能事件分类进行防汛应急响应识别的方法
CN103281461A (zh) 一种呼叫中心监控方法、装置与系统
CN110460454A (zh) 基于深度学习的网络设备端口故障智能预测方法及原理
CN113900844A (zh) 一种基于服务码级别的故障根因定位方法、系统及存储介质
CN111200530A (zh) 一种基于kpi指标进行根因分析的方法及装置
WO2020110131A1 (en) Method and crew allocation system for allocating a field technician for executing a work order
CN114707401A (zh) 信号系统设备的故障预警方法及装置
CN109635997A (zh) 一种设备维护保养时机的预测方法和系统
CN115909692A (zh) 一种高速公路报警事件的管理方法、平台、设备和介质
KR20210147594A (ko) 에너지 데이터 수집 및 관리에 최적화 기능을 제공하는 엣지 컴퓨팅 장치의 통신시스템 및 데이터베이스 운영방법
CN110458719A (zh) 一种用于电网企业的电网调度方法及系统

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19904787

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205A DATED 16/11/2021)

122 Ep: pct application non-entry in european phase

Ref document number: 19904787

Country of ref document: EP

Kind code of ref document: A1