WO2021082697A1 - 基于批量告警事件的定位方法、装置、电子设备及介质 - Google Patents

基于批量告警事件的定位方法、装置、电子设备及介质 Download PDF

Info

Publication number
WO2021082697A1
WO2021082697A1 PCT/CN2020/111916 CN2020111916W WO2021082697A1 WO 2021082697 A1 WO2021082697 A1 WO 2021082697A1 CN 2020111916 W CN2020111916 W CN 2020111916W WO 2021082697 A1 WO2021082697 A1 WO 2021082697A1
Authority
WO
WIPO (PCT)
Prior art keywords
alarm
event
target
events
monitoring dimension
Prior art date
Application number
PCT/CN2020/111916
Other languages
English (en)
French (fr)
Inventor
高盛远
Original Assignee
平安科技（深圳）有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 平安科技（深圳）有限公司 filed Critical 平安科技（深圳）有限公司
Publication of WO2021082697A1 publication Critical patent/WO2021082697A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/06—Management of faults, events, alarms or notifications
    • H04L41/0677—Localisation of faults
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/06—Management of faults, events, alarms or notifications
    • H04L41/0604—Management of faults, events, alarms or notifications using filtering, e.g. reduction of information by using priority, element types, position or time
    • H04L41/0622—Management of faults, events, alarms or notifications using filtering, e.g. reduction of information by using priority, element types, position or time based on time
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/06—Management of faults, events, alarms or notifications
    • H04L41/0631—Management of faults, events, alarms or notifications using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/06—Management of faults, events, alarms or notifications
    • H04L41/0631—Management of faults, events, alarms or notifications using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
    • H04L41/064—Management of faults, events, alarms or notifications using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis involving time analysis
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/06—Management of faults, events, alarms or notifications
    • H04L41/0631—Management of faults, events, alarms or notifications using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
    • H04L41/065—Management of faults, events, alarms or notifications using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis involving logical or physical relationship, e.g. grouping and hierarchies

Definitions

  • This application relates to the technical field of operation and maintenance monitoring, and in particular to a positioning method, device, electronic equipment, and media based on batch alarm events.
  • the inventor realizes that in the existing alarm positioning solution, the alarm information is directly analyzed from the time dimension. Because the monitoring system often generates noise during operation, the obtained alarm information will also be mixed with a large amount of noise information. At the same time, there is a certain delay between the occurrence time of the event and the alarm time, which leads to inaccurate alarm positioning. At the same time, there is no analysis and processing of redundant alarms caused by user operations, resulting in poor accuracy of alarm positioning.
  • the first aspect of the present application provides a method for locating based on batch alarm events, and the method for locating based on batch alarm events includes:
  • a second aspect of the present application provides an electronic device including a processor and a memory, and the processor is configured to execute computer-readable instructions stored in the memory to implement the following steps:
  • a third aspect of the present application provides a computer-readable storage medium having at least one computer-readable instruction stored thereon, and the at least one computer-readable instruction is executed by a processor to implement the following steps:
  • a fourth aspect of the present application provides a positioning device based on batch alarm events, and the positioning device based on batch alarm events includes:
  • the obtaining unit is configured to obtain at least one piece of alarm information to be processed when an alarm positioning instruction is received;
  • a judging unit configured to judge whether the at least one piece of alarm information satisfies the batch alarm condition
  • the obtaining unit is further configured to obtain all events within the first preset time when it is determined that the at least one piece of alarm information satisfies the batch alarm condition;
  • the processing unit is used to perform nested processing on all the events to obtain a two-dimensional nested dictionary
  • the deleting unit is used to delete the alarm information containing the configuration operation to obtain at least one target alarm;
  • the obtaining unit is further configured to obtain the event corresponding to each target alarm from the two-dimensional nested dictionary by using a loop traversal method to obtain the first event of each target alarm;
  • the aggregation unit is configured to categorize and aggregate the first event of the at least one target alarm based on the monitoring dimension to obtain the second event of the at least one monitoring dimension;
  • the calculation unit is used to calculate the proportion of the second event of each monitoring dimension in all the events, and obtain the proportion result of each monitoring dimension;
  • the determining unit is used to determine the monitoring dimension corresponding to the largest proportion result as the root cause of the alarm.
  • this application can obtain at least one piece of alarm information to be processed when an alarm location instruction is received, determine whether the at least one piece of alarm information meets the batch alarm condition, and when it is determined that the at least one piece of alarm information meets When the batch alarm condition is used, all events within the first preset time are acquired, all the events are nested to obtain a two-dimensional nested dictionary, the alarm information containing the configuration operation is deleted, and at least one target alarm is obtained.
  • the loop traversal method obtains the event corresponding to each target alarm from the two-dimensional nested dictionary, obtains the first event of each target alarm, and classifies and aggregates the first event of the at least one target alarm based on the monitoring dimension , Get the second event of at least one monitoring dimension, calculate the proportion of the second event of each monitoring dimension in all the events, obtain the proportion result of each monitoring dimension, and assign the largest proportion result to the monitoring dimension Determined as the root cause of the alarm, when the at least one piece of alarm information meets the batch alarm condition, the processed target alarm can be processed in the monitoring dimension, so as to avoid the interference caused by the delay of the alarm time. Redundant alarms caused by user operations are filtered, thereby improving the accuracy of locating the root cause of alarms.
  • This application is applied to the operation and maintenance monitoring of smart cities and promotes the construction of smart cities.
  • Fig. 1 is a flowchart of a preferred embodiment of a method for positioning based on batch alarm events according to the present application.
  • Fig. 2 is a functional module diagram of a preferred embodiment of a positioning device based on batch alarm events according to the present application.
  • Fig. 3 is a schematic structural diagram of an electronic device according to a preferred embodiment of a method for locating based on batch alarm events according to the present application.
  • FIG. 1 it is a flowchart of a preferred embodiment of the method for locating batch alarm events based on the present application. According to different needs, the order of the steps in the flowchart can be changed, and some steps can be omitted.
  • the positioning method based on batch alarm events is applied to one or more electronic devices.
  • the electronic device is a device that can automatically perform numerical calculation and/or information processing in accordance with pre-set or stored instructions, and its hardware Including but not limited to microprocessors, application specific integrated circuits (ASIC), programmable gate arrays (Field-Programmable Gate Array, FPGA), digital processors (Digital Signal Processor, DSP), embedded devices, etc.
  • ASIC application specific integrated circuits
  • FPGA Field-Programmable Gate Array
  • DSP Digital Signal Processor
  • the electronic device may be any electronic product that can interact with a user with a human machine, for example, a personal computer, a tablet computer, a smart phone, a personal digital assistant (PDA), a game console, an interactive network television ( Internet Protocol Television, IPTV), smart wearable devices, etc.
  • a personal computer for example, a personal computer, a tablet computer, a smart phone, a personal digital assistant (PDA), a game console, an interactive network television ( Internet Protocol Television, IPTV), smart wearable devices, etc.
  • PDA personal digital assistant
  • IPTV Internet Protocol Television
  • smart wearable devices etc.
  • the electronic device may also include a network device and/or user equipment.
  • the network device includes, but is not limited to, a single network server, a server group composed of multiple network servers, or a cloud composed of a large number of hosts or network servers based on cloud computing.
  • the network where the electronic device is located includes, but is not limited to, the Internet, a wide area network, a metropolitan area network, a local area network, a virtual private network (Virtual Private Network, VPN), etc.
  • the alarm location instruction may be triggered by the user, or may be automatically triggered when certain conditions are met, which is not limited in the present application.
  • meeting certain conditions includes, but is not limited to: meeting configuration time, etc.
  • the configuration time may include a determined time point (for example, the configuration time may be seven o'clock in the morning every day), or include a time period, etc.
  • the at least one piece of alarm information is issued by a monitoring system, and the at least one piece of alarm information may include, but is not limited to: alarm time, alarm log, and the like.
  • the monitoring system is a system that communicates with electronic equipment.
  • the monitoring system mainly monitors the server or the electronic equipment. When the server or the electronic equipment fails, the monitoring system can generate an alarm according to the failure. information.
  • S11 Determine whether the at least one piece of alarm information satisfies a batch alarm condition.
  • the batch alarm condition means that the number of alarm information in any type reaches the configured number within a certain period of time.
  • the electronic device determining whether the at least one piece of alarm information satisfies a batch alarm condition includes:
  • the electronic device detects the type of each piece of alarm information, classifies the alarm information of the same type, and obtains at least one type of alarm information. Further, the electronic device calculates the first type of alarm information in each type. When detecting that the first number of alarm information in any type is greater than or equal to the configured number, the electronic device determines that the at least one piece of alarm information satisfies the batch alarm condition.
  • the value of the number of configurations can be customized, which is not limited in this application.
  • the all events refer to events monitored by the monitoring system within the first preset time.
  • the electronic device acquiring all events within the first preset time includes:
  • the electronic device obtains the alarm time of each piece of alarm information from the at least one piece of alarm information, determines the target time period of the at least one piece of alarm information according to the alarm time, and intercepts any time period from the target time period As the first preset time, further, the electronic device uses a web crawler technology to obtain all events within the first preset time.
  • the selection of the arbitrary time period is not limited in this application.
  • the at least one piece of alarm information contains alarm information A, alarm information B, and alarm information C
  • the electronic device obtains the alarm information A from the at least one piece of alarm information at 8:00, so The alarm time of the alarm information B is 9:00, and the alarm time of the alarm information C is 10:00.
  • the electronic device determines that the target time period of the at least one piece of alarm information is based on the alarm time 8:00-10:00, the electronic device intercepts 8:30-9:30 from the target time period as the first preset time, and further, the electronic device uses web crawler technology from the monitoring Obtain all events that occurred within 8:30-9:30 in the system.
  • the two-dimensional nested dictionary contains specific information of all the events, and the specific information is composed of the target subject, target time, and target information of each event.
  • the electronic device performs nesting processing on all the events to obtain a two-dimensional nested dictionary including:
  • the electronic device uses a machine learning method to extract the target subject and target time of each event from all the events. Further, the electronic device determines each target subject as the outer label of each event and assigns each target subject to the outer label of each event. The target time is determined as the inner label of each event, each target information corresponding to each event is obtained from all the events, and each target information is determined as the characteristic value of each event. Layer labels, inner layer labels and feature values to generate the two-dimensional nested dictionary.
  • the electronic device uses a machine learning method to extract the target theme and target time of each event from all the events including:
  • the electronic device obtains a first training set, builds a first network of the target subject by training the first training set, and adjusts the first network using a first learning rate to obtain a first model of the target subject
  • the electronic device inputs each event into the first model to obtain the target theme of each event.
  • the electronic device obtains a second training set, and constructs all the events by training the second training set.
  • the second network of the target time adopts a second learning rate to adjust the second network to obtain a second model of the target time, and the electronic device inputs each event into the second model to obtain each event The target time of the event.
  • the first training set includes the target theme of the event
  • the second training set includes the target time of the event
  • the values of the first learning rate and the second learning rate can be customized, which is not limited in this application.
  • the electronic device may also use other algorithms, which is not limited in this application.
  • the two-dimensional nested dictionary is generated so that all the events have a unified format. Therefore, the positioning method based on batch alarm events is suitable for various monitoring systems (such as the Argus monitoring system).
  • the configuration operation refers to an operation caused by a user's improper operation, for example, an operation in which the device automatically deletes document information when the user is shutting down.
  • deleting the alarm information containing the configuration operation by the electronic device and obtaining at least one target alarm includes:
  • the electronic device obtains a first log from the at least one piece of alarm information, detects whether the configuration operation is contained in the first log, and further, the electronic device deletes the alarm information containing the configuration operation to obtain all State at least one target alarm.
  • S15 Obtain the event corresponding to each target alarm from the two-dimensional nested dictionary by using a loop traversal method, and obtain the first event of each target alarm.
  • the first event is an event corresponding to the at least one target alarm.
  • the target alarm refers to alarm information that does not contain the configuration operation.
  • the electronic device uses a loop traversal method to obtain the event corresponding to each target alarm from the two-dimensional nested dictionary, and obtaining the first event of each target alarm includes:
  • the electronic device obtains the first topic of each target alarm and all the outer labels in the two-dimensional nested dictionary by using a loop traversal method, and matches each first topic with all the outer labels, and further The electronic device determines the event corresponding to the successfully matched outer label as the first event of the target alarm.
  • the target alarm is target alarm D
  • the electronic device uses a loop traversal method to obtain the first subject of the target alarm D as subject A, and at the same time obtains all outer labels in the two-dimensional nested dictionary They are label A, label B, label C, and label D. Further, the electronic device matches the subject A with all outer labels to obtain a match between the subject A and the label A. The electronic device determines the event corresponding to the tag A in the two-dimensional nested dictionary as the first event of the target alarm D.
  • S16 Based on the monitoring dimension, classify and aggregate the first event of the at least one target alarm to obtain a second event of at least one monitoring dimension.
  • the second event is a set of first events belonging to the same monitoring dimension.
  • the target alarms are respectively target alarm E, target alarm F, and target alarm G
  • the first event of the target alarm E includes event 1, event 2 and event 3, and the first event of the target alarm F
  • the first event of the target alarm G is event 6.
  • the event 1, the event 2, the event 3, the event 4, the event 5 and all The event 6 is classified and aggregated, and the second event of the physical machine monitoring dimension is the event 1, the event 2 and the event 3, and the second event of the storage monitoring dimension is the event 4 and the event 5. And said event 6.
  • the electronic device categorizes and aggregates the first event of the at least one target alarm based on the monitoring dimension, and obtaining the second event of the at least one monitoring dimension includes:
  • the electronic device obtains the alarm log of each target alarm, uses a Chinese keyword extraction algorithm based on high-dimensional clustering technology to extract the first information from the alarm log, and determines the monitoring of each first event according to the first information Further, the electronic device uses a classification algorithm to classify and aggregate the first events with the same monitoring dimension to obtain the second event of the at least one monitoring dimension.
  • the monitoring dimension of each first event can be accurately obtained, and because the classification algorithm is adopted, first events with the same monitoring dimension can be classified into the same monitoring dimension.
  • the electronic device using a Chinese keyword extraction algorithm based on high-dimensional clustering technology to extract the first information from the alarm log includes:
  • the electronic device performs rapid word segmentation on the alarm log according to a pre-configured target dictionary to obtain the first word segmentation, counts the target word frequency of the first word segmentation, and determines the first word segmentation whose target word frequency is greater than the preset word frequency as the initial word segmentation Keywords: the electronic device trims the initial keywords according to a preset small dictionary to obtain final keywords, and determines the final keywords as the first information.
  • the target dictionary may include common keywords.
  • the small dictionary may include, but is not limited to function words, stop words, etc.
  • the first information can be accurately and quickly determined by trimming the initial keywords.
  • S17 Calculate the proportion of the second event of each monitoring dimension in all the events, and obtain the proportion result of each monitoring dimension.
  • the percentage result refers to the ratio of the number of the second events to the total number of all events.
  • the electronic device calculates the proportion of the second event of each monitoring dimension in all the events, and obtaining the proportion result of each monitoring dimension includes:
  • the electronic device obtains the total number of all events according to the two-dimensional nested dictionary. Further, the electronic device determines the target number of the corresponding second event in each monitoring dimension, and divides each target number by According to the total quantity, the result of the proportion of each monitoring dimension is obtained.
  • the total number of all events obtained from the two-dimensional nested dictionary is 1000
  • the electronic device determines that the target number of the second event corresponding to the physical machine monitoring dimension is 800
  • the storage monitoring The target number of the second event corresponding to the dimension is 100.
  • the electronic device divides each target number by the total number to obtain a result that the proportion of the physical machine monitoring dimension is four-fifths.
  • the storage monitoring The proportion of dimensions is one-tenth.
  • the proportion result of each monitoring dimension can be accurately obtained, which provides a basis for subsequent determination of the root cause of the alarm.
  • the alarm root cause refers to a specific alarm root cause.
  • the electronic device determining the monitoring dimension corresponding to the largest proportion result as the root cause of the alarm includes:
  • the electronic device When detecting the proportion result of each monitoring dimension, the electronic device obtains the size comparison program, and inputs the proportion result of each monitoring dimension into the size comparison program to obtain the largest proportion result. Further, The electronic device determines the monitoring dimension corresponding to the largest proportion result as the root cause of the alarm.
  • the method further includes:
  • the electronic device obtains a solution corresponding to the root cause of the alarm from the configuration scheme library, and generates prompt information according to the root cause of the alarm and the solution. Further, the electronic device uses encryption technology to The prompt information is encrypted to obtain the target ciphertext, and the target ciphertext is sent to the terminal device of the designated person. When it is detected that the target ciphertext is successfully decrypted, the prompt information is displayed.
  • At least one alarm root cause and a corresponding solution are stored in the configuration scheme library.
  • the prompt information may include, but is not limited to: root cause of the alarm, solution, alarm time, etc.
  • the designated person may be the person in charge of the monitoring system.
  • the prompt information is encrypted, which can prevent the alarm root cause and solution in the prompt information from being tampered with at will, improve the security of the prompt information, and can also promptly obtain the root cause of the alarm. Remind the designated person to check.
  • this application can obtain at least one piece of alarm information to be processed when an alarm location instruction is received, determine whether the at least one piece of alarm information meets the batch alarm condition, and when it is determined that the at least one piece of alarm information satisfies
  • the batch alarm condition is used, all events within the first preset time are acquired, all the events are nested to obtain a two-dimensional nested dictionary, the alarm information containing the configuration operation is deleted, and at least one target alarm is obtained.
  • the loop traversal method obtains the event corresponding to each target alarm from the two-dimensional nested dictionary, obtains the first event of each target alarm, and classifies and aggregates the first event of the at least one target alarm based on the monitoring dimension , Get the second event of at least one monitoring dimension, calculate the proportion of the second event of each monitoring dimension in all the events, obtain the proportion result of each monitoring dimension, and assign the largest proportion result to the monitoring dimension Determined as the root cause of the alarm, when the at least one piece of alarm information meets the batch alarm condition, the processed target alarm can be processed in the monitoring dimension, so as to avoid the interference caused by the delay of the alarm time. Redundant alarms caused by user operations are filtered, thereby improving the accuracy of locating the root cause of alarms.
  • FIG. 2 it is a functional module diagram of a preferred embodiment of a positioning device based on batch alarm events of the present application.
  • the positioning device 11 based on batch alarm events includes an acquisition unit 110, a judgment unit 111, a processing unit 112, a deletion unit 113, an aggregation unit 114, a calculation unit 115, a determination unit 116, a generation unit 117, an encryption unit 118, and a sending unit 119.
  • the display unit 120 The module/unit referred to in this application refers to a series of computer program segments that can be executed by the processor 13 and can complete fixed functions, and are stored in the memory 12. In this embodiment, the functions of each module/unit will be described in detail in subsequent embodiments.
  • the obtaining unit 110 obtains at least one piece of alarm information to be processed.
  • the alarm location instruction may be triggered by the user, or may be automatically triggered when certain conditions are met, which is not limited in the present application.
  • meeting certain conditions includes, but is not limited to: meeting configuration time, etc.
  • the configuration time may include a determined time point (for example, the configuration time may be seven o'clock in the morning every day), or include a time period, etc.
  • the at least one piece of alarm information is issued by a monitoring system, and the at least one piece of alarm information may include, but is not limited to: alarm time, alarm log, and the like.
  • the monitoring system is a system that communicates with electronic equipment.
  • the monitoring system mainly monitors the server or the electronic equipment. When the server or the electronic equipment fails, the monitoring system can generate an alarm according to the failure. information.
  • the judging unit 111 judges whether the at least one piece of alarm information meets the batch alarm condition.
  • the batch alarm condition means that the number of alarm information in any type reaches the configured number within a certain period of time.
  • the judging unit 111 judging whether the at least one piece of alarm information satisfies a batch alarm condition includes:
  • the judging unit 111 detects the type of each piece of alarm information, classifies the alarm information of the same type, and obtains at least one type of alarm information. Further, the judging unit 111 calculates the value of the alarm information in each type. The first quantity, when it is detected that the first quantity of alarm information in any type is greater than or equal to the configured number, the judgment unit 111 determines that the at least one piece of alarm information satisfies the batch alarm condition.
  • the value of the number of configurations can be customized, which is not limited in this application.
  • the obtaining unit 110 obtains all events within the first preset time.
  • the all events refer to events monitored by the monitoring system within the first preset time.
  • the acquiring unit 110 acquiring all events within the first preset time includes:
  • the obtaining unit 110 obtains the alarm time of each piece of alarm information from the at least one piece of alarm information, determines the target time period of the at least one piece of alarm information according to the alarm time, and intercepts any time from the target time period A segment is used as the first preset time, and further, the obtaining unit 110 uses a web crawler technology to obtain all events within the first preset time.
  • the selection of the arbitrary time period is not limited in this application.
  • the at least one piece of alarm information contains alarm information A, alarm information B, and alarm information C
  • the obtaining unit 110 obtains the alarm time of the alarm information A from the at least one piece of alarm information at 8:00
  • the alarm time of the alarm information B is 9:00
  • the alarm time of the alarm information C is 10:00.
  • the acquiring unit 110 determines the target time of the at least one piece of alarm information according to the alarm time The segment is 8:00-10:00
  • the acquisition unit 110 intercepts 8:30-9:30 from the target time period as the first preset time
  • the acquisition unit 110 uses web crawling technology Obtain all events that occurred within 8:30-9:30 from the monitoring system.
  • the processing unit 112 performs nesting processing on all the events to obtain a two-dimensional nested dictionary.
  • the two-dimensional nested dictionary contains specific information of all the events, and the specific information is composed of the target subject, target time, and target information of each event.
  • the processing unit 112 performs nesting processing on all the events to obtain a two-dimensional nested dictionary including:
  • the processing unit 112 uses a machine learning method to extract the target theme and target time of each event from all the events. Further, the processing unit 112 determines each target theme as the outer label of each event and the target time. Each target time is determined as the inner label of each event, each target information corresponding to each event is obtained from all the events, and each target information is determined as the characteristic value of each event, according to each event. The outer label, inner label and feature value of, generate the two-dimensional nested dictionary.
  • the processing unit 112 uses a machine learning method to extract the target theme and target time of each event from all the events, including:
  • the processing unit 112 obtains the first training set, builds the first network of the target subject by training the first training set, adjusts the first network using the first learning rate, and obtains the first network of the target subject Model, the processing unit 112 inputs each event into the first model to obtain the target theme of each event. Further, the processing unit 112 obtains a second training set, and trains the second training set , Construct a second network of the target time, adjust the second network with a second learning rate to obtain a second model of the target time, and the processing unit 112 inputs each event into the second model , Get the target time of each event.
  • the first training set includes the target theme of the event
  • the second training set includes the target time of the event
  • the values of the first learning rate and the second learning rate can be customized, which is not limited in this application.
  • processing unit 112 may also use other algorithms, which are not limited in this application.
  • the two-dimensional nested dictionary is generated so that all the events have a unified format. Therefore, the positioning method based on batch alarm events is suitable for various monitoring systems (such as the Argus monitoring system).
  • the deleting unit 113 deletes the alarm information containing the configuration operation, and obtains at least one target alarm.
  • the configuration operation refers to an operation caused by a user's improper operation, for example, an operation in which the device automatically deletes document information when the user is shutting down.
  • the deleting unit 113 deletes the alarm information containing the configuration operation, and obtaining at least one target alarm includes:
  • the deleting unit 113 obtains the first log from the at least one piece of alarm information, and detects whether the configuration operation is contained in the first log. Further, the deleting unit 113 deletes the alarm information containing the configuration operation, Obtain the at least one target alarm.
  • the obtaining unit 110 obtains the event corresponding to each target alarm from the two-dimensional nested dictionary using a loop traversal method, and obtains the first event of each target alarm.
  • the first event is an event corresponding to the at least one target alarm.
  • the target alarm refers to alarm information that does not contain the configuration operation.
  • the obtaining unit 110 uses a loop traversal method to obtain the event corresponding to each target alarm from the two-dimensional nested dictionary, and obtaining the first event of each target alarm includes:
  • the obtaining unit 110 obtains the first topic of each target alarm and all outer tags in the two-dimensional nested dictionary by using a loop traversal method, and matches each first topic with all the outer tags, and further Specifically, the acquiring unit 110 determines the event corresponding to the successfully matched outer label as the first event of the target alarm.
  • the target alarm is the target alarm D
  • the obtaining unit 110 uses a loop traversal method to obtain the first subject of the target alarm D as the subject A, and at the same time obtains all the outer layers in the two-dimensional nested dictionary
  • the tags are respectively Tag A, Tag B, Tag C, and Tag D.
  • the acquiring unit 110 matches the subject A with all the outer tags to obtain a match between the subject A and the label A, The acquiring unit 110 determines the event corresponding to the tag A in the two-dimensional nested dictionary as the first event of the target alarm D.
  • the aggregation unit 114 categorizes and aggregates the first event of the at least one target alarm based on the monitoring dimension to obtain the second event of at least one monitoring dimension.
  • the second event is a set of first events belonging to the same monitoring dimension.
  • the target alarms are respectively target alarm E, target alarm F, and target alarm G
  • the first event of the target alarm E includes event 1, event 2 and event 3, and the first event of the target alarm F
  • the first event of the target alarm G is event 6.
  • the event 1, the event 2, the event 3, the event 4, the event 5 and all The event 6 is classified and aggregated, and the second event of the physical machine monitoring dimension is the event 1, the event 2 and the event 3, and the second event of the storage monitoring dimension is the event 4 and the event 5. And said event 6.
  • the aggregation unit 114 categorizes and aggregates the first event of the at least one target alarm based on the monitoring dimension, and obtaining the second event of the at least one monitoring dimension includes:
  • the aggregating unit 114 obtains the alarm log of each target alarm, uses a Chinese keyword extraction algorithm based on high-dimensional clustering technology to extract the first information from the alarm log, and determines the information of each first event according to the first information.
  • the monitoring dimension further, the aggregation unit 114 uses a classification algorithm to classify and aggregate the first events with the same monitoring dimension to obtain the second event of the at least one monitoring dimension.
  • the monitoring dimension of each first event can be accurately obtained, and because the classification algorithm is adopted, first events with the same monitoring dimension can be classified into the same monitoring dimension.
  • the aggregating unit 114 adopting a Chinese keyword extraction algorithm based on high-dimensional clustering technology to extract the first information from the alarm log includes:
  • the aggregation unit 114 performs rapid word segmentation on the alarm log according to a pre-configured target dictionary to obtain a first word segmentation, counts the target word frequency of the first word segmentation, and determines the first word segmentation whose target word frequency is greater than the preset word frequency as For initial keywords, the aggregation unit 114 trims the initial keywords according to a preset small dictionary to obtain final keywords, and determines the final keywords as the first information.
  • the target dictionary may include common keywords.
  • the small dictionary may include, but is not limited to function words, stop words, etc.
  • the first information can be accurately and quickly determined by trimming the initial keywords.
  • the calculation unit 115 calculates the proportion of the second event of each monitoring dimension in all the events, and obtains the proportion result of each monitoring dimension.
  • the percentage result refers to the ratio of the number of the second events to the total number of all events.
  • the calculation unit 115 calculates the proportion of the second event of each monitoring dimension in all the events, and obtaining the proportion result of each monitoring dimension includes:
  • the calculation unit 115 obtains the total number of all events according to the two-dimensional nested dictionary. Further, the calculation unit 115 determines the target number of the corresponding second event in each monitoring dimension, and calculates each target number Divide by the total number to obtain the proportion of each monitoring dimension.
  • the total number of all events obtained from the two-dimensional nested dictionary is 1000
  • the calculation unit 115 determines that the target number of the second event corresponding to the physical machine monitoring dimension is 800
  • the storage The target quantity of the second event corresponding to the monitoring dimension is 100
  • the calculation unit 115 divides each target quantity by the total quantity to obtain a result that the proportion of the physical machine monitoring dimension is four-fifths.
  • the storage monitoring dimension accounted for one-tenth of the result.
  • the proportion result of each monitoring dimension can be accurately obtained, which provides a basis for subsequent determination of the root cause of the alarm.
  • the determining unit 116 determines the monitoring dimension corresponding to the largest proportion result as the root cause of the alarm.
  • the alarm root cause refers to a specific alarm root cause.
  • the determining unit 116 determining the monitoring dimension corresponding to the largest proportion result as the root cause of the alarm includes:
  • the determining unit 116 obtains the size comparison program, and inputs the proportion result of each monitoring dimension into the size comparison program to obtain the largest proportion result, and further The determining unit 116 determines the monitoring dimension corresponding to the largest proportion result as the root cause of the alarm.
  • the method further includes:
  • the obtaining unit 110 obtains a solution corresponding to the root cause of the alarm from the configuration scheme database, and the generating unit 117 generates prompt information according to the root cause of the alarm and the solution.
  • the encryption unit 118 adopts encryption technology. Encrypt the prompt information to obtain the target ciphertext.
  • the sending unit 119 sends the target ciphertext to the terminal device of the designated person, and when it is detected that the target ciphertext is successfully decrypted, the display unit 120 Display the prompt information.
  • At least one alarm root cause and a corresponding solution are stored in the configuration scheme library.
  • the prompt information may include, but is not limited to: root cause of the alarm, solution, alarm time, etc.
  • the designated person may be the person in charge of the monitoring system.
  • the prompt information is encrypted, which can prevent the alarm root cause and solution in the prompt information from being tampered with at will, improve the security of the prompt information, and can also promptly obtain the root cause of the alarm. Remind the designated person to check.
  • this application can obtain at least one piece of alarm information to be processed when an alarm location instruction is received, determine whether the at least one piece of alarm information meets the batch alarm condition, and when it is determined that the at least one piece of alarm information satisfies
  • the batch alarm condition is used, all events within the first preset time are acquired, all the events are nested to obtain a two-dimensional nested dictionary, the alarm information containing the configuration operation is deleted, and at least one target alarm is obtained.
  • the loop traversal method obtains the event corresponding to each target alarm from the two-dimensional nested dictionary, obtains the first event of each target alarm, and classifies and aggregates the first event of the at least one target alarm based on the monitoring dimension , Get the second event of at least one monitoring dimension, calculate the proportion of the second event of each monitoring dimension in all the events, obtain the proportion result of each monitoring dimension, and assign the largest proportion result to the monitoring dimension Determined as the root cause of the alarm, when the at least one piece of alarm information meets the batch alarm condition, the processed target alarm can be processed in the monitoring dimension, so as to avoid the interference caused by the delay of the alarm time. Redundant alarms caused by user operations are filtered, thereby improving the accuracy of locating the root cause of alarms.
  • FIG. 3 it is a schematic structural diagram of an electronic device according to a preferred embodiment of a method for positioning based on batch alarm events according to the present application.
  • the electronic device 1 includes, but is not limited to, a memory 12, a processor 13, and a computer program stored in the memory 12 and running on the processor 13, such as Location program based on batch alarm events.
  • the schematic diagram is only an example of the electronic device 1 and does not constitute a limitation on the electronic device 1. It may include more or less components than those shown in the figure, or a combination of certain components, or different components. Components, for example, the electronic device 1 may also include an input/output device, a network access device, a bus, and the like.
  • the processor 13 may be a central processing unit (Central Processing Unit, CPU), other general-purpose processors, digital signal processors (Digital Signal Processor, DSP), application specific integrated circuits (ASIC), Field-Programmable Gate Array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc.
  • the general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc.
  • the processor 13 is the computing core and control center of the electronic device 1 and connects the entire electronic device with various interfaces and lines. Each part of 1, and executes the operating system of the electronic device 1, and various installed applications, program codes, etc.
  • the processor 13 executes the operating system of the electronic device 1 and various installed applications.
  • the processor 13 executes the application program to implement the steps in each embodiment of the positioning method based on batch alarm events, such as the steps shown in FIG. 1.
  • the computer program may be divided into one or more modules/units, and the one or more modules/units are stored in the memory 12 and executed by the processor 13 to complete this Application.
  • the one or more modules/units may be a series of computer program instruction segments capable of completing specific functions, and the instruction segments are used to describe the execution process of the computer program in the electronic device 1.
  • the computer program can be divided into an acquisition unit 110, a judgment unit 111, a processing unit 112, a deletion unit 113, an aggregation unit 114, a calculation unit 115, a determination unit 116, a generation unit 117, an encryption unit 118, a transmission unit 119, and Display unit 120.
  • the memory 12 may be used to store the computer program and/or module.
  • the processor 13 runs or executes the computer program and/or module stored in the memory 12 and calls data stored in the memory 12, The various functions of the electronic device 1 are realized.
  • the memory 12 may mainly include a storage program area and a storage data area.
  • the storage program area may store an operating system, an application program required by at least one function (such as a sound playback function, an image playback function, etc.), etc.; the storage data area may Store data (such as audio data, etc.) created based on the use of electronic devices.
  • the memory 12 may include non-volatile and volatile memory, such as a hard disk, a memory, a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a Secure Digital (SD) card, and a flash memory card ( Flash Card), at least one magnetic disk storage device, flash memory device, or other storage device.
  • non-volatile and volatile memory such as a hard disk, a memory, a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a Secure Digital (SD) card, and a flash memory card ( Flash Card), at least one magnetic disk storage device, flash memory device, or other storage device.
  • the memory 12 may be an external memory and/or an internal memory of the electronic device 1. Further, the memory 12 may be a memory in a physical form, such as a memory stick, a TF card (Trans-flash Card), and so on.
  • TF card Trans-flash Card
  • the integrated module/unit of the electronic device 1 may be stored in a computer-readable storage medium, which may be non-easy.
  • a volatile storage medium can also be a volatile storage medium.
  • the computer program includes computer-readable instruction code
  • the computer-readable instruction code may be in the form of source code, object code, executable file, or some intermediate form.
  • the computer-readable medium may include: any entity or device capable of carrying the computer program code, recording medium, U disk, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM, Read-Only Memory) , Random access memory.
  • the memory 12 in the electronic device 1 stores multiple instructions to implement a method for locating based on batch alarm events, and the processor 13 can execute the multiple instructions to implement: when an alarm is received When locating the instruction, obtain at least one piece of alarm information to be processed; determine whether the at least one piece of alarm information meets the batch alarm condition; when it is determined that the at least one piece of alarm information meets the batch alarm condition, obtain the information within the first preset time All events; nested processing of all the events to obtain a two-dimensional nested dictionary; deletes the alarm information containing configuration operations to obtain at least one target alarm; uses a loop traversal method to obtain each item from the two-dimensional nested dictionary For the event corresponding to the target alarm, the first event of each target alarm is obtained; based on the monitoring dimension, the first event of the at least one target alarm is classified and aggregated to obtain the second event of at least one monitoring dimension; and each monitoring is calculated The proportion of the second event of the dimension in all the events is obtained, and the proportion result of each monitoring dimension is
  • modules described as separate components may or may not be physically separated, and the components displayed as modules may or may not be physical units, and may be located in one place or distributed on multiple network units. Some or all of the modules can be selected according to actual needs to achieve the objectives of the solutions of the embodiments.
  • the functional modules in the various embodiments of the present application may be integrated into one processing unit, or each unit may exist alone physically, or two or more units may be integrated into one unit.
  • the above-mentioned integrated unit may be implemented in the form of hardware, or may be implemented in the form of hardware plus software functional modules.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Alarm Systems (AREA)

Abstract

本申请涉及运维监控，提供一种基于批量告警事件的定位方法、装置、电子设备及介质。该方法能够获取待处理的至少一条告警信息并判断是否满足批量告警条件，当满足批量告警条件时，获取第一预设时间内的所有事件，对所述所有事件进行嵌套处理，得到二维嵌套字典，删除含有配置操作的告警信息，得到至少一条目标告警，从二维嵌套字典中获取每条目标告警对应的事件，得到每条目标告警的第一事件，基于监控维度，对所述至少一条目标告警的第一事件进行归类聚合，得到至少一个监控维度的第二事件，计算每个监控维度的第二事件在所有事件中的占比，得到每个监控维度的占比结果，将最大的占比结果对应的监控维度确定为告警根因，通过智能决策提高告警定位的准确率。

Description

基于批量告警事件的定位方法、装置、电子设备及介质
本申请要求于2019年11月01日提交中国专利局，申请号为201911058281.5，发明名称为“基于批量告警事件的定位方法、装置、电子设备及介质”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及运维监控技术领域，尤其涉及一种基于批量告警事件的定位方法、装置、电子设备及介质。
背景技术
目前，随着互联网技术被广泛应用到各行各业中，监控系统发出告警信息的数量及类型也不断增多，每天面对着数量庞大、类型众多的告警信息，使运维工程师的压力不断增大，为了缓解运维工程师的负担，告警定位方法应运而生。
然而，发明人意识到在现有的告警定位方案中，直接从时间维度上对告警信息进行分析，由于监控系统运作时经常产生噪声，导致获取到的告警信息中也会混杂大量的噪声信息，同时，事件的发生时间及告警时间之间存在一定的延时，因此导致告警定位不够准确，同时，对因用户操作引起的冗余告警也没有分析处理，导致告警定位的准确性差。
发明内容
鉴于以上内容，有必要提出一种基于批量告警事件的定位方法、装置、电子设备及介质，不仅能够避免告警时间因延时而带来的干扰，还能够过滤因用户操作引起的冗余告警，进而提高告警根因定位的准确率。
本申请的第一方面提供一种基于批量告警事件的定位方法，所述基于批量告警事件的定位方法包括：
当接收到告警定位指令时，获取待处理的至少一条告警信息；
判断所述至少一条告警信息是否满足批量告警条件；
当确定所述至少一条告警信息满足所述批量告警条件时，获取第一预设时间内的所有事件；
对所述所有事件进行嵌套处理，得到二维嵌套字典；
删除含有配置操作的告警信息，得到至少一条目标告警；
采用循环遍历方法从所述二维嵌套字典中获取每条目标告警对应的事件，得到每条目标告警的第一事件；
基于监控维度，对所述至少一条目标告警的第一事件进行归类聚合，得到至少一个监控维度的第二事件；
计算每个监控维度的第二事件在所述所有事件中的占比，得到每个监控维度的占比结果；
将最大的占比结果对应的监控维度确定为告警根因。
本申请的第二方面提供一种电子设备，所述电子设备包括处理器和存储器，所述处理器用于执行所述存储器中存储的计算机可读指令以实现以下步骤：
当接收到告警定位指令时，获取待处理的至少一条告警信息；
判断所述至少一条告警信息是否满足批量告警条件；
当确定所述至少一条告警信息满足所述批量告警条件时，获取第一预设时间内的所有事件；
对所述所有事件进行嵌套处理，得到二维嵌套字典；
删除含有配置操作的告警信息，得到至少一条目标告警；
采用循环遍历方法从所述二维嵌套字典中获取每条目标告警对应的事件，得到每条目标告警的第一事件；
基于监控维度，对所述至少一条目标告警的第一事件进行归类聚合，得到至少一个监控维度的第二事件；
计算每个监控维度的第二事件在所述所有事件中的占比，得到每个监控维度的占比结果；
将最大的占比结果对应的监控维度确定为告警根因。
本申请的第三方面提供一种计算机可读存储介质，所述计算机可读存储介质上存储有至少一个计算机可读指令，所述至少一个计算机可读指令被处理器执行以实现以下步骤：
当接收到告警定位指令时，获取待处理的至少一条告警信息；
判断所述至少一条告警信息是否满足批量告警条件；
当确定所述至少一条告警信息满足所述批量告警条件时，获取第一预设时间内的所有事件；
对所述所有事件进行嵌套处理，得到二维嵌套字典；
删除含有配置操作的告警信息，得到至少一条目标告警；
采用循环遍历方法从所述二维嵌套字典中获取每条目标告警对应的事件，得到每条目标告警的第一事件；
基于监控维度，对所述至少一条目标告警的第一事件进行归类聚合，得到至少一个监控维度的第二事件；
计算每个监控维度的第二事件在所述所有事件中的占比，得到每个监控维度的占比结果；
将最大的占比结果对应的监控维度确定为告警根因。
本申请的第四方面提供一种基于批量告警事件的定位装置，所述基于批量告警事件的定位装置包括：
获取单元，用于当接收到告警定位指令时，获取待处理的至少一条告警信息；
判断单元，用于判断所述至少一条告警信息是否满足批量告警条件；
所述获取单元，还用于当确定所述至少一条告警信息满足所述批量告警条件时，获取第一预设时间内的所有事件；
处理单元，用于对所述所有事件进行嵌套处理，得到二维嵌套字典；
删除单元，用于删除含有配置操作的告警信息，得到至少一条目标告警；
所述获取单元，还用于采用循环遍历方法从所述二维嵌套字典中获取每条目标告警对应的事件，得到每条目标告警的第一事件；
聚合单元，用于基于监控维度，对所述至少一条目标告警的第一事件进行归类聚合，得到至少一个监控维度的第二事件；
计算单元，用于计算每个监控维度的第二事件在所述所有事件中的占比，得到每个监控维度的占比结果；
确定单元，用于将最大的占比结果对应的监控维度确定为告警根因。
由以上技术方案可以看出，本申请能够当接收到告警定位指令时，获取待处理的至少一条告警信息，判断所述至少一条告警信息是否满足批量告警条件，当确定所述至少一条告警信息满足所述批量告警条件时，获取第一预设时间内的所有事件，对所述所有 事件进行嵌套处理，得到二维嵌套字典，删除含有配置操作的告警信息，得到至少一条目标告警，采用循环遍历方法从所述二维嵌套字典中获取每条目标告警对应的事件，得到每条目标告警的第一事件，基于监控维度，对所述至少一条目标告警的第一事件进行归类聚合，得到至少一个监控维度的第二事件，计算每个监控维度的第二事件在所述所有事件中的占比，得到每个监控维度的占比结果，将最大的占比结果对应的监控维度确定为告警根因，能够在所述至少一条告警信息满足批量告警条件时，对处理过的目标告警进行监控维度上的处理，避免告警时间因延时而带来的干扰，同时，还能够对因用户操作引起的冗余告警进行过滤，从而提高告警根因定位的准确率。本申请应用于智慧城市的运维监控，推动智慧城市的建设。
附图说明
图1是本申请基于批量告警事件的定位方法的较佳实施例的流程图。
图2是本申请基于批量告警事件的定位装置的较佳实施例的功能模块图。
图3是本申请实现基于批量告警事件的定位方法的较佳实施例的电子设备的结构示意图。
具体实施方式
为了使本申请的目的、技术方案和优点更加清楚，下面结合附图和具体实施例对本申请进行详细描述。
如图1所示，是本申请基于批量告警事件的定位方法的较佳实施例的流程图。根据不同的需求，该流程图中步骤的顺序可以改变，某些步骤可以省略。
所述基于批量告警事件的定位方法应用于一个或者多个电子设备中，所述电子设备是一种能够按照事先设定或存储的指令，自动进行数值计算和/或信息处理的设备，其硬件包括但不限于微处理器、专用集成电路(Application Specific Integrated Circuit，ASIC)、可编程门阵列(Field－Programmable Gate Array，FPGA)、数字处理器(Digital Signal Processor，DSP)、嵌入式设备等。
所述电子设备可以是任何一种可与用户进行人机交互的电子产品，例如，个人计算机、平板电脑、智能手机、个人数字助理(Personal Digital Assistant，PDA)、游戏机、交互式网络电视(Internet Protocol Television，IPTV)、智能式穿戴式设备等。
所述电子设备还可以包括网络设备和/或用户设备。其中，所述网络设备包括，但不限于单个网络服务器、多个网络服务器组成的服务器组或基于云计算(Cloud Computing)的由大量主机或网络服务器构成的云。
所述电子设备所处的网络包括但不限于互联网、广域网、城域网、局域网、虚拟专用网络(Virtual Private Network，VPN)等。
S10，当接收到告警定位指令时，获取待处理的至少一条告警信息。
在本申请的至少一个实施例中，所述告警定位指令可以由用户触发，也可以在满足一定条件时自动触发，本申请不限制。
其中，所述满足一定条件包括，但不限于：满足配置时间等。
所述配置时间可以包括确定的时间点(例如：所述配置时间可以是每天早上七点)，或者包括一个时间段等。
在本申请的至少一个实施例中，所述至少一条告警信息是由监控系统发出的，所述至少一条告警信息可以包括，但不限于：告警时间、告警日志等。
其中，所述监控系统是与电子设备相通信的系统，所述监控系统主要监控服务器或者所述电子设备，当所述服务器或者所述电子设备出现故障时，所述监控系统能够根据故障产生告警信息。
S11，判断所述至少一条告警信息是否满足批量告警条件。
在本申请的至少一个实施例中，所述批量告警条件是指在一定时间内，任意类型中告警信息的数量达到配置数目。
在本申请的至少一个实施例中，所述电子设备判断所述至少一条告警信息是否满足批量告警条件包括：
所述电子设备检测每条告警信息的类型，将所述类型相同的告警信息进行归类，得到至少一种类型的告警信息，进一步地，所述电子设备计算每种类型中告警信息的第一数量，当检测到任意一种类型中告警信息的第一数量大于或者等于所述配置数目时，所述电子设备确定所述至少一条告警信息满足所述批量告警条件。
其中，所述配置数目的取值可以自定义配置，本申请不作限制。
S12，当确定所述至少一条告警信息满足所述批量告警条件时，获取第一预设时间内的所有事件。
在本申请的至少一个实施例中，所述所有事件是指在所述第一预设时间内，所述监控系统监控到的事件。
在本申请的至少一个实施例中，所述电子设备获取第一预设时间内的所有事件包括：
所述电子设备从所述至少一条告警信息中获取每条告警信息的告警时间，根据所述告警时间，确定所述至少一条告警信息的目标时间段，从所述目标时间段中截取任意时间段作为所述第一预设时间，进一步地，所述电子设备采用网络爬虫技术获取所述第一预设时间内的所有事件。
其中，所述任意时间段的选取本申请不限制。
例如：所述至少一条告警信息中含有告警信息A、告警信息B、告警信息C，所述电子设备从所述至少一条告警信息中获取到所述告警信息A的告警时间为8:00、所述告警信息B的告警时间为9:00、所述告警信息C的告警时间为10:00，进一步地，所述电子设备根据所述告警时间，确定所述至少一条告警信息的目标时间段为8:00-10:00，所述电子设备从所述目标时间段中截取8:30-9:30作为第一预设时间，更进一步地，所述电子设备采用网络爬虫技术从所述监控系统中获取8:30-9:30内发生的所有事件。
通过上述实施方式，由于获取的事件来自所述目标时间段中任意时间段的所有事件，因此能够快速获取更加全面的事件。
S13，对所述所有事件进行嵌套处理，得到二维嵌套字典。
在本申请的至少一个实施例中，所述二维嵌套字典中包含所述所有事件的具体信息，所述具体信息由每件事件的目标主题、目标时间及每件事件的目标信息组成。
在本申请的至少一个实施例中，所述电子设备对所述所有事件进行嵌套处理，得到二维嵌套字典包括：
所述电子设备采用机器学习方法从所述所有事件中提取每件事件的目标主题及目标时间，进一步地，所述电子设备将每个目标主题确定为每件事件的外层标签及将每个目标时间确定为每件事件的内层标签，从所述所有事件中获取与每件事件对应的每个目标信息，将每个目标信息确定为每件事件的特征值，根据每件事件的外层标签、内层标签及特征值，生成所述二维嵌套字典。
具体地，所述电子设备采用机器学习方法从所述所有事件中提取每件事件的目标主题及目标时间包括：
所述电子设备获取第一训练集，通过训练所述第一训练集，构建所述目标主题的第一网络，采用第一学习率调整所述第一网络，得到所述目标主题的第一模型，所述电子设备将每件事件输入至所述第一模型中，得到每件事件的目标主题，进一步地，所述电子设备获取第二训练集，通过训练所述第二训练集，构建所述目标时间的第二网络，采用第二学习率调整 所述第二网络，得到所述目标时间的第二模型，所述电子设备将每件事件输入至所述第二模型中，得到每件事件的目标时间。
其中，所述第一训练集中包含事件的目标主题，所述第二训练集中包含事件的目标时间。
进一步地，所述第一学习率及所述第二学习率的取值可自定义配置，本申请不作限制。
当然，在其他实施例中，只要能达到相同的提取效果，所述电子设备也可以采用其他算法，本申请不限制。
通过上述实施方式，生成了所述二维嵌套字典，使所述所有事件具有统一的格式，因此，基于批量告警事件的定位方法适用于各种监控系统(如Argus监控系统)。
S14，删除含有配置操作的告警信息，得到至少一条目标告警。
在本申请的至少一个实施例中，所述配置操作是指由于用户操作不当引起的操作，例如：用户在关机时，设备自动删除文档信息的操作。
在本申请的至少一个实施例中，所述电子设备删除含有配置操作的告警信息，得到至少一条目标告警包括：
所述电子设备从所述至少一条告警信息中获取第一日志，检测所述第一日志中是否含有所述配置操作，进一步地，所述电子设备删除含有所述配置操作的告警信息，得到所述至少一条目标告警。
通过删除含有所述配置操作的告警信息，避免因所述配置操作的存在而导致告警根因定位不准确。
S15，采用循环遍历方法从所述二维嵌套字典中获取每条目标告警对应的事件，得到每条目标告警的第一事件。
在本申请的至少一个实施例中，所述第一事件是与所述至少一条目标告警对应的事件。
进一步地，所述目标告警是指不含所述配置操作的告警信息。
在本申请的至少一个实施例中，所述电子设备采用循环遍历方法从所述二维嵌套字典中获取每条目标告警对应的事件，得到每条目标告警的第一事件包括：
所述电子设备采用循环遍历方法获取每条目标告警的第一主题及所述二维嵌套字典中的所有外层标签，将每个第一主题与所述所有外层标签进行匹配，进一步地，所述电子设备将匹配成功的外层标签对应的事件确定为该条目标告警的第一事件。
例如：所述目标告警为目标告警D，所述电子设备采用循环遍历方法获取到所述目标告警D的第一主题为主题甲，同时获取到所述二维嵌套字典中的所有外层标签分别为标签甲、标签乙、标签丙以及标签丁，进一步地，所述电子设备将所述主题甲与所述所有外层标签进行匹配，得到所述主题甲与所述标签甲匹配，所述电子设备将在所述二维嵌套字典中与所述标签甲对应的事件确定为所述目标告警D的第一事件。
通过上述实施方式，利用所述二维嵌套字典，能够直接将目标告警的第一主题与所述外层标签进行匹配，而不需要将所述第一主题与所述所有事件中的具体信息都进行匹配，进而提高所述第一主题与所述外层标签匹配速度。
S16，基于监控维度，对所述至少一条目标告警的第一事件进行归类聚合，得到至少一个监控维度的第二事件。
在本申请的至少一个实施例中，所述第二事件是属于同一个监控维度的第一事件的集合。
例如：所述目标告警分别为目标告警E、目标告警F、目标告警G，其中，所述目标告警E的第一事件有事件1、事件2及事件3，所述目标告警F的第一事件有事件4及事件5，所述目标告警G的第一事件有事件6，基于监控维度对所述事件1、所述事件2、所述事件3、所述事件4、所述事件5及所述事件6进行归类聚合，得到物理机监控维度的第二事件有所述事件1、所述事件2及所述事件3，存储监控维度的第二事件有所述事件4、所述事件5及所述事件6。
在本申请的至少一个实施例中，所述电子设备基于监控维度，对所述至少一条目标告警的第一事件进行归类聚合，得到至少一个监控维度的第二事件包括：
所述电子设备获取每条目标告警的告警日志，采用基于高维聚类技术的中文关键词提取算法从所述告警日志中提取第一信息，根据所述第一信息，确定每个第一事件的监控维度，进一步地，所述电子设备采用分类算法将所述监控维度相同的第一事件进行归类聚合，得到所述至少一个监控维度的第二事件。
通过上述实施方式，能够准确地得到每个第一事件的监控维度，由于采用了分类算法，因此能够将监控维度相同的第一事件分类到同一监控维度上。
具体地，所述电子设备采用基于高维聚类技术的中文关键词提取算法从所述告警日志中提取第一信息包括：
所述电子设备依据预先配置的目标词典对所述告警日志进行快速分词，得到第一分词，统计所述第一分词的目标词频，将所述目标词频大于预设词频的第一分词确定为初始关键词，所述电子设备根据预设小词典，对所述初始关键词进行修剪，得到最终关键词，将所述最终关键词确定为所述第一信息。
其中，所述目标词典可以包括常见的关键词。
进一步地，所述小词典可以包括，但不限于虚词、停用词等。
通过上述实施方式，通过对所述初始关键词进行修剪，进而准确、快速地确定出所述第一信息。
S17，计算每个监控维度的第二事件在所述所有事件中的占比，得到每个监控维度的占比结果。
在本申请的至少一个实施例中，所述占比结果是指所述第二事件的数量与所述所有事件的总数量的比值。
在本申请的至少一个实施例中，所述电子设备计算每个监控维度的第二事件在所述所有事件中的占比，得到每个监控维度的占比结果包括：
所述电子设备根据所述二维嵌套字典获取所述所有事件的总数量，进一步地，所述电子设备确定每个监控维度中对应的第二事件的目标数量，将每个目标数量除以所述总数量，得到每个监控维度的占比结果。
例如：从所述二维嵌套字典中获取所述所有事件的总数量为1000件，所述电子设备确定所述物理机监控维度对应的第二事件的目标数量为800件，所述存储监控维度对应的第二事件的目标数量为100件，所述电子设备将每个目标数量除以所述总数量，得到所述物理机监控维度的占比结果为五分之四，所述存储监控维度的占比结果为十分之一。
通过确定每个监控维度的第二事件在所述所有事件中的比值，进而能够准确地得到每个监控维度的占比结果，为后续确定告警根因提供基础。
S18，将最大的占比结果对应的监控维度确定为告警根因。
在本申请的至少一个实施例中，所述告警根因是指具体的告警根源。
在本申请的至少一个实施例中，所述电子设备将最大的占比结果对应的监控维度确定为告警根因包括：
当检测到每个监控维度的占比结果时，所述电子设备获取比较大小程序，将每个监控维度的占比结果输入至所述比较大小程序中，得到最大的占比结果，进一步地，所述电子设备将所述最大的占比结果对应的监控维度确定为所述告警根因。
在本申请的至少一个实施例中，在将最大的占比结果对应的维度确定为告警根因之后，所述方法还包括：
所述电子设备从配置方案库中获取与所述告警根因对应的解决方案，根据所述告警根因及所述解决方案，生成提示信息，进一步地，所述电子设备采用加密技术对所述提示信息进 行加密，得到目标密文，将所述目标密文发送至指定人员的终端设备，当检测到所述目标密文被成功解密时，显示所述提示信息。
其中，所述配置方案库中存储至少一个告警根因及对应的解决方案。
进一步地，所述提示信息可以包括，但不限于：告警根因、解决方案、告警时间等。
更进一步地，所述指定人员可以是所述监控系统的负责人。
通过上述实施方式，对所述提示信息进行加密，能够避免所述提示信息中的告警根因及解决方案被随意篡改，提高所述提示信息的安全性，还能够在得到告警根因后，及时提醒所述指定人员进行查看。
由以上技术方案可以看出，本申请能够当接收到告警定位指令时，获取待处理的至少一条告警信息，判断所述至少一条告警信息是否满足批量告警条件，当确定所述至少一条告警信息满足所述批量告警条件时，获取第一预设时间内的所有事件，对所述所有事件进行嵌套处理，得到二维嵌套字典，删除含有配置操作的告警信息，得到至少一条目标告警，采用循环遍历方法从所述二维嵌套字典中获取每条目标告警对应的事件，得到每条目标告警的第一事件，基于监控维度，对所述至少一条目标告警的第一事件进行归类聚合，得到至少一个监控维度的第二事件，计算每个监控维度的第二事件在所述所有事件中的占比，得到每个监控维度的占比结果，将最大的占比结果对应的监控维度确定为告警根因，能够在所述至少一条告警信息满足批量告警条件时，对处理过的目标告警进行监控维度上的处理，避免告警时间因延时而带来的干扰，同时，还能够对因用户操作引起的冗余告警进行过滤，从而提高告警根因定位的准确率。
如图2所示，是本申请基于批量告警事件的定位装置的较佳实施例的功能模块图。所述基于批量告警事件的定位装置11包括获取单元110、判断单元111、处理单元112、删除单元113、聚合单元114、计算单元115、确定单元116、生成单元117、加密单元118、发送单元119以及显示单元120。本申请所称的模块/单元是指一种能够被处理器13所执行，并且能够完成固定功能的一系列计算机程序段，其存储在存储器12中。在本实施例中，关于各模块/单元的功能将在后续的实施例中详述。
当接收到告警定位指令时，获取单元110获取待处理的至少一条告警信息。
在本申请的至少一个实施例中，所述告警定位指令可以由用户触发，也可以在满足一定条件时自动触发，本申请不限制。
其中，所述满足一定条件包括，但不限于：满足配置时间等。
所述配置时间可以包括确定的时间点(例如：所述配置时间可以是每天早上七点)，或者包括一个时间段等。
在本申请的至少一个实施例中，所述至少一条告警信息是由监控系统发出的，所述至少一条告警信息可以包括，但不限于：告警时间、告警日志等。
其中，所述监控系统是与电子设备相通信的系统，所述监控系统主要监控服务器或者所述电子设备，当所述服务器或者所述电子设备出现故障时，所述监控系统能够根据故障产生告警信息。
判断单元111判断所述至少一条告警信息是否满足批量告警条件。
在本申请的至少一个实施例中，所述批量告警条件是指在一定时间内，任意类型中告警信息的数量达到配置数目。
在本申请的至少一个实施例中，所述判断单元111判断所述至少一条告警信息是否满足批量告警条件包括：
所述判断单元111检测每条告警信息的类型，将所述类型相同的告警信息进行归类，得到至少一种类型的告警信息，进一步地，所述判断单元111计算每种类型中告警信息的第一数量，当检测到任意一种类型中告警信息的第一数量大于或者等于所述配置数目时，所述判 断单元111确定所述至少一条告警信息满足所述批量告警条件。
其中，所述配置数目的取值可以自定义配置，本申请不作限制。
当确定所述至少一条告警信息满足所述批量告警条件时，所述获取单元110获取第一预设时间内的所有事件。
在本申请的至少一个实施例中，所述所有事件是指在所述第一预设时间内，所述监控系统监控到的事件。
在本申请的至少一个实施例中，所述获取单元110获取第一预设时间内的所有事件包括：
所述获取单元110从所述至少一条告警信息中获取每条告警信息的告警时间，根据所述告警时间，确定所述至少一条告警信息的目标时间段，从所述目标时间段中截取任意时间段作为所述第一预设时间，进一步地，所述获取单元110采用网络爬虫技术获取所述第一预设时间内的所有事件。
其中，所述任意时间段的选取本申请不限制。
例如：所述至少一条告警信息中含有告警信息A、告警信息B、告警信息C，所述获取单元110从所述至少一条告警信息中获取到所述告警信息A的告警时间为8:00、所述告警信息B的告警时间为9:00、所述告警信息C的告警时间为10:00，进一步地，所述获取单元110根据所述告警时间，确定所述至少一条告警信息的目标时间段为8:00-10:00，所述获取单元110从所述目标时间段中截取8:30-9:30作为第一预设时间，更进一步地，所述获取单元110采用网络爬虫技术从所述监控系统中获取8:30-9:30内发生的所有事件。
通过上述实施方式，由于获取的事件来自所述目标时间段中任意时间段的所有事件，因此能够快速获取更加全面的事件。
处理单元112对所述所有事件进行嵌套处理，得到二维嵌套字典。
在本申请的至少一个实施例中，所述二维嵌套字典中包含所述所有事件的具体信息，所述具体信息由每件事件的目标主题、目标时间及每件事件的目标信息组成。
在本申请的至少一个实施例中，所述处理单元112对所述所有事件进行嵌套处理，得到二维嵌套字典包括：
所述处理单元112采用机器学习方法从所述所有事件中提取每件事件的目标主题及目标时间，进一步地，所述处理单元112将每个目标主题确定为每件事件的外层标签及将每个目标时间确定为每件事件的内层标签，从所述所有事件中获取与每件事件对应的每个目标信息，将每个目标信息确定为每件事件的特征值，根据每件事件的外层标签、内层标签及特征值，生成所述二维嵌套字典。
具体地，所述处理单元112采用机器学习方法从所述所有事件中提取每件事件的目标主题及目标时间包括：
所述处理单元112获取第一训练集，通过训练所述第一训练集，构建所述目标主题的第一网络，采用第一学习率调整所述第一网络，得到所述目标主题的第一模型，所述处理单元112将每件事件输入至所述第一模型中，得到每件事件的目标主题，进一步地，所述处理单元112获取第二训练集，通过训练所述第二训练集，构建所述目标时间的第二网络，采用第二学习率调整所述第二网络，得到所述目标时间的第二模型，所述处理单元112将每件事件输入至所述第二模型中，得到每件事件的目标时间。
其中，所述第一训练集中包含事件的目标主题，所述第二训练集中包含事件的目标时间。
进一步地，所述第一学习率及所述第二学习率的取值可自定义配置，本申请不作限制。
当然，在其他实施例中，只要能达到相同的提取效果，所述处理单元112也可以采用其他算法，本申请不限制。
通过上述实施方式，生成了所述二维嵌套字典，使所述所有事件具有统一的格式，因此，基于批量告警事件的定位方法适用于各种监控系统(如Argus监控系统)。
删除单元113删除含有配置操作的告警信息，得到至少一条目标告警。
在本申请的至少一个实施例中，所述配置操作是指由于用户操作不当引起的操作，例如：用户在关机时，设备自动删除文档信息的操作。
在本申请的至少一个实施例中，所述删除单元113删除含有配置操作的告警信息，得到至少一条目标告警包括：
所述删除单元113从所述至少一条告警信息中获取第一日志，检测所述第一日志中是否含有所述配置操作，进一步地，所述删除单元113删除含有所述配置操作的告警信息，得到所述至少一条目标告警。
通过删除含有所述配置操作的告警信息，避免因所述配置操作的存在而导致告警根因定位不准确。
所述获取单元110采用循环遍历方法从所述二维嵌套字典中获取每条目标告警对应的事件，得到每条目标告警的第一事件。
在本申请的至少一个实施例中，所述第一事件是与所述至少一条目标告警对应的事件。
进一步地，所述目标告警是指不含所述配置操作的告警信息。
在本申请的至少一个实施例中，所述获取单元110采用循环遍历方法从所述二维嵌套字典中获取每条目标告警对应的事件，得到每条目标告警的第一事件包括：
所述获取单元110采用循环遍历方法获取每条目标告警的第一主题及所述二维嵌套字典中的所有外层标签，将每个第一主题与所述所有外层标签进行匹配，进一步地，所述获取单元110将匹配成功的外层标签对应的事件确定为该条目标告警的第一事件。
例如：所述目标告警为目标告警D，所述获取单元110采用循环遍历方法获取到所述目标告警D的第一主题为主题甲，同时获取到所述二维嵌套字典中的所有外层标签分别为标签甲、标签乙、标签丙以及标签丁，进一步地，所述获取单元110将所述主题甲与所述所有外层标签进行匹配，得到所述主题甲与所述标签甲匹配，所述获取单元110将在所述二维嵌套字典中与所述标签甲对应的事件确定为所述目标告警D的第一事件。
通过上述实施方式，利用所述二维嵌套字典，能够直接将目标告警的第一主题与所述外层标签进行匹配，而不需要将所述第一主题与所述所有事件中的具体信息都进行匹配，进而提高所述第一主题与所述外层标签匹配速度。
聚合单元114基于监控维度，对所述至少一条目标告警的第一事件进行归类聚合，得到至少一个监控维度的第二事件。
在本申请的至少一个实施例中，所述第二事件是属于同一个监控维度的第一事件的集合。
例如：所述目标告警分别为目标告警E、目标告警F、目标告警G，其中，所述目标告警E的第一事件有事件1、事件2及事件3，所述目标告警F的第一事件有事件4及事件5，所述目标告警G的第一事件有事件6，基于监控维度对所述事件1、所述事件2、所述事件3、所述事件4、所述事件5及所述事件6进行归类聚合，得到物理机监控维度的第二事件有所述事件1、所述事件2及所述事件3，存储监控维度的第二事件有所述事件4、所述事件5及所述事件6。
在本申请的至少一个实施例中，所述聚合单元114基于监控维度，对所述至少一条目标告警的第一事件进行归类聚合，得到至少一个监控维度的第二事件包括：
所述聚合单元114获取每条目标告警的告警日志，采用基于高维聚类技术的中文关键词提取算法从所述告警日志中提取第一信息，根据所述第一信息，确定每个第一事件的监控维度，进一步地，所述聚合单元114采用分类算法将所述监控维度相同的第一事件进行归类聚合，得到所述至少一个监控维度的第二事件。
通过上述实施方式，能够准确地得到每个第一事件的监控维度，由于采用了分类算法，因此能够将监控维度相同的第一事件分类到同一监控维度上。
具体地，所述聚合单元114采用基于高维聚类技术的中文关键词提取算法从所述告警日志中提取第一信息包括：
所述聚合单元114依据预先配置的目标词典对所述告警日志进行快速分词，得到第一分词，统计所述第一分词的目标词频，将所述目标词频大于预设词频的第一分词确定为初始关键词，所述聚合单元114根据预设小词典，对所述初始关键词进行修剪，得到最终关键词，将所述最终关键词确定为所述第一信息。
其中，所述目标词典可以包括常见的关键词。
进一步地，所述小词典可以包括，但不限于虚词、停用词等。
通过上述实施方式，通过对所述初始关键词进行修剪，进而准确、快速地确定出所述第一信息。
计算单元115计算每个监控维度的第二事件在所述所有事件中的占比，得到每个监控维度的占比结果。
在本申请的至少一个实施例中，所述占比结果是指所述第二事件的数量与所述所有事件的总数量的比值。
在本申请的至少一个实施例中，所述计算单元115计算每个监控维度的第二事件在所述所有事件中的占比，得到每个监控维度的占比结果包括：
所述计算单元115根据所述二维嵌套字典获取所述所有事件的总数量，进一步地，所述计算单元115确定每个监控维度中对应的第二事件的目标数量，将每个目标数量除以所述总数量，得到每个监控维度的占比结果。
例如：从所述二维嵌套字典中获取所述所有事件的总数量为1000件，所述计算单元115确定所述物理机监控维度对应的第二事件的目标数量为800件，所述存储监控维度对应的第二事件的目标数量为100件，所述计算单元115将每个目标数量除以所述总数量，得到所述物理机监控维度的占比结果为五分之四，所述存储监控维度的占比结果为十分之一。
通过确定每个监控维度的第二事件在所述所有事件中的比值，进而能够准确地得到每个监控维度的占比结果，为后续确定告警根因提供基础。
确定单元116将最大的占比结果对应的监控维度确定为告警根因。
在本申请的至少一个实施例中，所述告警根因是指具体的告警根源。
在本申请的至少一个实施例中，所述确定单元116将最大的占比结果对应的监控维度确定为告警根因包括：
当检测到每个监控维度的占比结果时，所述确定单元116获取比较大小程序，将每个监控维度的占比结果输入至所述比较大小程序中，得到最大的占比结果，进一步地，所述确定单元116将所述最大的占比结果对应的监控维度确定为所述告警根因。
在本申请的至少一个实施例中，在将最大的占比结果对应的维度确定为告警根因之后，所述方法还包括：
所述获取单元110从配置方案库中获取与所述告警根因对应的解决方案，生成单元117根据所述告警根因及所述解决方案，生成提示信息，进一步地，加密单元118采用加密技术对所述提示信息进行加密，得到目标密文，更进一步地，发送单元119将所述目标密文发送至指定人员的终端设备，当检测到所述目标密文被成功解密时，显示单元120显示所述提示信息。
其中，所述配置方案库中存储至少一个告警根因及对应的解决方案。
进一步地，所述提示信息可以包括，但不限于：告警根因、解决方案、告警时间等。
更进一步地，所述指定人员可以是所述监控系统的负责人。
通过上述实施方式，对所述提示信息进行加密，能够避免所述提示信息中的告警根因及解决方案被随意篡改，提高所述提示信息的安全性，还能够在得到告警根因后，及时提醒所 述指定人员进行查看。
由以上技术方案可以看出，本申请能够当接收到告警定位指令时，获取待处理的至少一条告警信息，判断所述至少一条告警信息是否满足批量告警条件，当确定所述至少一条告警信息满足所述批量告警条件时，获取第一预设时间内的所有事件，对所述所有事件进行嵌套处理，得到二维嵌套字典，删除含有配置操作的告警信息，得到至少一条目标告警，采用循环遍历方法从所述二维嵌套字典中获取每条目标告警对应的事件，得到每条目标告警的第一事件，基于监控维度，对所述至少一条目标告警的第一事件进行归类聚合，得到至少一个监控维度的第二事件，计算每个监控维度的第二事件在所述所有事件中的占比，得到每个监控维度的占比结果，将最大的占比结果对应的监控维度确定为告警根因，能够在所述至少一条告警信息满足批量告警条件时，对处理过的目标告警进行监控维度上的处理，避免告警时间因延时而带来的干扰，同时，还能够对因用户操作引起的冗余告警进行过滤，从而提高告警根因定位的准确率。
如图3所示，是本申请实现基于批量告警事件的定位方法的较佳实施例的电子设备的结构示意图。
在本申请的一个实施例中，所述电子设备1包括，但不限于，存储器12、处理器13，以及存储在所述存储器12中并可在所述处理器13上运行的计算机程序，例如基于批量告警事件的定位程序。
本领域技术人员可以理解，所述示意图仅仅是电子设备1的示例，并不构成对电子设备1的限定，可以包括比图示更多或更少的部件，或者组合某些部件，或者不同的部件，例如所述电子设备1还可以包括输入输出设备、网络接入设备、总线等。
所述处理器13可以是中央处理单元(Central Processing Unit，CPU)，还可以是其他通用处理器、数字信号处理器(Digital Signal Processor，DSP)、专用集成电路(Application Specific Integrated Circuit，ASIC)、现场可编程门阵列(Field-Programmable Gate Array，FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件等。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等，所述处理器13是所述电子设备1的运算核心和控制中心，利用各种接口和线路连接整个电子设备1的各个部分，及执行所述电子设备1的操作系统以及安装的各类应用程序、程序代码等。
所述处理器13执行所述电子设备1的操作系统以及安装的各类应用程序。所述处理器13执行所述应用程序以实现上述各个基于批量告警事件的定位方法实施例中的步骤，例如图1所示的步骤。
示例性的，所述计算机程序可以被分割成一个或多个模块/单元，所述一个或者多个模块/单元被存储在所述存储器12中，并由所述处理器13执行，以完成本申请。所述一个或多个模块/单元可以是能够完成特定功能的一系列计算机程序指令段，该指令段用于描述所述计算机程序在所述电子设备1中的执行过程。例如，所述计算机程序可以被分割成获取单元110、判断单元111、处理单元112、删除单元113、聚合单元114、计算单元115、确定单元116、生成单元117、加密单元118、发送单元119以及显示单元120。
所述存储器12可用于存储所述计算机程序和/或模块，所述处理器13通过运行或执行存储在所述存储器12内的计算机程序和/或模块，以及调用存储在存储器12内的数据，实现所述电子设备1的各种功能。所述存储器12可主要包括存储程序区和存储数据区，其中，存储程序区可存储操作系统、至少一个功能所需的应用程序(比如声音播放功能、图像播放功能等)等；存储数据区可存储根据电子设备的使用所创建的数据(比如音频数据等)等。此外，存储器12可以包括非易失性和易失性存储器，例如硬盘、内存、插接式硬盘，智能存储卡(Smart Media Card,SMC)，安全数字(Secure Digital,SD)卡，闪存卡(Flash Card)、至少一个磁盘存储器件、闪存器件、或其他存储器件。
所述存储器12可以是电子设备1的外部存储器和/或内部存储器。进一步地，所述存储器12可以是具有实物形式的存储器，如内存条、TF卡(Trans-flash Card)等等。
所述电子设备1集成的模块/单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中，所述计算机可读存储介质可以是非易失性的存储介质，也可以是易失性的存储介质。基于这样的理解，本申请实现上述实施例方法中的全部或部分流程，也可以通过计算机程序来指令相关的硬件来完成，所述的计算机程序可存储于一计算机可读存储介质中，该计算机程序在被处理器执行时，可实现上述各个方法实施例的步骤。
其中，所述计算机程序包括计算机可读指令代码，所述计算机可读指令代码可以为源代码形式、对象代码形式、可执行文件或某些中间形式等。所述计算机可读介质可以包括：能够携带所述计算机程序代码的任何实体或装置、记录介质、U盘、移动硬盘、磁碟、光盘、计算机存储器、只读存储器(ROM，Read-Only Memory)、随机存取存储器。
结合图1，所述电子设备1中的所述存储器12存储多个指令以实现一种基于批量告警事件的定位方法，所述处理器13可执行所述多个指令从而实现：当接收到告警定位指令时，获取待处理的至少一条告警信息；判断所述至少一条告警信息是否满足批量告警条件；当确定所述至少一条告警信息满足所述批量告警条件时，获取第一预设时间内的所有事件；对所述所有事件进行嵌套处理，得到二维嵌套字典；删除含有配置操作的告警信息，得到至少一条目标告警；采用循环遍历方法从所述二维嵌套字典中获取每条目标告警对应的事件，得到每条目标告警的第一事件；基于监控维度，对所述至少一条目标告警的第一事件进行归类聚合，得到至少一个监控维度的第二事件；计算每个监控维度的第二事件在所述所有事件中的占比，得到每个监控维度的占比结果；将最大的占比结果对应的监控维度确定为告警根因。
具体地，所述处理器13对上述指令的具体实现方法可参考图1对应实施例中相关步骤的描述，在此不赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统，装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述模块的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式。
所述作为分离部件说明的模块可以是或者也可以不是物理上分开的，作为模块显示的部件可以是或者也可以不是物理单元，既可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部模块来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能模块可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用硬件加软件功能模块的形式实现。
因此，无论从哪一点来看，均应将实施例看作是示范性的，而且是非限制性的，本申请的范围由所附权利要求而不是上述说明限定，因此旨在将落在权利要求的等同要件的含义和范围内的所有变化涵括在本申请内。不应将权利要求中的任何附关联图标记视为限制所涉及的权利要求。
此外，显然“包括”一词不排除其他单元或步骤，单数不排除复数。系统权利要求中陈述的多个单元或装置也可以由一个单元或装置通过软件或者硬件来实现。第二等词语用来表示名称，而并不表示任何特定的顺序。
最后应说明的是，以上实施例仅用以说明本申请的技术方案而非限制，尽管参照较佳实施例对本申请进行了详细说明，本领域的普通技术人员应当理解，可以对本申请的技术方案进行修改或等同替换，而不脱离本申请技术方案的精神和范围。

Claims (20)

  1. 一种基于批量告警事件的定位方法，其中，所述基于批量告警事件的定位方法包括：
    当接收到告警定位指令时，获取待处理的至少一条告警信息；
    判断所述至少一条告警信息是否满足批量告警条件；
    当确定所述至少一条告警信息满足所述批量告警条件时，获取第一预设时间内的所有事件；
    对所述所有事件进行嵌套处理，得到二维嵌套字典；
    删除含有配置操作的告警信息，得到至少一条目标告警；
    采用循环遍历方法从所述二维嵌套字典中获取每条目标告警对应的事件，得到每条目标告警的第一事件；
    基于监控维度，对所述至少一条目标告警的第一事件进行归类聚合，得到至少一个监控维度的第二事件；
    计算每个监控维度的第二事件在所述所有事件中的占比，得到每个监控维度的占比结果；
    将最大的占比结果对应的监控维度确定为告警根因。
  2. 根据权利要求1所述的基于批量告警事件的定位方法，其中，所述获取第一预设时间内的所有事件包括：
    从所述至少一条告警信息中获取每条告警信息的告警时间；
    根据所述告警时间，确定所述至少一条告警信息的目标时间段；
    从所述目标时间段中截取任意时间段作为所述第一预设时间；
    采用网络爬虫技术获取所述第一预设时间内的所有事件。
  3. 根据权利要求1所述的基于批量告警事件的定位方法，其中，所述对所述所有事件进行嵌套处理，得到二维嵌套字典包括：
    采用机器学习方法从所述所有事件中提取每件事件的目标主题及目标时间；
    将每个目标主题确定为每件事件的外层标签及将每个目标时间确定为每件事件的内层标签；
    从所述所有事件中获取与每件事件对应的每个目标信息；
    将每个目标信息确定为每件事件的特征值；
    根据每件事件的外层标签、内层标签及特征值，生成所述二维嵌套字典。
  4. 根据权利要求3所述的基于批量告警事件的定位方法，其中，所述采用循环遍历方法从所述二维嵌套字典中获取每条目标告警对应的事件，得到每条目标告警的第一事件包括：
    采用循环遍历方法获取每条目标告警的第一主题及所述二维嵌套字典中的所有外层标签；
    将每个第一主题与所述所有外层标签进行匹配；
    将匹配成功的外层标签对应的事件确定为该条目标告警的第一事件。
  5. 根据权利要求1所述的基于批量告警事件的定位方法，其中，所述基于监控维度，对所述至少一条目标告警的第一事件进行归类聚合，得到至少一个监控维度的第二事件包括：
    获取每条目标告警的告警日志；
    采用基于高维聚类技术的中文关键词提取算法从所述告警日志中提取第一信息；
    根据所述第一信息，确定每个第一事件的监控维度；
    采用分类算法将所述监控维度相同的第一事件进行归类聚合，得到所述至少一个监控维度的第二事件。
  6. 根据权利要求1所述的基于批量告警事件的定位方法，其中，所述计算每个监控维度的第二事件在所述所有事件中的占比，得到每个监控维度的占比结果包括：
    根据所述二维嵌套字典获取所述所有事件的总数量；
    确定每个监控维度中对应的第二事件的目标数量；
    将每个目标数量除以所述总数量，得到每个监控维度的占比结果。
  7. 根据权利要求1所述的基于批量告警事件的定位方法，其中，在将最大的占比结果对应的维度确定为告警根因之后，所述方法还包括：
    从配置方案库中获取与所述告警根因对应的解决方案；
    根据所述告警根因及所述解决方案，生成提示信息；
    采用加密技术对所述提示信息进行加密，得到目标密文；
    将所述目标密文发送至指定人员的终端设备；
    当检测到所述目标密文被成功解密时，显示所述提示信息。
  8. 一种电子设备，其中，所述电子设备包括处理器和存储器，所述处理器用于执行存储器中存储的至少一个计算机可读指令以实现以下步骤：
    当接收到告警定位指令时，获取待处理的至少一条告警信息；
    判断所述至少一条告警信息是否满足批量告警条件；
    当确定所述至少一条告警信息满足所述批量告警条件时，获取第一预设时间内的所有事件；
    对所述所有事件进行嵌套处理，得到二维嵌套字典；
    删除含有配置操作的告警信息，得到至少一条目标告警；
    采用循环遍历方法从所述二维嵌套字典中获取每条目标告警对应的事件，得到每条目标告警的第一事件；
    基于监控维度，对所述至少一条目标告警的第一事件进行归类聚合，得到至少一个监控维度的第二事件；
    计算每个监控维度的第二事件在所述所有事件中的占比，得到每个监控维度的占比结果；
    将最大的占比结果对应的监控维度确定为告警根因。
  9. 根据权利要求8所述的电子设备，其中，在所述获取第一预设时间内的所有事件时，所述处理器执行所述至少一个计算机可读指令以实现以下步骤：
    从所述至少一条告警信息中获取每条告警信息的告警时间；
    根据所述告警时间，确定所述至少一条告警信息的目标时间段；
    从所述目标时间段中截取任意时间段作为所述第一预设时间；
    采用网络爬虫技术获取所述第一预设时间内的所有事件。
  10. 根据权利要求8所述的电子设备，其中，在所述对所述所有事件进行嵌套处理，得到二维嵌套字典时，所述处理器执行所述至少一个计算机可读指令以实现以下步骤：
    采用机器学习方法从所述所有事件中提取每件事件的目标主题及目标时间；
    将每个目标主题确定为每件事件的外层标签及将每个目标时间确定为每件事件的内层标签；
    从所述所有事件中获取与每件事件对应的每个目标信息；
    将每个目标信息确定为每件事件的特征值；
    根据每件事件的外层标签、内层标签及特征值，生成所述二维嵌套字典。
  11. 根据权利要求10所述的电子设备，其中，在所述采用循环遍历方法从所述二维嵌套字典中获取每条目标告警对应的事件，得到每条目标告警的第一事件时，所述处理器执行所述至少一个计算机可读指令以实现以下步骤：
    采用循环遍历方法获取每条目标告警的第一主题及所述二维嵌套字典中的所有外层标签；
    将每个第一主题与所述所有外层标签进行匹配；
    将匹配成功的外层标签对应的事件确定为该条目标告警的第一事件。
  12. 根据权利要求8所述的电子设备，其中，在所述基于监控维度，对所述至少一条目 标告警的第一事件进行归类聚合，得到至少一个监控维度的第二事件时，所述处理器执行所述至少一个计算机可读指令以实现以下步骤：
    获取每条目标告警的告警日志；
    采用基于高维聚类技术的中文关键词提取算法从所述告警日志中提取第一信息；
    根据所述第一信息，确定每个第一事件的监控维度；
    采用分类算法将所述监控维度相同的第一事件进行归类聚合，得到所述至少一个监控维度的第二事件。
  13. 根据权利要求8所述的电子设备，其中，在所述计算每个监控维度的第二事件在所述所有事件中的占比，得到每个监控维度的占比结果时，所述处理器执行所述至少一个计算机可读指令以实现以下步骤：
    根据所述二维嵌套字典获取所述所有事件的总数量；
    确定每个监控维度中对应的第二事件的目标数量；
    将每个目标数量除以所述总数量，得到每个监控维度的占比结果。
  14. 一种计算机可读存储介质，其中，所述计算机可读存储介质存储有至少一个计算机可读指令，所述至少一个计算机可读指令被处理器执行时实现以下步骤：
    当接收到告警定位指令时，获取待处理的至少一条告警信息；
    判断所述至少一条告警信息是否满足批量告警条件；
    当确定所述至少一条告警信息满足所述批量告警条件时，获取第一预设时间内的所有事件；
    对所述所有事件进行嵌套处理，得到二维嵌套字典；
    删除含有配置操作的告警信息，得到至少一条目标告警；
    采用循环遍历方法从所述二维嵌套字典中获取每条目标告警对应的事件，得到每条目标告警的第一事件；
    基于监控维度，对所述至少一条目标告警的第一事件进行归类聚合，得到至少一个监控维度的第二事件；
    计算每个监控维度的第二事件在所述所有事件中的占比，得到每个监控维度的占比结果；
    将最大的占比结果对应的监控维度确定为告警根因。
  15. 根据权利要求14所述的存储介质，其中，在所述获取第一预设时间内的所有事件时，所述至少一个计算机可读指令被处理器执行以实现以下步骤：
    从所述至少一条告警信息中获取每条告警信息的告警时间；
    根据所述告警时间，确定所述至少一条告警信息的目标时间段；
    从所述目标时间段中截取任意时间段作为所述第一预设时间；
    采用网络爬虫技术获取所述第一预设时间内的所有事件。
  16. 根据权利要求14所述的存储介质，其中，在所述对所述所有事件进行嵌套处理，得到二维嵌套字典时，所述至少一个计算机可读指令被处理器执行以实现以下步骤：
    采用机器学习方法从所述所有事件中提取每件事件的目标主题及目标时间；
    将每个目标主题确定为每件事件的外层标签及将每个目标时间确定为每件事件的内层标签；
    从所述所有事件中获取与每件事件对应的每个目标信息；
    将每个目标信息确定为每件事件的特征值；
    根据每件事件的外层标签、内层标签及特征值，生成所述二维嵌套字典。
  17. 根据权利要求16所述的存储介质，其中，在所述采用循环遍历方法从所述二维嵌套字典中获取每条目标告警对应的事件，得到每条目标告警的第一事件时，所述至少一个计算机可读指令被处理器执行以实现以下步骤：
    采用循环遍历方法获取每条目标告警的第一主题及所述二维嵌套字典中的所有外层标签；
    将每个第一主题与所述所有外层标签进行匹配；
    将匹配成功的外层标签对应的事件确定为该条目标告警的第一事件。
  18. 根据权利要求14所述的存储介质，其中，在所述基于监控维度，对所述至少一条目标告警的第一事件进行归类聚合，得到至少一个监控维度的第二事件时，所述至少一个计算机可读指令被处理器执行时以实现以下步骤：
    获取每条目标告警的告警日志；
    采用基于高维聚类技术的中文关键词提取算法从所述告警日志中提取第一信息；
    根据所述第一信息，确定每个第一事件的监控维度；
    采用分类算法将所述监控维度相同的第一事件进行归类聚合，得到所述至少一个监控维度的第二事件。
  19. 根据权利要求14所述的存储介质，其中，在所述计算每个监控维度的第二事件在所述所有事件中的占比，得到每个监控维度的占比结果时，所述至少一个计算机可读指令被处理器执行以实现以下步骤：
    根据所述二维嵌套字典获取所述所有事件的总数量；
    确定每个监控维度中对应的第二事件的目标数量；
    将每个目标数量除以所述总数量，得到每个监控维度的占比结果。
  20. 一种基于批量告警事件的定位装置，其中，所述基于批量告警事件的定位装置包括：
    获取单元，用于当接收到告警定位指令时，获取待处理的至少一条告警信息；
    判断单元，用于判断所述至少一条告警信息是否满足批量告警条件；
    所述获取单元，还用于当确定所述至少一条告警信息满足所述批量告警条件时，获取第一预设时间内的所有事件；
    处理单元，用于对所述所有事件进行嵌套处理，得到二维嵌套字典；
    删除单元，用于删除含有配置操作的告警信息，得到至少一条目标告警；
    所述获取单元，还用于采用循环遍历方法从所述二维嵌套字典中获取每条目标告警对应的事件，得到每条目标告警的第一事件；
    聚合单元，用于基于监控维度，对所述至少一条目标告警的第一事件进行归类聚合，得到至少一个监控维度的第二事件；
    计算单元，用于计算每个监控维度的第二事件在所述所有事件中的占比，得到每个监控维度的占比结果；
    确定单元，用于将最大的占比结果对应的监控维度确定为告警根因。
PCT/CN2020/111916 2019-11-01 2020-08-27 基于批量告警事件的定位方法、装置、电子设备及介质 WO2021082697A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201911058281.5A CN111082966B (zh) 2019-11-01 2019-11-01 基于批量告警事件的定位方法、装置、电子设备及介质
CN201911058281.5 2019-11-01

Publications (1)

Publication Number Publication Date
WO2021082697A1 true WO2021082697A1 (zh) 2021-05-06

Family

ID=70310753

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/111916 WO2021082697A1 (zh) 2019-11-01 2020-08-27 基于批量告警事件的定位方法、装置、电子设备及介质

Country Status (2)

Country Link
CN (1) CN111082966B (zh)
WO (1) WO2021082697A1 (zh)

Cited By (13)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113572633A (zh) * 2021-06-15 2021-10-29 阿里巴巴新加坡控股有限公司 根因定位方法、系统、设备及存储介质
CN114363044A (zh) * 2021-12-30 2022-04-15 深信服科技股份有限公司 一种分层告警方法、系统、存储介质和终端
CN114399417A (zh) * 2021-12-31 2022-04-26 常熟昊虞电子信息科技有限公司 基于智慧城市的数据处理方法及服务器
CN114464547A (zh) * 2021-12-29 2022-05-10 上海赛美特软件科技有限公司 一种晶圆检验方法、装置、设备及存储介质
CN114884795A (zh) * 2022-05-20 2022-08-09 远景智能国际私人投资有限公司 物联网场景中的告警信息处理方法、装置、计算机设备
CN115118464A (zh) * 2022-06-10 2022-09-27 深信服科技股份有限公司 一种失陷主机检测方法、装置、电子设备及存储介质
CN115277368A (zh) * 2022-08-02 2022-11-01 上海宏时数据系统有限公司 多平台告警方法、装置、电子设备和存储介质
CN115277356A (zh) * 2022-07-29 2022-11-01 中国电信股份有限公司 告警信息的归并方法、装置及电子设备
CN115296979A (zh) * 2022-08-01 2022-11-04 中国农业银行股份有限公司 一种故障处理方法、装置、设备及存储介质
CN115834335A (zh) * 2022-11-07 2023-03-21 中国建设银行股份有限公司 告警信息处理方法及装置、存储介质及电子设备
CN115866511A (zh) * 2022-11-18 2023-03-28 东土科技(宜昌)有限公司 定位系统中的硬件设备的监控方法及装置
CN116054416A (zh) * 2023-03-15 2023-05-02 扬州康德电气有限公司 一种基于物联网的智能监控运维管理系统
CN116991620A (zh) * 2023-08-03 2023-11-03 北京优特捷信息技术有限公司 一种解决方案确定方法、装置、设备及介质

Families Citing this family (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111082966B (zh) * 2019-11-01 2022-08-12 平安科技（深圳）有限公司 基于批量告警事件的定位方法、装置、电子设备及介质
CN112269818B (zh) * 2020-11-25 2023-11-21 成都数之联科技股份有限公司 一种设备参数根因定位方法及系统、装置、介质
CN112968805B (zh) * 2021-05-19 2021-08-06 新华三技术有限公司 一种告警日志处理方法及装置
CN113312200A (zh) * 2021-06-01 2021-08-27 中国民航信息网络股份有限公司 一种事件处理方法、装置、计算机设备及存储介质
CN113542253B (zh) * 2021-07-12 2023-04-07 杭州安恒信息技术股份有限公司 一种网络流量检测方法、装置、设备及介质
CN116132263B (zh) * 2023-02-24 2023-09-19 北京优特捷信息技术有限公司 告警解决方案推荐方法、装置、电子设备及存储介质

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20180254942A1 (en) * 2017-03-01 2018-09-06 Teoco Ltd. System and Method for Alarm Correlation and Root Cause Determination
CN110321411A (zh) * 2019-06-26 2019-10-11 国网江苏省电力有限公司 一种电网监控告警信息分类方法、系统及可读存储介质
CN110351150A (zh) * 2019-07-26 2019-10-18 中国工商银行股份有限公司 故障根源确定方法及装置、电子设备和可读存储介质
CN111082966A (zh) * 2019-11-01 2020-04-28 平安科技（深圳）有限公司 基于批量告警事件的定位方法、装置、电子设备及介质

Family Cites Families (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102118275A (zh) * 2009-12-30 2011-07-06 大唐移动通信设备有限公司 一种告警风暴的处理方法及处理装置
CN105117315B (zh) * 2015-08-06 2018-07-20 上海携程商务有限公司 基于cep的告警处理系统及方法
CN108880845B (zh) * 2017-05-16 2021-01-05 腾讯科技（深圳）有限公司 一种信息提示的方法以及相关装置
US10706107B2 (en) * 2017-05-30 2020-07-07 Open Text Sa Ulc Search systems and methods utilizing search based user clustering
CN107196804B (zh) * 2017-06-01 2020-07-10 国网山东省电力公司信息通信公司 电力系统终端通信接入网告警集中监控系统及方法
CN109213655B (zh) * 2018-07-19 2022-02-18 东软集团股份有限公司 针对告警的解决方案确定方法、装置、存储介质和设备
CN108847994B (zh) * 2018-07-25 2021-10-15 山东中创软件商用中间件股份有限公司 基于数据分析的告警定位方法、装置、设备以及存储介质

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20180254942A1 (en) * 2017-03-01 2018-09-06 Teoco Ltd. System and Method for Alarm Correlation and Root Cause Determination
CN110321411A (zh) * 2019-06-26 2019-10-11 国网江苏省电力有限公司 一种电网监控告警信息分类方法、系统及可读存储介质
CN110351150A (zh) * 2019-07-26 2019-10-18 中国工商银行股份有限公司 故障根源确定方法及装置、电子设备和可读存储介质
CN111082966A (zh) * 2019-11-01 2020-04-28 平安科技（深圳）有限公司 基于批量告警事件的定位方法、装置、电子设备及介质

Cited By (20)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113572633B (zh) * 2021-06-15 2023-05-19 阿里巴巴新加坡控股有限公司 根因定位方法、系统、设备及存储介质
CN113572633A (zh) * 2021-06-15 2021-10-29 阿里巴巴新加坡控股有限公司 根因定位方法、系统、设备及存储介质
CN114464547A (zh) * 2021-12-29 2022-05-10 上海赛美特软件科技有限公司 一种晶圆检验方法、装置、设备及存储介质
CN114363044A (zh) * 2021-12-30 2022-04-15 深信服科技股份有限公司 一种分层告警方法、系统、存储介质和终端
CN114363044B (zh) * 2021-12-30 2024-04-09 深信服科技股份有限公司 一种分层告警方法、系统、存储介质和终端
CN114399417A (zh) * 2021-12-31 2022-04-26 常熟昊虞电子信息科技有限公司 基于智慧城市的数据处理方法及服务器
CN114884795A (zh) * 2022-05-20 2022-08-09 远景智能国际私人投资有限公司 物联网场景中的告警信息处理方法、装置、计算机设备
CN115118464A (zh) * 2022-06-10 2022-09-27 深信服科技股份有限公司 一种失陷主机检测方法、装置、电子设备及存储介质
CN115277356A (zh) * 2022-07-29 2022-11-01 中国电信股份有限公司 告警信息的归并方法、装置及电子设备
CN115277356B (zh) * 2022-07-29 2024-03-12 中国电信股份有限公司 告警信息的归并方法、装置及电子设备
CN115296979B (zh) * 2022-08-01 2024-03-08 中国农业银行股份有限公司 一种故障处理方法、装置、设备及存储介质
CN115296979A (zh) * 2022-08-01 2022-11-04 中国农业银行股份有限公司 一种故障处理方法、装置、设备及存储介质
CN115277368A (zh) * 2022-08-02 2022-11-01 上海宏时数据系统有限公司 多平台告警方法、装置、电子设备和存储介质
CN115834335A (zh) * 2022-11-07 2023-03-21 中国建设银行股份有限公司 告警信息处理方法及装置、存储介质及电子设备
CN115866511A (zh) * 2022-11-18 2023-03-28 东土科技(宜昌)有限公司 定位系统中的硬件设备的监控方法及装置
CN115866511B (zh) * 2022-11-18 2023-11-24 东土科技(宜昌)有限公司 定位系统中的硬件设备的监控方法及装置
CN116054416B (zh) * 2023-03-15 2023-09-22 扬州康德电气有限公司 一种基于物联网的智能监控运维管理系统
CN116054416A (zh) * 2023-03-15 2023-05-02 扬州康德电气有限公司 一种基于物联网的智能监控运维管理系统
CN116991620B (zh) * 2023-08-03 2024-02-23 北京优特捷信息技术有限公司 一种解决方案确定方法、装置、设备及介质
CN116991620A (zh) * 2023-08-03 2023-11-03 北京优特捷信息技术有限公司 一种解决方案确定方法、装置、设备及介质

Also Published As

Publication number Publication date
CN111082966A (zh) 2020-04-28
CN111082966B (zh) 2022-08-12

Similar Documents

Publication Publication Date Title
WO2021082697A1 (zh) 基于批量告警事件的定位方法、装置、电子设备及介质
WO2021151279A1 (zh) 基于边缘计算的云监控方法、装置、电子设备及存储介质
US11811805B1 (en) Detecting fraud by correlating user behavior biometrics with other data sources
US12014283B2 (en) Systems and methods for identifying process flows from log files and visualizing the flow
US10733079B2 (en) Systems and methods for end-to-end testing of applications using dynamically simulated data
WO2017107965A1 (zh) 一种web异常检测方法和装置
US20230045726A1 (en) Video information processing method and apparatus, electronic device, and storage medium
US9292333B2 (en) Image instance mapping
EP3323046A1 (en) Apparatus and method of leveraging machine learning principals for root cause analysis and remediation in computer environments
JP6967541B2 (ja) データ処理システムのデータモジュール管理
WO2020082733A1 (zh) 基于业务规则的消息推送请求流量控制方法、装置及介质
WO2021196825A1 (zh) 摘要生成方法、装置、电子设备及介质
CN112306700A (zh) 一种异常rpc请求的诊断方法和装置
US20160308808A1 (en) Predicting viewing activity of a posting to an activity stream
US11315010B2 (en) Neural networks for detecting fraud based on user behavior biometrics
US20180300572A1 (en) Fraud detection based on user behavior biometrics
WO2021056731A1 (zh) 基于日志数据分析的行为检测方法、装置、设备及介质
WO2020042580A1 (zh) 人员分组方法、装置、电子装置及存储介质
CN110555482A (zh) 基于人工智能的低俗图片识别方法、装置及电子设备
WO2021196474A1 (zh) 用户兴趣画像方法及相关设备
CN111985545B (zh) 基于人工智能的目标数据检测方法、装置、设备及介质
CN106294406B (zh) 一种用于处理应用访问数据的方法与设备
US20240320329A1 (en) Machine Learning Model Adversarial Attack Monitoring
CN111931214A (zh) 数据处理方法、装置、服务器及存储介质
EP4024906B1 (en) Method for identifying a device using attributes and location signatures from the device

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20881127

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 20881127

Country of ref document: EP

Kind code of ref document: A1