WO2022257423A1 - 告警信息关联方法、装置、电子设备和可读存储介质 - Google Patents
告警信息关联方法、装置、电子设备和可读存储介质 Download PDFInfo
- Publication number
- WO2022257423A1 WO2022257423A1 PCT/CN2021/140396 CN2021140396W WO2022257423A1 WO 2022257423 A1 WO2022257423 A1 WO 2022257423A1 CN 2021140396 W CN2021140396 W CN 2021140396W WO 2022257423 A1 WO2022257423 A1 WO 2022257423A1
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- alarm
- association
- data
- information
- group
- Prior art date
Links
- 238000000034 method Methods 0.000 title claims abstract description 67
- 239000013598 vector Substances 0.000 claims abstract description 118
- 238000012545 processing Methods 0.000 claims abstract description 33
- 238000012544 monitoring process Methods 0.000 claims abstract description 24
- 239000011159 matrix material Substances 0.000 claims description 31
- 230000006835 compression Effects 0.000 claims description 10
- 238000007906 compression Methods 0.000 claims description 10
- 238000004590 computer program Methods 0.000 claims description 4
- 230000004044 response Effects 0.000 abstract description 3
- 230000008569 process Effects 0.000 description 18
- 238000004458 analytical method Methods 0.000 description 9
- 238000010586 diagram Methods 0.000 description 6
- 230000006870 function Effects 0.000 description 5
- OOXMVRVXLWBJKF-DUXPYHPUSA-N n-[3-[(e)-2-(5-nitrofuran-2-yl)ethenyl]-1,2,4-oxadiazol-5-yl]acetamide Chemical compound O1C(NC(=O)C)=NC(\C=C\C=2OC(=CC=2)[N+]([O-])=O)=N1 OOXMVRVXLWBJKF-DUXPYHPUSA-N 0.000 description 5
- 238000004364 calculation method Methods 0.000 description 3
- 238000013500 data storage Methods 0.000 description 3
- 238000007726 management method Methods 0.000 description 3
- 238000010223 real-time analysis Methods 0.000 description 3
- 230000006978 adaptation Effects 0.000 description 2
- 238000004891 communication Methods 0.000 description 2
- 238000005516 engineering process Methods 0.000 description 2
- 238000001914 filtration Methods 0.000 description 2
- 238000012423 maintenance Methods 0.000 description 2
- 238000012986 modification Methods 0.000 description 2
- 230000004048 modification Effects 0.000 description 2
- 238000012795 verification Methods 0.000 description 2
- 230000009471 action Effects 0.000 description 1
- 230000032683 aging Effects 0.000 description 1
- 238000003491 array Methods 0.000 description 1
- 238000012098 association analyses Methods 0.000 description 1
- 230000009286 beneficial effect Effects 0.000 description 1
- 238000010219 correlation analysis Methods 0.000 description 1
- 230000002354 daily effect Effects 0.000 description 1
- 238000007405 data analysis Methods 0.000 description 1
- 230000007547 defect Effects 0.000 description 1
- 238000001514 detection method Methods 0.000 description 1
- 230000000694 effects Effects 0.000 description 1
- 230000002708 enhancing effect Effects 0.000 description 1
- 230000003203 everyday effect Effects 0.000 description 1
- 230000003287 optical effect Effects 0.000 description 1
- 239000013307 optical fiber Substances 0.000 description 1
- 230000002093 peripheral effect Effects 0.000 description 1
- 238000007781 pre-processing Methods 0.000 description 1
- 230000000644 propagated effect Effects 0.000 description 1
- 230000008439 repair process Effects 0.000 description 1
- 238000002910 structure generation Methods 0.000 description 1
- 238000012549 training Methods 0.000 description 1
- 230000001960 triggered effect Effects 0.000 description 1
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/06—Management of faults, events, alarms or notifications
- H04L41/0604—Management of faults, events, alarms or notifications using filtering, e.g. reduction of information by using priority, element types, position or time
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/23—Clustering techniques
Definitions
- the present disclosure relates to the technical field of network monitoring, and in particular to an alarm information association method, device, electronic equipment and computer-readable storage medium.
- the communication network is large in scale, complex in structure, and diverse in equipment, and various hardware components and software modules generate a large amount of alarm information every day. If the alarm storm is not dealt with, the alarm monitoring personnel will frequently receive a large amount of miscellaneous alarm information. The alarm monitoring personnel can only extract effective information from the massive alarms based on experience. It is difficult to guarantee the accuracy of the root cause determination and the rapid convergence of the problem. and repair is difficult to guarantee.
- alarm information is filtered, merged, and associated by setting alarm association, so as to filter complicated information, merge repeated information, and directly display the association relationship of problem occurrence to monitoring personnel.
- the current alarm correlation monitoring scheme still has the following defects:
- the current alarm correlation scheme relies on frequent access to the database, resulting in a long alarm correlation analysis cycle, slow alarm output, and a large amount of calculation.
- the current alarm correlation method is mainly that a certain alarm is only associated with another alarm set, but in fact a certain alarm may be associated with multiple alarm sets, which makes the current alarm correlation scheme unable to reflect the complexity of the real scene.
- the purpose of the present disclosure is to provide an alarm information association method, device, electronic equipment, and computer-readable storage medium, at least to a certain extent, to overcome the problems of long alarm association analysis cycle, slow alarm output, and large amount of calculation in related technologies .
- a method for associating alarm information including: when the alarm information is collected, vectorize the alarm information to obtain an alarm vector; based on the alarm event represented by the alarm vector, in the alarm Obtain an alarm association model matching the alarm vector from the association probability model set; acquire a plurality of alarm association information of the alarm vector, and establish a relationship between the alarm vector and the plurality of alarm association information according to the alarm association model the association relationship; generate an alarm association tree according to the association relationship, and push the alarm association tree to the monitoring terminal.
- performing vectorization processing on the alarm information, before obtaining the alarm vector further includes: acquiring historical alarm data within a time stamp range; Performing vectorization processing on the historical alarm data set to obtain vectorized alarm data; performing correlation grouping processing on the vectorized alarm data to obtain group alarm data; generating a group alarm matrix based on the group alarm data; according to the group alarm matrix
- the alarm correlation model is derived to generate the alarm correlation probability model set based on the alarm correlation model.
- the generating a group alarm matrix based on the group alarm data specifically includes: performing a compression operation on each group of the group alarm data to obtain corresponding simplified group data; The data is standardized to obtain a standardized alarm sample; and the group alarm matrix is constructed based on the standardized sample.
- performing vectorization processing on the historical alarm data set to obtain vectorized alarm data includes: performing a clustering operation on the historical alarm data to obtain An abstract vector of an event; generating the vectorized alarm data according to the abstract vector, the historical occurrence time of the alarm event, and the historical duration of the alarm event.
- the compression operation is performed on each group of the group alarm data to obtain the corresponding simplified group data, which specifically includes: detecting the first group in each group of the group alarm data When the alarm data and the second group alarm data have the same abstract vector, the first group alarm data and the second group alarm data are combined into third group alarm data, so as to obtain the simplified group data.
- the combining the first group alarm data and the second group alarm data into third group alarm data specifically includes: combining the first group alarm data and the second group alarm data
- the earlier historical occurrence time in the second group of alarm data is determined as the historical occurrence time of the third group of alarm data; determine the time information of the later ending time in the first group of alarm data and the second group of alarm data ; Determine the historical duration of the third group alarm data according to the time information of the later end time and the historical occurrence time of the third group alarm data; according to the same abstract vector, the third group alarm
- the historical occurrence time of the data and the historical duration of the third group alarm data generate the third group alarm data, and delete the first group alarm data and the second group alarm data.
- the performing standardization processing on the condensed group data to obtain a standardized alarm sample specifically includes: calculating the corresponding condensed event according to the latest end event and earliest start time of the alarm event.
- the impact duration of the packet data sort the occurrence time of the alarm events to obtain a time-sorted sequence; perform a deduplication operation on the time-sorted sequence, and count the time-sorted sequence after the de-duplicated operation to obtain the time-sorted sequence Distortion times of the alarm event; configure the alarm duration threshold according to the impact duration, configure the distortion times threshold according to the distortion times; filter the simplified packet data according to the alarm duration threshold and/or the distortion times threshold, and The filtered simplified packet data is determined as the standardized alarm sample.
- the constructing the grouped alarm matrix based on the standardized sample specifically includes: sorting the alarm events based on the occurrence time to generate a relationship alarm sequence; traversing the relationship alarm sequence , generating the grouped alarm matrix according to the number of distortions of the alarm event and the corresponding position of the abstract vector in the relational alarm sequence.
- the deriving the alarm association model according to the group alarm matrix specifically includes: counting the association abstractions of each of the abstract vectors in the standardized alarm samples according to the group alarm matrix vector; counting the probability that the abstract vector occurs after the associated abstract vector; generating the alarm association model of the abstract vector according to the probability and the associated abstract vector.
- the establishment of the association relationship between the alarm vector and the plurality of alarm association information according to the alarm association model specifically includes: traversing the alarms formed by the plurality of alarm association information an association set; when it is detected that the first alarm associated information in the plurality of alarm associated information has a sounding time earlier than the time threshold, remove the first alarm associated information from the alarm associated set; When the alarm correlation set is an empty set, determine the alarm information as root alarm information, and add the alarm vector to the alarm correlation set; when it is detected that the alarm correlation set is a non-empty set, according to The alarm association model calculates the probability of sending the alarm information when the alarm association information occurs; when it is detected that the probability is greater than a probability threshold, an association relationship between the alarm information and the alarm association information is established .
- it further includes: adding the alarm association tree to the group alarm data based on the type of the alarm information; determining the alarm association model based on the generation frequency of the alarm association tree update frequency; updating the alarm correlation model based on the update frequency.
- a device for associating alarm information including: a processing module configured to perform vectorization processing on the alarm information when the alarm information is collected to obtain an alarm vector; an acquisition module configured to obtain an alarm vector based on For the alarm event represented by the alarm vector, an alarm correlation model matching the alarm vector is obtained from the alarm correlation probability model set; a building module is used to obtain a plurality of alarm correlation information of the alarm vector, and according to the alarm correlation The model establishes the association relationship between the alarm vector and the plurality of alarm association information; the generating module is configured to generate an alarm association tree according to the association relationship, and push the alarm association tree to the monitoring terminal.
- an electronic device including: a processor; and a memory for storing executable instructions of the processor; wherein, the processor is configured to execute any one of the above by executing the executable instructions Alarm information association method.
- a computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a processor, any one of the above alarm information association methods is implemented.
- the alarm information association scheme converts the alarm information collected in real time into the form of an alarm vector to obtain an alarm association model that matches the alarm vector from the pre-stored alarm association probability model set, and through The alarm association model establishes the association relationship between alarm information and alarm association information, and further pushes the association relationship to the monitoring terminal in the form of an alarm association tree.
- the alarm association probability model set and the alarm association probability model set Pre-stored in the memory it can reduce the number of IOs, further reduce the resource consumption of the association process, and increase the configuration speed of the alarm association tree.
- the alarm association tree can be generated in real time, which is beneficial to Improve the alarm monitoring experience and alarm response timeliness.
- the alarm correlation model is generated based on the analysis of a large amount of historical alarm data, so it can more accurately reflect the correlation between alarm information and multiple alarm correlation information, that is to say, multiple alarm correlations can be generated, and then Provide monitoring personnel with multiple verification paths based on alarm correlation, so that they can effectively use the alarm correlation information to query the cause of the alarm, which is conducive to improving the efficiency of alarm root cause analysis and fault location, assisting the decision-making analysis of operation and maintenance personnel, and improving the stability of business operation sex.
- FIG. 1 shows a flowchart of a method for associating alarm information in an embodiment of the present disclosure
- FIG. 2 shows a flow chart of another method for associating alarm information in an embodiment of the present disclosure
- FIG. 3 shows a flow chart of yet another method for associating alarm information in an embodiment of the present disclosure
- FIG. 4 shows a flowchart of another method for associating alarm information in an embodiment of the present disclosure
- FIG. 5 shows a flowchart of another method for associating alarm information in an embodiment of the present disclosure
- FIG. 6 shows a flowchart of another method for associating alarm information in an embodiment of the present disclosure
- FIG. 7 shows a flow chart of another method for associating alarm information in an embodiment of the present disclosure
- FIG. 8 shows a flowchart of another method for associating alarm information in an embodiment of the present disclosure
- FIG. 9 shows a flow chart of yet another method for associating alarm information in an embodiment of the present disclosure.
- FIG. 10 shows a schematic diagram of an alarm information association system in an embodiment of the present disclosure
- FIG. 11 shows a schematic diagram of an alarm association tree in an embodiment of the present disclosure
- FIG. 12 shows a schematic diagram of an alarm information associating device in an embodiment of the present disclosure
- Figure 13 shows a schematic diagram of an electronic device in an embodiment of the present disclosure.
- FIG. 14 shows a schematic diagram of a computer-readable storage medium in an embodiment of the present disclosure.
- Example embodiments will now be described more fully with reference to the accompanying drawings.
- Example embodiments may, however, be embodied in many forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided so that this disclosure will be thorough and complete and will fully convey the concept of example embodiments to those skilled in the art.
- the described features, structures or properties may be combined in any suitable manner in one or more embodiments.
- numerous specific details are provided in order to give a thorough understanding of embodiments of the present disclosure.
- those skilled in the art will appreciate that the technical solution of the present disclosure may be practiced without one or more of the specified details, or other components, devices, steps, etc. may be adopted.
- well-known technical solutions have not been shown or described in detail to avoid obscuring aspects of the present disclosure.
- the terminal and/or server executes the method for associating alarm information, including the following steps:
- Step S102 when the alarm information is collected, vectorize the alarm information to obtain an alarm vector.
- the alarm storm generated by the system in a short period of time contains a large amount of alarm information, some of which are caused by some common factors and have a certain relationship with each other, and some may not have any relationship. Therefore, an alarm association operation needs to be performed to find the association relationship between these information.
- the abstract vector representation of the alarm event is carried out to obtain the abstract vector of the alarm information, and the abstract vector, occurrence time and duration The time length is spliced to obtain the alarm vector.
- Step S104 based on the alarm event represented by the alarm vector, an alarm association model matching the alarm vector is obtained from the alarm association probability model set.
- multiple alarm correlation models are generated through pre-training, and these multiple alarm correlation models are used as a set of alarm correlation probability models. After the alarm vector is generated based on the alarm information received in real time, an alarm association model matching the alarm vector is searched in the alarm association probability model set, so as to establish an association relationship between the alarm information and other information based on the alarm association model.
- step S106 a plurality of alarm associated information of the alarm vector is obtained, and an association relationship between the alarm vector and the plurality of alarm associated information is established according to the alarm association model.
- the alarm information can include PIM (Physical Infrastructure Manager, physical infrastructure manager) alarm, VIM (text editor) alarm and VNF (virtual network function) alarm, when VNF alarms, EMS (Element Management System) reports to For VFVO alarm data, it is necessary to provide the UUID (Universally Unique Identifier) of the VIM layer virtual machine corresponding to the VNF where the alarm occurred.
- UUID Universally Unique Identifier
- the VIM layer alarm is reported to NFVO through the northbound interface, it will also carry the UUID of the virtual machine. Therefore, it can be guaranteed that the VNF that has an alarm is associated with the VIM layer through the UUID of the VIM layer virtual machine.
- NFVO When PIM reports physical device alarms to NFVO through the northbound interface, it will carry the device serial number of the physical device.
- VIM layer alarms When VIM layer alarms are reported to NFVO through the northbound interface, NFVO can know which machine the alarm is located on based on the virtual machine UUID carried in the alarm data.
- NFVO On the computing nodes, NFVO pre-stores the device serial number of the physical device corresponding to each computing node. According to the device serial number and the virtual machine UUID carried in the alarm data, VIM alarms can be associated with PIM alarms. Based on these known association methods, a plurality of alarm association information of the alarm information is obtained, so as to further establish an association relationship between the alarm information and the alarm association information based on the alarm association model.
- Step S108 generating an alarm correlation tree according to the correlation relationship, and pushing the alarm correlation tree to the monitoring terminal.
- an alarm association model matching the alarm vector is obtained from the pre-stored alarm association probability model set, and the alarm information and alarm information are established through the alarm association model.
- the association relationship between the alarm association information further, the association relationship is pushed to the monitoring terminal in the form of an alarm association tree.
- the alarm association probability model set and storing the alarm association probability model set in memory it can reduce The number of IOs can further reduce the resource consumption of the correlation process and increase the configuration rate of the alarm correlation tree.
- the alarm correlation tree can be generated in real time, which is conducive to improving the alarm monitoring experience and alarm response. aging.
- the alarm correlation model is generated based on the analysis of a large amount of historical alarm data, so it can more accurately reflect the correlation between alarm information and multiple alarm correlation information, that is to say, multiple alarm correlations can be generated, and then Provide monitoring personnel with multiple verification paths based on alarm correlation, so that they can effectively use the alarm correlation information to query the cause of the alarm, which is conducive to improving the efficiency of alarm root cause analysis and fault location, assisting the decision-making analysis of operation and maintenance personnel, and improving the stability of business operation sex.
- Alarm correlation methods also include:
- Step S202 acquiring historical alarm data within the time stamp range.
- w j is the jth historical alarm data, j ⁇ [1,m],
- T s is the lower limit of the time stamp range
- T e is the upper limit of the time stamp range
- m is the number of historical alarm data w in the time stamp range [T s , T e ].
- T s and T e have a lot to do with the specific business situation. Choosing the appropriate T s and T e can effectively reduce the cost of building an alarm correlation model based on stock data. For example, T e takes the zero point of the day before the current time, and T s takes the zero point of T e 30 days ago.
- Step S204 performing vectorization processing on the historical alarm data set to obtain vectorized alarm data.
- the historical alarm data is vectorized to describe the event type, historical occurrence time and duration, etc. in the historical alarm data through the vector, and then based on the vectorized alarm data to explore the correlation between different historical alarm data , so as to construct multiple alarm correlation models based on these correlation relationships, and further construct an alarm correlation probability model set W V based on the multiple alarm correlation models.
- Step S206 performing correlation grouping processing on the vectorized alarm data to obtain grouped alarm data.
- the vectorized alarm data set W V is grouped by relevance, based on the data analysis of W V and the daily alarm registration and combing, the grouped alarm data set G is obtained, as shown in formula (3), which will have relevance
- the vectorized alarm data of is combined into a set of W Vi , as shown in formula (4).
- step S206 it also includes: generating a group alarm matrix based on the group alarm data, specifically including:
- Step S208 performing a compression operation on each group of grouped alarm data to obtain corresponding simplified grouped data.
- Step S210 performing standardization processing on the simplified packet data to obtain standardized alarm samples.
- Step S212 constructing a group alarm matrix based on standardized samples.
- Step S214 deduce an alarm association model according to the group alarm matrix, so as to generate an alarm association probability model set based on the alarm association model.
- an alarm association model is constructed based on historical alarm data, and standardized alarm data is constructed through alarm data vectorization, alarm interval identification, alarm data filtering and compression, and alarm layering. Based on the normalized vector alarm data, a The alarm correlation model realizes the effect of reflecting the internal business correlation of the alarm based on the alarm correlation model.
- step S204 is to vectorize the historical alarm data set to obtain a specific implementation of vectorized alarm data, including:
- Step S302 performing a clustering operation on the historical alarm data to obtain an abstract vector used to represent an alarm event.
- Step S304 generating vectorized alarm data according to the abstract vector, the historical occurrence time of the alarm event, and the historical duration of the alarm event.
- w i is the historical alarm data
- xi is the specific alarm event of w i , for example: CPU IDLE ⁇ 30%
- t i is the specific occurrence time of w i
- d i is w i duration.
- equation (6) shows that for The process of vectorizing data.
- V ⁇ v 1 ,...,v i ,...,v k ⁇ , i ⁇ [1, k]; k is the upper limit of the number of abstract vector enumerations, determined by specific services, and V is a type of alarm event Abstract vector representation of , after clustering all alarm data, V is obtained, and V is enumerable for a specific business field.
- V is a type of alarm event Abstract vector representation of , after clustering all alarm data, V is obtained, and V is enumerable for a specific business field.
- V can be obtained through the alarm vectorization process.
- X m ⁇ x 1 , . . . , x i , . . . , x m ⁇ , i ⁇ [1, m] (9)
- V ⁇ v 1 , . . . , v j , . . . , v k ⁇ , j ⁇ [1, k] (10)
- X m represents the set of m specific alarm information
- w vi represents the result of the vectorization process of historical alarm data w i , as shown in formula (11).
- v represents the vectorized result of x i through x i ⁇ v j
- t i is the historical occurrence time of w i
- d i is the historical duration of w i .
- a specific implementation manner of performing a compression operation on each group of grouped alarm data to obtain corresponding simplified grouped data includes:
- the first group warning data and the second group warning data in each group of group warning data have the same abstract vector
- the first group warning data and the second group warning data are combined into the third group warning data, so as to Get condensed group data.
- each subset W Vi in the packet alarm data set G is compressed to obtain a simplified packet data set GS, as shown in equations (12) and (13) respectively.
- W Vi in step 208 is different from W Vi in step 206 marked as GS.W Vi , W Vi in step 206 is marked as GW Vi , In particular, for any GS.W Vi , the vector results w v .v of vectorized alarms therein are not repeated. The process of compressing each group of alarm data W Vi will be described in detail below.
- a specific implementation of merging the first packet alarm data and the second packet alarm data into the third packet alarm data includes:
- Step S402 determining the earlier historical occurrence time of the first group alarm data and the second group alarm data as the historical occurrence time of the third group alarm data.
- Step S404 determining the time information of the later ending time in the first group alarm data and the second group alarm data.
- Step S406 Determine the historical duration of the third group of alarm data according to the time information of the later end time and the historical occurrence time of the third group of alarm data.
- Step S408 according to the same abstract vector, the historical occurrence time of the third group of alarm data and the historical duration of the third group of alarm data, generate the third group of alarm data, and delete the first group of alarm data and the second group of alarm data.
- w vc .d max(w va .t+w va .d,w vb .t+w va .d)-w vc .t (17)
- step S210 performing standardization processing on the simplified packet data, and a specific implementation manner of obtaining standardized alarm samples include:
- Step S502 according to the latest end event and earliest start time of the alarm event, calculate the impact duration of the corresponding condensed packet data.
- Step S504 sorting the occurrence time of the alarm events to obtain a time sorting sequence.
- Step S506 performing deduplication operation on the time sorting sequence, counting the time sorting sequence after deduplication operation, and obtaining the number of distortions of the alarm event.
- Step S508 configure the alarm duration threshold according to the impact duration, and configure the distortion times threshold according to the distortion times.
- Step S510 filter the simplified group data according to the alarm duration threshold and/or the distortion times threshold, and determine the filtered simplified group data as a standardized alarm sample.
- the simplified grouped data set GS is subjected to standardization processing to obtain a standardized alarm sample set G std , as shown in formula (18).
- G std ⁇ W V1 , . . . , W Vi , . . . , W Vn ⁇ (18)
- max(w v .t+w v .d) represents the moment at which the latest end time of w v in W Vi is obtained
- min(w v .t) represents the moment at which the earliest start time of w v in W Vi is obtained
- the difference between the two is the influence duration du i of W Vi
- the alarm group duration set DU is obtained after the overall processing of GS, as shown in formula (20).
- sort(w v .t) means to sort the occurrence time w v .t of all w v in W Vi from small to large, unique means to deduplicate the sorted results, and count means to deduplicate the deduplicated results Counting, the final count value is the number of distortions.
- G std ⁇ W V1 , . . . , W Vi , . . . , W Vn ⁇ (23)
- step S212 a specific implementation of building a group alarm matrix based on standardized samples, includes:
- Step S602 sort the alarm events based on the occurrence time, and generate a sequence of related alarms.
- Step S604 traversing the relational warning sequence, and generating a grouped warning matrix according to the number of distortions of the warning event and the position of the corresponding abstract vector in the relational warning sequence.
- the matrix group alarm set M is constructed based on G std , as shown in formula (24).
- G std ⁇ M is performed on each W Vi After the operation, j corresponds to the number of distortions, and K corresponds to the position of v in V.
- step S214 deduces a specific implementation of the alarm association model according to the group alarm matrix, including:
- step S702 the associated abstract vectors of each abstract vector in the standardized alarm samples are counted according to the group alarm matrix.
- Step S704 counting the probability of occurrence of the abstract vector after associating the abstract vector.
- Step S706 generating an alarm association model of the abstract vector according to the probability and the associated abstract vector.
- Step 7 Based on M, derive the alarm association probability model set P of the associated abstract vector set V, as shown in formula (26).
- v j ) represents the probability of v i occurring when the alarm vector v j occurs.
- the number list of each different alarm vector v i associated with v j based on the sample set G std can be calculated, denoted as c i , as shown in formula (27).
- v j ) represents the statistical sum of v i occurring after v j occurs.
- formula (28) that is, the alarm association model, can be obtained, and a set P of alarm association probability models is formed by a plurality of p(v i
- a specific implementation manner of establishing an association relationship between an alarm vector and multiple alarm association information according to an alarm association model includes:
- Step S802 traversing an alarm association set composed of a plurality of alarm association information.
- Step S804 when it is detected that among the plurality of alarm related information, the first alarm related information whose sounding time is earlier than the time threshold is detected, the first alarm related information is removed from the alarm related set.
- Step S806 when it is detected that the alarm association set is empty, determine the alarm information as the source alarm information, and add the alarm vector to the alarm association set.
- Step S808 when it is detected that the alarm association set is not empty, calculate the probability of sending the alarm information when the alarm association information occurs according to the alarm association model.
- Step S810 when it is detected that the probability is greater than the probability threshold, an association relationship between the alarm information and the alarm associated information is established.
- the association relationship is constructed in combination with the matching alarm association model p(v
- R is traversed, and if rw v .t>t0, the r is removed from R, otherwise, the traversal continues.
- t0 is an empirical parameter, which means that the time interval between two alarms is absolutely unrelated, usually 24h is optional, p0 is the probability that there is an alarm correlation, and the empirical parameter of this value is usually 0.3. Note that an alarm message may Has multiple alarm associations.
- the latest alarm correlation set R is obtained, which is also recorded as That is, the real-time alarm association is completed, and the association relationship is generated correspondingly.
- each alarm related information in the alarm related set R is expanded and represented in the form of a tree, as shown in Figure 11, w is the alarm information, w1 and w2 are the alarm related information in the alarm related set R, which are periodically pushed For monitoring personnel, it is convenient for monitoring personnel to see the alarm correlation with a clear logical structure. This push cycle can be set according to experience.
- it further includes: adding an alarm association tree to the group alarm data based on the type of alarm information; determining the update frequency of the alarm association model based on the generation frequency of the alarm association tree; updating the alarm based on the update frequency Association model.
- the process of generating the alarm association tree is equivalent to the process of marking the alarm information and the alarm association information.
- the update method of the alarm association model includes:
- Step S902 during the process of generating the association relationship of the alarm information, mark the alarm information and the alarm related information.
- Step S904 updating the marked data to the historical alarm data set. As shown in formula (30).
- W ⁇ w 1 , . . . , w i , . . . , w n ⁇ (30)
- Step S906 determine the update frequency of the alarm association model based on the time period and the update frequency of the historical alarm data set, so as to update the alarm association model based on the update frequency.
- Step S908 updating the alarm association model based on a preset update frequency.
- step S906 and step S908 may be executed.
- the determination of the time period is given by experts in combination with the business status, for example, it is updated once a week.
- the threshold value of the update frequency is given by experts based on the business status. For example, every 100 occurrences, the alarm model is adjusted immediately. If the alarm model needs to be adjusted, the automatic execution of the generation process of the alarm correlation model is triggered to obtain a new alarm correlation probability model set P new , and the alarm model adjustment based on the incremental data is completed.
- Figure 10 shows an alarm information association system.
- the alarm information association system includes: an alarm information collection module 1002, an incremental real-time analysis module 1004, an alarm association output module 1006, and an incremental alarm association model adjustment module 1008 , a data storage module 1010 , an inventory analysis module 1012 , an alarm correlation model storage module 1014 and an alarm correlation management module 1016 .
- the alarm information collection module 1002 is used to collect all real-time alarm information of the cloud platform.
- the incremental real-time analysis module 1004 is used to combine the alarm correlation model obtained from the alarm correlation model storage module 1014 based on the real-time alarm data provided by the alarm information collection module 1002, and synthesize the alarm correlation threshold to produce an alarm correlation result for alarm correlation display .
- the alarm correlation output module 1006 is used to intuitively output the alarm correlation results produced by the incremental real-time analysis module.
- the incremental alarm correlation model adjustment module 1008 is used to control the feedback adjustment timing of the alarm correlation model.
- the alarm association management module 1016 is used to view, manage, and mark stock alarm association information, and configure alarm association threshold information.
- the data storage module 1010 is used for storing stock (historical) alarm data and alarm associated data.
- the inventory analysis module 1012 is used to use the inventory alarm data set and related association results provided by the data storage module 1010 to perform calculation and analysis to obtain an alarm association model, and store the result in the alarm association model storage module 1014 .
- the alarm correlation model storage module 1014 is used for storing the alarm correlation model.
- the alarm information associating apparatus 1200 will be described below with reference to FIG. 12 .
- the apparatus 1200 for associating alarm information shown in FIG. 12 is only an example, and should not impose any limitation on the functions and scope of use of this embodiment of the present invention.
- the alarm information associating apparatus 1200 is expressed in the form of a hardware module.
- the components of the alarm information associating device 900 may include but not limited to: a processing module 1202, configured to perform vectorization processing on the alarm information when the alarm information is collected, to obtain an alarm vector; event, obtaining an alarm correlation model matching the alarm vector from the alarm correlation probability model set; building module 1206, used to obtain a plurality of alarm correlation information of the alarm vector, and establish a relationship between the alarm vector and multiple alarm correlation information according to the alarm correlation model The association relationship; the tree structure generation module 1208, configured to generate an alarm association tree according to the association relationship, and push the alarm association tree to the monitoring terminal.
- a model generation module 1210 configured to obtain historical alarm data within the time stamp range; vectorize the historical alarm data set to obtain vectorized alarm data; The data is grouped by association to obtain grouped alarm data; a grouped alarm matrix is generated based on the grouped alarm data; an alarm correlation model is derived based on the grouped alarm matrix, and an alarm correlation probability model set is generated based on the alarm correlation model.
- the model generation module 1210 is also used to: perform a compression operation on each group of group alarm data to obtain corresponding simplified group data; standardize the simplified group data to obtain standardized alarm samples; The sample builds a group alarm matrix.
- the model generation module 1210 is also used to: perform a clustering operation on historical alarm data to obtain an abstract vector used to represent an alarm event; according to the abstract vector, the historical occurrence time of the alarm event, the Historical duration, generate vectorized alarm data.
- the model generation module 1210 is further configured to: when detecting that the first group alarm data and the second group alarm data in each group of group alarm data have the same abstract vector, the first group alarm data The alarm data and the second group alarm data are combined into the third group alarm data to obtain the simplified group data.
- the model generating module 1210 is further configured to: determine the earlier historical occurrence time of the first group alarm data and the second group alarm data as the historical occurrence time of the third group alarm data; The first group of alarm data and the second group of alarm data end later time information; according to the end of the later time information and the historical occurrence time of the third group of alarm data, determine the historical duration of the third group of alarm data; according to the same The abstract vector, the historical occurrence time of the third group of alarm data and the historical duration of the third group of alarm data generate the third group of alarm data, and delete the first group of alarm data and the second group of alarm data.
- the model generation module 1210 is further configured to: calculate the impact duration of the corresponding condensed packet data according to the latest end event and earliest start time of the alarm event; sort the occurrence time of the alarm event to obtain Time sorting sequence; deduplicate the time sorting sequence, count the time sorting sequence after the deduplication operation, and obtain the number of distortions of the alarm event; configure the alarm duration threshold according to the impact duration, and configure the distortion times threshold according to the number of distortions; Filter the condensed group data according to the alarm duration threshold and/or the distortion times threshold, and determine the filtered condensed group data as a standardized alarm sample.
- the model generation module 1210 is also used to: sort the alarm events based on the time of occurrence, and generate a relationship alarm sequence; traverse the relationship alarm sequence, according to the number of distortions of the alarm events, and the corresponding abstract vector in the relationship position in the alarm sequence, generating a grouped alarm matrix.
- the model generation module 1210 is also used to: calculate the associated abstract vector of each abstract vector in the standardized alarm sample according to the group alarm matrix; count the probability of the abstract vector occurring after the associated abstract vector; according to the probability and Associating abstract vectors generates an alarm association model of abstract vectors.
- the establishing module 1206 is further configured to: traverse the alarm association set composed of multiple alarm association information; detect the first alarm association information whose sounding time is earlier than the time threshold among the plurality of alarm association information , remove the first alarm correlation information from the alarm correlation set; when it is detected that the alarm correlation set is an empty set, determine the alarm information as the source alarm information, and add the alarm vector to the alarm correlation set; When the association set is a non-empty set, the probability of sending the alarm information is calculated according to the alarm association model when the alarm association information occurs; when the detection probability is greater than the probability threshold, the association relationship between the alarm information and the alarm association information is established, and based on The alarm information updates the alarm association set;
- an update module 1212 configured to add an alarm association tree to historical alarm data; determine the update frequency of the alarm association model based on the generation frequency of the alarm association tree; update the alarm association based on the update frequency Model.
- FIG. 13 An electronic device 1300 according to this embodiment of the present invention is described below with reference to FIG. 13 .
- the electronic device 1300 shown in FIG. 13 is only an example, and should not limit the functions and scope of use of this embodiment of the present invention.
- electronic device 1300 takes the form of a general-purpose computing device.
- Components of the electronic device 1300 may include but not limited to: at least one processing unit 1310 , at least one storage unit 1320 , and a bus 1330 connecting different system components (including the storage unit 1320 and the processing unit 1310 ).
- the storage unit stores program codes, and the program codes can be executed by the processing unit 1310, so that the processing unit 1310 executes the steps according to various exemplary embodiments of the present invention described in the “Exemplary Methods” section of this specification.
- the processing unit 1310 may execute steps S102, S104, S106 and S108 as shown in FIG. 1, and other steps defined in the alarm information association method of the present disclosure.
- the storage unit 1320 may include a readable medium in the form of a volatile storage unit, such as a random access storage unit (RAM) 13201 and/or a cache storage unit 13202 , and may further include a read-only storage unit (ROM) 13203 .
- RAM random access storage unit
- ROM read-only storage unit
- the storage unit 1320 may also include a program/utility 13204 having a set (at least one) of program modules 13205, such program modules 13205 including but not limited to: an operating system, one or more application programs, other program modules, and program data, Implementations of networked environments may be included in each or some combination of these examples.
- Bus 1330 may represent one or more of several types of bus structures, including a memory cell bus or memory cell controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local area using any of a variety of bus structures. bus.
- Electronic device 1300 may also communicate with one or more external devices 1370 (e.g., keyboards, pointing devices, Bluetooth devices, etc.), and may also communicate with one or more devices that enable a user to interact with the electronic device, and/or communicate with one or more devices that enable The electronic device 1300 is capable of communicating with any device (eg, router, modem, etc.) that communicates with one or more other computing devices. Such communication may occur through input/output (I/O) interface 1350 . Moreover, the electronic device 1300 can also communicate with one or more networks (such as a local area network (LAN), a wide area network (WAN) and/or a public network such as the Internet) through the network adapter 1360 .
- networks such as a local area network (LAN), a wide area network (WAN) and/or a public network such as the Internet
- the network adapter 1360 communicates with other modules of the electronic device 1300 through the bus 1330 .
- other hardware and/or software modules may be used in conjunction with the electronic device, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and Data backup storage system, etc.
- the example implementations described here can be implemented by software, or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of the present disclosure can be embodied in the form of software products, and the software products can be stored in a non-volatile storage medium (which can be CD-ROM, U disk, mobile hard disk, etc.) or on the network , including several instructions to make a computing device (which may be a personal computer, a server, a terminal device, or a network device, etc.) execute the method according to the embodiments of the present disclosure.
- a computing device which may be a personal computer, a server, a terminal device, or a network device, etc.
- a computer-readable storage medium on which a program product capable of implementing the above-mentioned method in this specification is stored.
- various aspects of the present invention can also be implemented in the form of a program product, which includes program code.
- the program product runs on the terminal device, the program code is used to make the terminal device execute the above-mentioned Steps according to various exemplary embodiments of the invention are described in the "Exemplary Methods" section.
- a program product 1400 for realizing the above method according to an embodiment of the present invention is described, which can adopt a portable compact disc read-only memory (CD-ROM) and include program codes, and can be installed on a terminal device, For example running on a personal computer.
- a readable storage medium may be any tangible medium containing or storing a program, and the program may be used by or in combination with an instruction execution system, apparatus or device.
- a computer readable signal medium may include a data signal carrying readable program code in baseband or as part of a carrier wave. Such propagated data signals may take many forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the foregoing.
- a readable signal medium may also be any readable medium other than a readable storage medium that can transmit, propagate, or transport a program for use by or in conjunction with an instruction execution system, apparatus, or device.
- Program code embodied on a readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.
- Program code for carrying out the operations of the present invention may be written in any combination of one or more programming languages, including object-oriented programming languages—such as Java, C++, etc., as well as conventional procedural programming languages. Programming language - such as "C" or a similar programming language.
- the program code may execute entirely on the user's computing device, partly on the user's device, as a stand-alone software package, partly on the user's computing device and partly on a remote computing device, or entirely on the remote computing device or server to execute.
- the remote computing device may be connected to the user computing device through any kind of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., using an Internet service provider). business to connect via the Internet).
- LAN local area network
- WAN wide area network
- Internet service provider an Internet service provider
- steps of the methods of the present disclosure are depicted in the drawings in a particular order, there is no requirement or implication that the steps must be performed in that particular order, or that all illustrated steps must be performed to achieve the desired result. Additionally or alternatively, certain steps may be omitted, multiple steps may be combined into one step for execution, and/or one step may be decomposed into multiple steps for execution, etc.
- the technical solutions according to the embodiments of the present disclosure can be embodied in the form of software products, and the software products can be stored in a non-volatile storage medium (which can be CD-ROM, U disk, mobile hard disk, etc.) or on the network , including several instructions to make a computing device (which may be a personal computer, a server, a mobile terminal, or a network device, etc.) execute the method according to the embodiments of the present disclosure.
- a non-volatile storage medium which can be CD-ROM, U disk, mobile hard disk, etc.
- a computing device which may be a personal computer, a server, a mobile terminal, or a network device, etc.
Landscapes
- Engineering & Computer Science (AREA)
- Data Mining & Analysis (AREA)
- Theoretical Computer Science (AREA)
- Bioinformatics & Cheminformatics (AREA)
- Artificial Intelligence (AREA)
- Bioinformatics & Computational Biology (AREA)
- Computer Vision & Pattern Recognition (AREA)
- Evolutionary Biology (AREA)
- Evolutionary Computation (AREA)
- Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Life Sciences & Earth Sciences (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
本公开提供了一种告警信息关联方法、装置、电子设备和计算机可读存储介质，涉及网络监控技术领域。其中，告警信息关联方法包括：对在采集到告警信息时，对告警信息进行向量化处理，得到告警向量；基于告警向量表示的告警事件，在告警关联概率模型集合中获取与告警向量匹配的告警关联模型；获取告警向量的多个告警关联信息，根据告警关联模型建立告警向量与多个告警关联信息之间的关联关系；根据关联关系生成告警关联树，将告警关联树推送给监测终端。通过本公开的技术方案，基于实时采集到的告警信息和告警关联模型，能够实时生成告警关联树，有利于提升告警监测体验和告警响应时效。
Description
本公开要求于2021年06月08日提交的申请号为202110638004.2、名称为“告警信息关联方法、装置、电子设备和可读存储介质”的中国专利申请的优先权，该中国专利申请的全部内容通过引用全部并入本文。
本公开涉及网络监控技术领域，尤其涉及一种告警信息关联方法、装置、电子设备和计算机可读存储介质。
通信网络规模庞大，结构复杂，设备多种多样，各种硬件部件和软件模块每天产生大量的告警信息。告警风暴如果不加处理，会使告警监测人员频繁收到大量纷杂的告警信息，告警监测人员往往只能依据经验从海量告警中提取有效信息，其问题根源确定准确性难以保证，问题的快速收敛和修复难以保证。
相关技术中，通过设置告警关联，对告警信息进行过滤、合并和关联，以将纷杂信息过滤，将重复信息合并，将问题发生的关联关系直接展示给监测人员。但是目前采用的告警关联监控方案还存在以下缺陷：
(1)目前的告警关联方案由于依赖频繁访问数据库，导致告警关联分析周期长，告警产出慢，计算量大。
(2)目前的告警关联方式主要还是某一告警只和另一告警集合关联，而实际上某一告警可能和多重告警集合相关联，导致目前的告警关联方案无法反映现实场景的复杂性。
需要说明的是，在上述背景技术部分公开的信息仅用于加强对本公开的背景的理解，因此可以包括不构成对本领域普通技术人员已知的现有技术的信息。
发明内容
本公开的目的在于提供一种告警信息关联方法、装置、电子设备和计算机可读存储介质，至少在一定程度上克服由于相关技术中告警关联分析周期长，告警产出慢，计算量大的问题。
本公开的其他特性和优点将通过下面的详细描述变得显然，或部分地通过本公开的实践而习得。
根据本公开的一个方面，提供一种告警信息关联方法，包括：在采集到告警信息时，对所述告警信息进行向量化处理，得到告警向量；基于所述告警向量表示的告警事件，在告警关联概率模型集合中获取与所述告警向量匹配的告警关联模型；获取所述告警向量 的多个告警关联信息，根据所述告警关联模型建立所述告警向量与所述多个告警关联信息之间的关联关系；根据所述关联关系生成告警关联树，将所述告警关联树推送给监测终端。
在本公开的一个实施例中，所述在采集到告警信息时，对所述告警信息进行向量化处理，得到告警向量之前，还包括：获取处于时间戳范围内的历史告警数据；对所述历史告警数据集合进行向量化处理，得到向量化告警数据；对所述向量化告警数据进行关联性分组处理，得到分组告警数据；基于所述分组告警数据生成分组告警矩阵；根据所述分组告警矩阵推导出所述告警关联模型，以基于所述告警关联模型生成所述告警关联概率模型集合。
在本公开的一个实施例中，所述基于所述分组告警数据生成分组告警矩阵，具体包括：对每一组所述分组告警数据进行压缩操作，得到对应的精简分组数据；对所述精简分组数据进行标准化处理，得到标准化告警样本；基于所述标准化样本构建所述分组告警矩阵。
在本公开的一个实施例中，所述对所述历史告警数据集合进行向量化处理，得到向量化告警数据，具体包括：对所述历史告警数据执行聚类操作，得到用于表示所述告警事件的抽象向量；根据所述抽象向量、所述告警事件的历史发生时间、所述告警事件的历史持续时间，生成所述向量化告警数据。
在本公开的一个实施例中，所述对每一组所述分组告警数据进行压缩操作，得到对应的精简分组数据，具体包括：在检测到每一组所述分组告警数据中的第一分组告警数据和第二分组告警数据具有相同的所述抽象向量时，将所述第一分组告警数据和所述第二分组告警数据合并为第三分组告警数据，以得到所述精简分组数据。
在本公开的一个实施例中，所述将所述第一分组告警数据和所述第二分组告警数据合并为第三分组告警数据，具体包括：将所述第一分组告警数据和所述第二分组告警数据中较早的所述历史发生时间确定为所述第三分组告警数据的历史发生时间；确定所述第一分组告警数据和所述第二分组告警数据中结束较晚的时刻信息；根据所述结束较晚的时刻信息和所述第三分组告警数据的历史发生时间，确定所述第三分组告警数据的历史持续时间；根据相同的所述抽象向量、所述第三分组告警数据的历史发生时间和所述第三分组告警数据的历史持续时间，生成所述第三分组告警数据，并删除所述第一分组告警数据和所述第二分组告警数据。
在本公开的一个实施例中，所述对所述精简分组数据进行标准化处理，得到标准化告警样本，具体包括：根据所述告警事件的最晚结束事件和最早开始时间，计算对应的所述精简分组数据的影响时长；对所述告警事件的发生时间进行排序，得到时间排序序列；对所述时间排序序列进行去重操作，对去重操作后的所述时间排序序列进行计数，得到所述告警事件的畸变次数；根据所述影响时长配置告警时长阈值，根据所述畸变次数配置畸变次数阈值；根据所述告警时长阈值和/或所述畸变次数阈值对所述精简分组数据进行过滤，将过滤后的所述精简分组数据确定为所述标准化告警样本。
在本公开的一个实施例中，所述基于所述标准化样本构建所述分组告警矩阵，具体包括：对所述告警事件基于所述发生时间进行排序，生成关系告警序列；遍历所述关系告警序列，根据所述告警事件的畸变次数，以及对应的所述抽象向量在所述关系告警序列中的位置，生成所述分组告警矩阵。
在本公开的一个实施例中，所述根据所述分组告警矩阵推导出所述告警关联模型，具体包括：根据所述分组告警矩阵统计所述标准化告警样本中每个所述抽象向量的关联抽象向量；统计所述抽象向量在所述关联抽象向量之后发生的概率；根据所述概率和所述关联抽象向量生成所述抽象向量的所述告警关联模型。
在本公开的一个实施例中，所述根据所述告警关联模型建立所述告警向量与所述多个告警关联信息之间的关联关系，具体包括：遍历所述多个告警关联信息构成的告警关联集合；在检测到所述多个告警关联信息中具有发声时间早于时间阈值的第一告警关联信息时，在所述告警关联集合中移除所述第一告警关联信息；在检测到所述告警关联集合为空集时，将所述告警信息确定为根源告警信息，并将所述告警向量添加至所述告警关联集合中；在检测到所述告警关联集合为非空集合时，根据所述告警关联模型计算当所述告警关联信息发生时，所述告警信息发送的概率；在检测到所述概率大于概率阈值时，建立所述告警信息和所述告警关联信息之间的关联关系。
在本公开的一个实施例中，还包括：基于所述告警信息的类型将所述告警关联树添加至所述分组告警数据中；基于所述告警关联树的生成频率确定所述告警关联模型的更新频率；基于所述更新频率更新所述告警关联模型。
根据本公开的另一个方面，提供一种告警信息关联装置，包括：处理模块，用于在采集到告警信息时，对所述告警信息进行向量化处理，得到告警向量；获取模块，用于基于所述告警向量表示的告警事件，在告警关联概率模型集合中获取与所述告警向量匹配的告警关联模型；建立模块，用于获取所述告警向量的多个告警关联信息，根据所述告警关联模型建立所述告警向量与所述多个告警关联信息之间的关联关系；生成模块，用于根据所述关联关系生成告警关联树，将所述告警关联树推送给监测终端。
根据本公开的再一个方面，提供一种电子设备，包括：处理器；以及存储器，用于存储处理器的可执行指令；其中，处理器配置为经由执行可执行指令来执行上述任意一项的告警信息关联方法。
根据本公开的又一个方面，提供一种计算机可读存储介质，其上存储有计算机程序，计算机程序被处理器执行时实现上述任意一项的告警信息关联方法。
本公开的实施例所提供的告警信息关联方案，通过将实时采集到的告警信息转化为告警向量的形式，以在预存的告警关联概率模型集合中获取与告警向量匹配的告警关联模型，并通过告警关联模型建立告警信息和告警关联信息之间的关联关系，进一步，将关联关系以告警关联树的形式推送给监测终端，一方面，通过设置告警关联概率模型集合，并将告警关联概率模型集合预存在内存中，能够减少IO次数，并能够进一步降低关联过 程的资源消耗，提高告警关联树的配置速率，另一方面，通过基于实时采集到的告警信息，能够实时生成告警关联树，有利于提升告警监测体验和告警响应时效。
进一步地，告警关联模型是基于对大量历史告警数据进行分析生成的，因此能够较准确地反应出告警信息和多个告警关联信息之间的关联关系，也就是说可以生成多个告警关联，进而给监测人员提供多条基于告警关联的验证路径，从而能够有效地利用告警关联信息查询告警原因，有利于提高告警根因分析和故障定位效率，辅助运维人员的决策分析，提升业务运行的稳定性。
应当理解的是，以上的一般描述和后文的细节描述仅是示例性和解释性的，并不能限制本公开。
此处的附图被并入说明书中并构成本说明书的一部分，示出了符合本公开的实施例，并与说明书一起用于解释本公开的原理。显而易见地，下面描述中的附图仅仅是本公开的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1示出本公开实施例中一种告警信息关联方法的流程图；
图2示出本公开实施例中另一种告警信息关联方法的流程图；
图3示出本公开实施例中再一种告警信息关联方法的流程图；
图4示出本公开实施例中又一种告警信息关联方法的流程图；
图5示出本公开实施例中又一种告警信息关联方法的流程图；
图6示出本公开实施例中又一种告警信息关联方法的流程图；
图7示出本公开实施例中另一种告警信息关联方法的流程图；
图8示出本公开实施例中又一种告警信息关联方法的流程图；
图9示出本公开实施例中再一种告警信息关联方法的流程图；
图10示出本公开实施例中一种告警信息关联系统的示意图；
图11示出本公开实施例中一种告警关联树的示意图；
图12示出本公开实施例中一种告警信息关联装置的示意图；
图13示出本公开实施例中一种电子设备的示意图；和
图14示出本公开实施例中一种计算机可读存储介质的示意图。
现在将参考附图更全面地描述示例实施方式。然而，示例实施方式能够以多种形式 实施，且不应被理解为限于在此阐述的范例；相反，提供这些实施方式使得本公开将更加全面和完整，并将示例实施方式的构思全面地传达给本领域的技术人员。所描述的征、结构或性可以以任何合适的方式结合在一个或更多实施方式中。在下面的描述中，提供许多具体细节从而给出对本公开的实施方式的充分理解。然而，本领域技术人员将意识到，可以实践本公开的技术方案而省略所述定细节中的一个或更多，或者可以采用其它的、组元、装置、步骤等。在其它情况下，不详细示出或描述公知技术方案以避免喧宾夺主而使得本公开的各方面变得模糊。
此外，附图仅为本公开的示意性图解，图中相同的附图标记表示相同或类似的分，因而将省略对它们的重复描述。附图中所示的一些方框图是功能实体，不一定必须与物理或逻辑上独立的实体相对应。可以采用软件形式来实现这些功能实体，或在一个或多个硬件模块或集成电路中实现这些功能实体，或在不同网络和/或处理器装置和/或微控制器装置中实现这些功能实体。
下面结合附图对本公开示例实施方式进行详细说明。
如图1所示，终端和/或服务器执行告警信息关联方法，包括以下步骤：
步骤S102，在采集到告警信息时，对告警信息进行向量化处理，得到告警向量。
其中，在短时间内系统产生的告警风暴中包含大量的告警信息，这些信息有的是由某种共同因素引发，互相之间存在一定的关联，有的也可能没有任何关系。因此需要执行告警关联操作，以找到这些信息之间的关联关系。
具体地，通过解析实时接收到的告警信息所描述的告警事件、告警信息的发生时间和持续时长，对告警事件进行抽象向量表述，得到告警信息的抽象向量，通过对抽象向量、发生时间和持续时长进行拼接，得到告警向量。
步骤S104，基于告警向量表示的告警事件，在告警关联概率模型集合中获取与告警向量匹配的告警关联模型。
其中，通过预先训练生成多个告警关联模型，并将这多个告警关联模型作为一个告警关联概率模型集合。在基于实时接收到的告警信息生成告警向量后，在告警关联概率模型集合中寻找与该告警向量匹配的告警关联模型，以基于告警关联模型建立告警信息与其它信息之间的关联关系。
步骤S106，获取告警向量的多个告警关联信息，根据告警关联模型建立告警向量与多个告警关联信息之间的关联关系。
其中，为了得到当前采集到的告警信息的实际告警关联信息以及实际关联关系，需要获取可能与告警向量具有关联关系的多个告警关联信息，从而根据告警关联模型建立告警向量和告警关联信息之间的关联关系。
比如，告警信息可以包括PIM(Physical Infrastructure Manager，物理基础设施管理器)告警、VIM(文本编辑器)告警和VNF(虚拟网络功能)告警，当VNF发生告警时，EMS(单元管理系统)上报给VFVO告警数据时，需要提供发生告警的VNF 对应的VIM层虚机的通用唯一识别码UUID(Universally Unique Identifier)，VIM层的告警通过北向接口报给给NFVO时，也会携带虚机的UUID，因此可以保证发生告警的VNF通过VIM层虚机的UUID与VIM层进行关联。PIM通过北向接口向NFVO报告物理设备告警时，会携带物理设备的设备序列号，VIM层告警通过北向接口报告给NFVO时，根据告警数据携带的虚机UUID，NFVO可以知道该告警位于哪一台计算节点上，而且NFVO预先存储有每一个计算节点对应的物理设备的设备序列号，根据该设备序列号和告警数据携带的虚机UUID，可以将VIM告警与PIM告警关联。基于这些已知的关联方式，得到告警信息的多个告警关联信息，以进一步基于告警关联模型建立告警信息和告警关联信息之间的关联关系。
步骤S108，根据关联关系生成告警关联树，将告警关联树推送给监测终端。
其中，通过将关联关系以告警关联树的方式推送给监测终端，能够便于监测人员看到逻辑结构清晰的告警关联情况。
在该实施例中，通过将实时采集到的告警信息转化为告警向量的形式，以在预存的告警关联概率模型集合中获取与告警向量匹配的告警关联模型，并通过告警关联模型建立告警信息和告警关联信息之间的关联关系，进一步，将关联关系以告警关联树的形式推送给监测终端，一方面，通过设置告警关联概率模型集合，并将告警关联概率模型集合预存在内存中，能够减少IO次数，并能够进一步降低关联过程的资源消耗，提高告警关联树的配置速率，另一方面，通过基于实时采集到的告警信息，能够实时生成告警关联树，有利于提升告警监测体验和告警响应时效。
进一步地，告警关联模型是基于对大量历史告警数据进行分析生成的，因此能够较准确地反应出告警信息和多个告警关联信息之间的关联关系，也就是说可以生成多个告警关联，进而给监测人员提供多条基于告警关联的验证路径，从而能够有效地利用告警关联信息查询告警原因，有利于提高告警根因分析和故障定位效率，辅助运维人员的决策分析，提升业务运行的稳定性。
如图2所示，在本公开的一个实施例中，在步骤S102，采集到告警信息时，对告警信息进行向量化处理，得到告警向量之前，基于历史告警数据生成告警关联模型，具体地，告警关联方法还包括：
步骤S202，获取处于时间戳范围内的历史告警数据。
具体地，所有的历史告警数据集合采用式(1)表示：
W＝{w
1,...,w
i,...,w
n} (1)
n为存量告警数量；w
i为第i个告警数据，i∈[1,n]。
获取时间戳范围内的[T
s,T
e]的存量告警数据集合采用式(2)表示：
w
j为第j个历史告警数据，j∈[1,m]，
T
s为时间戳范围的下限，T
e为时间戳范围的上限，m为时间戳范围[T
s,T
e]中历史告警 数据w的数量。
通常T
s和T
e的选取和具体业务情况有较大关系，选择合适的T
s和T
e能有效降低基于存量数据构建告警关联模型的开销。比如T
e取当前时间前一天的零点，T
s取T
e30天之前的零点。
步骤S204，对历史告警数据集合进行向量化处理，得到向量化告警数据。
其中，通过将历史告警数据进行向量化处理，以通过向量描述出历史告警数据中的事件类型、历史发生时间和持续时长等，进而基于向量化告警数据去探寻不同历史告警数据之间的关联关系，以基于这些关联关系构建出多个告警关联模型，并进一步基于多个告警关联模型构建出告警关联概率模型集合W
V。
步骤S206，对向量化告警数据进行关联性分组处理，得到分组告警数据。
具体地，对向量化告警数据集合W
V进行关联性分组，基于对W
V的数据分析配合日常报警登记和梳理进行，得到分组告警数据集合G，如式(3)所示，将具有关联性的向量化告警数据合并到一组W
Vi中，如式(4)所示。
G＝{W
V1，...，W
Vi，...，W
Vx} (3)
W
Vi＝{w
v1，...，w
vj，...，w
vy} (4)
其中，x＜＜m，y＜＜m，i∈[1，x]，j∈[1，y]；
在步骤S206后，还包括：基于分组告警数据生成分组告警矩阵，具体包括：
步骤S208，对每一组分组告警数据进行压缩操作，得到对应的精简分组数据。
步骤S210，对精简分组数据进行标准化处理，得到标准化告警样本。
步骤S212，基于标准化样本构建分组告警矩阵。
步骤S214，根据分组告警矩阵推导出告警关联模型，以基于告警关联模型生成告警关联概率模型集合。
在该实施例中，通过基于历史告警数据构建告警关联模型，通过告警数据向量化、告警区间识别、告警数据过滤压缩、告警分层构建规格化告警数据，基于规格化后的向量告警数据，构建告警关联模型，实现基于告警关联模型反映出告警内部的业务关联的效果。
如图3所示，在本公开的一个实施例中，步骤S204，对历史告警数据集合进行向量化处理，得到向量化告警数据的一种具体实现方式，包括：
步骤S302，对历史告警数据执行聚类操作，得到用于表示告警事件的抽象向量。
步骤S304，根据抽象向量、告警事件的历史发生时间、告警事件的历史持续时间，生成向量化告警数据。
其中，如式(5)所示，w
i为历史告警数据，x
i为w
i的具体报警事件，比如：CPU IDLE＜30％，t
i为w
i的具体发生时间，d
i为w
i的持续时间。
w
i＝(x
i,t
i,d
i) (5)
具体地，式(6)示出了对
数据进行向量化的过程。
得到的向量化告警数据集合如式(7)所示：
V＝{v
1，...，v
i，...，v
k}，i∈[1，k]；k为抽象向量枚举数量的上限，由具体业务确定，V为一类告警事件的抽象向量表述，通过对所有告警数据进行聚类后，得到V，V对于某一具体的业务领域，具有可枚举性。同时我们将a～b个具体报警信息x抽象的用告警向量v
c体现，称为告警的向量化过程，如式(8)所示：
x
a～b→v
c (8)
通常的，对于确定的X
m可以通过告警的向量化过程得到V。
X
m＝{x
1，...，x
i，...，x
m}，i∈[1，m] (9)
V＝{v
1，...，v
j，...，v
k}，j∈[1，k] (10)
其中，m＞＞k，X
m表示m个具体报警信息的集合，w
vi表示历史告警数据w
i向量化过程后的结果，如式(11)所示。
w
vi＝(v，t
i，d
i) (11)
其中，v表示由x
i经过x
i→v
j向量化后的结果，t
i为w
i的历史发生时间，d
i为w
i的历史持续时间。
在本公开的一个实施例中，步骤S208，对每一组分组告警数据进行压缩操作，得到对应的精简分组数据的一种具体实现方式，包括：
在检测到每一组分组告警数据中的第一分组告警数据和第二分组告警数据具有相同的抽象向量时，将第一分组告警数据和第二分组告警数据合并为第三分组告警数据，以得到精简分组数据。
具体地，对分组告警数据集合G中的每一个子集合W
Vi进行压缩，得到精简分组数据集合GS，分别如式(12)和式(13)所示。
GS＝{W
V1，...，W
Vi，...，W
Vx} (12)
W
Vi＝{w
v1，...，w
vj，...，w
vy} (13)
进一步的，x＝count(GS)；y＝count(GS.W
Vi)；x≤count(G)；y≤count(G.W
Vi)；i∈[1，x]，j∈[1，y]；将步骤208中W
Vi有别于步骤206中的W
Vi标记为GS.W
Vi，把步骤206中的W
Vi标记为G.W
Vi，
特别的，对于任意GS.W
Vi，其中的向量化告警的向量结果w
v.v不重复。下面对对每一组分组告警数据W
Vi进行压缩操作的过程进行详细描述。
对G.W
Vi进行压缩的主要方法是对进行告警向量w
v合并，具体合并方法为如果G.W
Vi中任意两个告警向量w
va(对应于第一分组告警数据)和w
vb(对应于第二分组告警数据)满足w
va.v＝w
vb.v，则操作对w
va和w
vb做合并操作得到新的告警向量w
vc，记为告警向量压缩，表示为式(14)。
w
va，w
vb→w
vc (14)
如图4所示，在本公开的一个实施例中，将第一分组告警数据和第二分组告警数 据合并为第三分组告警数据的一种具体实现方式，包括：
步骤S402，将第一分组告警数据和第二分组告警数据中较早的历史发生时间确定为第三分组告警数据的历史发生时间。
步骤S404，确定第一分组告警数据和第二分组告警数据中结束较晚的时刻信息。
步骤S406，根据结束较晚的时刻信息和第三分组告警数据的历史发生时间，确定第三分组告警数据的历史持续时间。
步骤S408，根据相同的抽象向量、第三分组告警数据的历史发生时间和第三分组告警数据的历史持续时间，生成第三分组告警数据，并删除第一分组告警数据和第二分组告警数据。
具体地，合并的具体操作过程如式(15)至式(17)所示。
w
vc.v＝w
va.v (15)
w
vc.t＝min(w
va.t，w
vb.t) (16)
w
vc.d＝max(w
va.t+w
va.d，w
vb.t+w
va.d)-w
vc.t (17)
在对G.W
Vi中所有满足实施w
va，w
vb→w
vc条件的告警向量w
v进行向量压缩后，得到压缩后的告警向量子集GS.W
Vi。最终得到精简分组数据集合GS。
如图5所示，在本公开的一个实施例中，步骤S210，对精简分组数据进行标准化处理，得到标准化告警样本的一种具体实现方式包括：
步骤S502，根据告警事件的最晚结束事件和最早开始时间，计算对应的精简分组数据的影响时长。
步骤S504，对告警事件的发生时间进行排序，得到时间排序序列。
步骤S506，对时间排序序列进行去重操作，对去重操作后的时间排序序列进行计数，得到告警事件的畸变次数。
步骤S508，根据影响时长配置告警时长阈值，根据畸变次数配置畸变次数阈值。
步骤S510，根据告警时长阈值和/或畸变次数阈值对精简分组数据进行过滤，将过滤后的精简分组数据确定为标准化告警样本。
其中，精简分组数据集合GS进行标准化处理，得到标准化告警样本集合G
std，如式(18)所示。
G
std＝{W
V1，...，W
Vi，...，W
Vn} (18)
其中，n≤count(GS)，i∈[1，n]。
具体地，首先，计算W
Vi的影响时长du
i，如式(19)所示。
du＝max(w
v.t+w
v.d)-min(w
v.t) (19)
上式中，max(w
v.t+w
v.d)表示获取W
Vi中w
v结束时间最晚的时刻，min(w
v.t)表示获取W
Vi中w
v最早的开始时间的时刻，两者的差值即为W
Vi的影响时长du
i，对GS整体处理后得到告警组时长集合DU，如式(20)所示。
DU＝{du
1，...，du
i，...，du
c} (20)
其中，i∈[1，c]。
然后，计算W
Vi的畸变次数ch
i，如式(21)所示。
ch＝count(unique(sort(w
v.t))) (21)
其中，sort(w
v.t)表示对W
Vi中所有w
v的发生时间w
v.t进行从小到大排序，unique表示对排序后的结果进行去重，count表示对去重后的结果进行计数，最终得到的计数值就为畸变次数。在对GS整体处理后得到告警组畸变统计集合CH，如式(22)所示。
CH＝{ch
1，...，ch
i，...，ch
c} (22)
其中，i∈[1，c]。
结合实际情况和专家意见，选取合适的告警时长阈值du
d和畸变次数阈值ch
d对GS进行过滤，降低边缘数据对最终告警概率模型的干扰。
具体地，令du
d从1开始逐渐增加，使得P(du
d＞du
i)＞0.9，得到目标du
d。令ch
d从1开始逐渐增加，使得P(ch
d＞ch
i)＞0.9，得到目标ch
d。最后过滤掉GS中，du＞du
d，或ch＞ch
d的W
Vi，得到新的G
std，如式(23)所示。
G
std＝{W
V1，...，W
Vi，...，W
Vn} (23)
其中，n≤c。
如图6所示，在本公开的一个实施例中，步骤S212，基于标准化样本构建分组告警矩阵的一种具体实现方式，包括：
步骤S602，对告警事件基于发生时间进行排序，生成关系告警序列。
步骤S604，遍历关系告警序列，根据告警事件的畸变次数，以及对应的抽象向量在关系告警序列中的位置，生成分组告警矩阵。
其中，基于G
std构建矩阵化分组告警集合M，如式(24)所示。
式中，j＝G
std.W
Vi.ch
d，
为矩阵化分组告警，如式(25)所示。
其中，G
std→M是通过对每个W
Vi进行
操作后得到，j对应的畸变次数，K对应v在V中的位置。
具体地，对于W
Vi来说，由于经过了压缩、过滤等预处理，所以每一个W
Vi.w
v都可以和不同的抽象告警向量v进行对应，对W
Vi中所有w
v按照w
v.t进行从小到大排序，获取具有先后关系的告警序列W
Vsi，对于W
Vsi进行遍历，定义临时变量x，临时变量y和一个k×j的零矩阵
初始的令x＝1，令
获取W
Vsi的第i个元素，如果存在，则记为w
vi，如果不存在，则退出遍历过程，获取w
vi.v在V中的位置m，m∈[1，k]，如果i＞1且w
vi.t＞w
v(i-1).t，则令y＝y+1，令n＝y+i，
如图7所示，在本公开的一个实施例中，步骤S214，根据分组告警矩阵推导出 告警关联模型的一种具体实现方式，包括：
步骤S702，根据分组告警矩阵统计标准化告警样本中每个抽象向量的关联抽象向量。
步骤S704，统计抽象向量在关联抽象向量之后发生的概率。
步骤S706，根据概率和关联抽象向量生成抽象向量的告警关联模型。
步骤7，基于M推导关联抽象向量集合V的告警关联概率模型集合P，如式(26)所示。
P＝{p(v
i|v
j)} (26)
其中，i∈[1，k]，j∈[1，k]，i≠j，p(v
i|v
j)表示告警向量v
j发生时，v
i发生的概率。
具体地，根据M，可以统计出基于样本集合G
std的每个不同告警向量v
i关联v
j的数量列表，记为c
i，如式(27)所示。
c
i＝{count(v
i|v
j)} (27)
其中，i∈[1，k]，j∈[1，k]，i≠j，count(v
i|v
j)表示v
j发生后，v
i随后发生的统计和。由此可以得到式(28)，即告警关联模型，由多个p(v
i|v
j)构成告警关联概率模型集合P。
如图8所示，在本公开的一个实施例中，步骤S106中，根据告警关联模型建立告警向量与多个告警关联信息之间的关联关系的一种具体实现方式包括：
步骤S802，遍历多个告警关联信息构成的告警关联集合。
步骤S804，在检测到多个告警关联信息中具有发声时间早于时间阈值的第一告警关联信息时，在告警关联集合中移除第一告警关联信息。
步骤S806，在检测到告警关联集合为空集时，将告警信息确定为根源告警信息，并将告警向量添加至告警关联集合中。
步骤S808，在检测到告警关联集合为非空集合时，根据告警关联模型计算当告警关联信息发生时，告警信息发送的概率。
步骤S810，在检测到概率大于概率阈值时，建立告警信息和告警关联信息之间的关联关系。
具体地，根据多个告警关联信息构成的告警关联集合R＝{r...}，结合匹配的告警关联模型p(v|v
j)构建关联关系
如式(29)所示。
其中，
描述了采集到的告警信息w和已有多个告警关联信息r之间的关联关系。
如果检测到不存在与告警信息关联的告警关联集合R，则设定当前告警关联集合R＝{r
e}，r
e表示空的告警关联情况。
具体地，遍历R，如果其中的r.w
v.t＞t0，则从R中移出该r，否则继续遍历。
完成上述遍历后，如果R＝{r
e}，则
表示当前告警w自身为根源告警，并将
放入告警关联集合R中，否则遍历R，对于其中的每一个r，令v
j＝r.w
v.v，如果p(v|v
j)＞p0，则认为w
v和r关联，此时构造新的告警关联r
0＝(w
v，r)，并替换R中的r为r
0；如果p(v|v
j)≤p0，则继续遍历过程。上述流程中t0为经验参数，表示两个告警绝对无关联的时间间隔，通常可选24h，p0是认为存在告警关联的概率，该值经验参数，通常可选为0.3，注意，一个告警信息可能具有多个告警关联。
完成上述操作后，即得到最新的告警关联集合R，也记为
即完成了实时告警关联，并对应生成关联关系。
进一步地，将告警关联集合R中每个告警关联信息以树的形式展开表示，如图11所示，w为告警信息，w1和w2为告警关联集合R中的告警关联信息，周期性的推送给监测人员，方便监测人员看到逻辑结构清晰的告警关联情况。此推送周期可以根据经验设定。
在本公开的一个实施例中，还包括：基于告警信息的类型将告警关联树添加至所述分组告警数据中；基于告警关联树的生成频率确定告警关联模型的更新频率；基于更新频率更新告警关联模型。
其中，生成告警关联树的过程，相当于对告警信息与告警关联信息进行打标的过程，如图9所示，告警关联模型的更新方法，包括：
步骤S902，在生成告警信息的关联关系的过程中，对告警信息和告警关联信息进行打标。
步骤S904，将打标后的数据更新至历史告警数据集合。如式(30)所示。
W＝{w
1，...，w
i，...，w
n} (30)
步骤S906，基于时间周期和历史告警数据集合的更新频次确定告警关联模型的更新频率，以基于更新频率更新告警关联模型。
步骤S908，基于预设的更新频率更新告警关联模型。
其中，步骤S906和步骤S908择一执行即可。
其中，时间周期的确定由专家结合业务现状给出，比如，每周更新一次。更新频次的阀值由专家结合业务现状给出，比如，每发生100次，就立即调节告警模型。如需调节告警模型，则触发告警关联模型的生成流程的自动执行得到新的告警关联概率模型集合P
new，完成基于增量数据的告警模型调节。
图10示出了一种告警信息关联系统，如图10所示，告警信息关联系统包括：告警信息采集模块1002、增量实时分析模块1004、告警关联输出模块1006、增量告警关联模型调节模块1008、数据存储模块1010、存量分析模块1012、告警关联模型存储模块1014和告警关联管理模块1016。
告警信息采集模块1002用于采集云平台所有实时告警信息。
增量实时分析模块1004用于基于告警信息采集模块1002提供的实时告警数据， 结合从告警关联模型存储模块1014获取的告警关联模型，综合告警关联阈值，产出用于告警关联展示的告警关联结果。
告警关联输出模块1006用于直观的输出增量实时分析模块产出的告警关联结果。
增量告警关联模型调节模块1008用于控制告警关联模型的反馈调节时机。
告警关联管理模块1016用于查看，管理，标记存量告警关联信息，配置告警关联阈值信息。
数据存储模块1010用于存储存量(历史)告警数据及告警关联数据。
存量分析模块1012用于使用数据存储模块1010提供的存量告警数据集和相关关联结果，进行计算分析，得到告警关联模型，并将结果存储到告警关联模型存储模块1014。
告警关联模型存储模块1014用于存储告警关联模型。
需要注意的是，上述附图仅是根据本发明示例性实施例的方法所包括的处理的示意性说明，而不是限制目的。易于理解，上述附图所示的处理并不表明或限制这些处理的时间顺序。另外，也易于理解，这些处理可以是例如在多个模块中同步或异步执行的。
所属技术领域的技术人员能够理解，本发明的各个方面可以实现为系统、方法或程序产品。因此，本发明的各个方面可以具体实现为以下形式，即：完全的硬件实施方式、完全的软件实施方式(包括固件、微代码等)，或硬件和软件方面结合的实施方式，这里可以统称为“电路”、“模块”或“系统”。
下面参照图12来描述根据本发明的这种实施方式的告警信息关联装置1200。图12所示的告警信息关联装置1200仅仅是一个示例，不应对本发明实施例的功能和使用范围带来任何限制。
告警信息关联装置1200以硬件模块的形式表现。告警信息关联装置900的组件可以包括但不限于：处理模块1202，用于在采集到告警信息时，对告警信息进行向量化处理，得到告警向量；获取模块1204，用于基于告警向量表示的告警事件，在告警关联概率模型集合中获取与告警向量匹配的告警关联模型；建立模块1206，用于获取告警向量的多个告警关联信息，根据告警关联模型建立告警向量与多个告警关联信息之间的关联关系；树结构生成模块1208，用于根据关联关系生成告警关联树，将告警关联树推送给监测终端。
在本公开的一个实施例中，还包括：模型生成模块1210，用于获取处于时间戳范围内的历史告警数据；对历史告警数据集合进行向量化处理，得到向量化告警数据；对向量化告警数据进行关联性分组处理，得到分组告警数据；基于分组告警数据生成分组告警矩阵；根据分组告警矩阵推导出告警关联模型，以基于告警关联模型生成告警关联概率模型集合。
在本公开的一个实施例中，模型生成模块1210还用于：对每一组分组告警数据 进行压缩操作，得到对应的精简分组数据；对精简分组数据进行标准化处理，得到标准化告警样本；基于标准化样本构建分组告警矩阵。
在本公开的一个实施例中，模型生成模块1210还用于：对历史告警数据执行聚类操作，得到用于表示告警事件的抽象向量；根据抽象向量、告警事件的历史发生时间、告警事件的历史持续时间，生成向量化告警数据。
在本公开的一个实施例中，模型生成模块1210还用于：在检测到每一组分组告警数据中的第一分组告警数据和第二分组告警数据具有相同的抽象向量时，将第一分组告警数据和第二分组告警数据合并为第三分组告警数据，以得到精简分组数据。
在本公开的一个实施例中，模型生成模块1210还用于：将第一分组告警数据和第二分组告警数据中较早的历史发生时间确定为第三分组告警数据的历史发生时间；确定第一分组告警数据和第二分组告警数据中结束较晚的时刻信息；根据结束较晚的时刻信息和第三分组告警数据的历史发生时间，确定第三分组告警数据的历史持续时间；根据相同的抽象向量、第三分组告警数据的历史发生时间和第三分组告警数据的历史持续时间，生成第三分组告警数据，并删除第一分组告警数据和第二分组告警数据。
在本公开的一个实施例中，模型生成模块1210还用于：根据告警事件的最晚结束事件和最早开始时间，计算对应的精简分组数据的影响时长；对告警事件的发生时间进行排序，得到时间排序序列；对时间排序序列进行去重操作，对去重操作后的时间排序序列进行计数，得到告警事件的畸变次数；根据影响时长配置告警时长阈值，根据畸变次数配置畸变次数阈值；根据所示告警时长阈值和/或畸变次数阈值对精简分组数据进行过滤，将过滤后的精简分组数据确定为标准化告警样本。
在本公开的一个实施例中，模型生成模块1210还用于：对告警事件基于发生时间进行排序，生成关系告警序列；遍历关系告警序列，根据告警事件的畸变次数，以及对应的抽象向量在关系告警序列中的位置，生成分组告警矩阵。
在本公开的一个实施例中，模型生成模块1210还用于：根据分组告警矩阵统计标准化告警样本中每个抽象向量的关联抽象向量；统计抽象向量在关联抽象向量之后发生的概率；根据概率和关联抽象向量生成抽象向量的告警关联模型。
在本公开的一个实施例中，建立模块1206还用于：遍历多个告警关联信息构成的告警关联集合；在检测到多个告警关联信息中具有发声时间早于时间阈值的第一告警关联信息时，在告警关联集合中移除第一告警关联信息；在检测到告警关联集合为空集时，将告警信息确定为根源告警信息，并将告警向量添加至告警关联集合中；在检测到告警关联集合为非空集合时，根据告警关联模型计算当告警关联信息发生时，告警信息发送的概率；在检测到概率大于概率阈值时，建立告警信息和告警关联信息之间的关联关系，并基于告警信息更新告警关联集合；
在本公开的一个实施例中，还包括：更新模块1212，用于将告警关联树添加至历 史告警数据中；基于告警关联树的生成频率确定告警关联模型的更新频率；基于更新频率更新告警关联模型。
下面参照图13来描述根据本发明的这种实施方式的电子设备1300。图13显示的电子设备1300仅仅是一个示例，不应对本发明实施例的功能和使用范围带来任何限制。
如图13所示，电子设备1300以通用计算设备的形式表现。电子设备1300的组件可以包括但不限于：上述至少一个处理单元1310、上述至少一个存储单元1320、连接不同系统组件(包括存储单元1320和处理单元1310)的总线1330。
其中，存储单元存储有程序代码，程序代码可以被处理单元1310执行，使得处理单元1310执行本说明书上述“示例性方法”部分中描述的根据本发明各种示例性实施方式的步骤。例如，处理单元1310可以执行如图1中所示的步骤S102、S104、S106和S108，以及本公开的告警信息关联方法中限定的其他步骤。
存储单元1320可以包括易失性存储单元形式的可读介质，例如随机存取存储单元(RAM)13201和/或高速缓存存储单元13202，还可以进一步包括只读存储单元(ROM)13203。
存储单元1320还可以包括具有一组(至少一个)程序模块13205的程序/实用工具13204，这样的程序模块13205包括但不限于：操作系统、一个或者多个应用程序、其它程序模块以及程序数据，这些示例中的每一个或某种组合中可能包括网络环境的实现。
总线1330可以为表示几类总线结构中的一种或多种，包括存储单元总线或者存储单元控制器、外围总线、图形加速端口、处理单元或者使用多种总线结构中的任意总线结构的局域总线。
电子设备1300也可以与一个或多个外部设备1370(例如键盘、指向设备、蓝牙设备等)通信，还可与一个或者多个使得用户能与该电子设备交互的设备通信，和/或与使得该电子设备1300能与一个或多个其它计算设备进行通信的任何设备(例如路由器、调制解调器等等)通信。这种通信可以通过输入/输出(I/O)接口1350进行。并且，电子设备1300还可以通过网络适配器1360与一个或者多个网络(例如局域网(LAN)，广域网(WAN)和/或公共网络，例如因特网)通信。如图所示，网络适配器1360通过总线1330与电子设备1300的其它模块通信。应当明白，尽管图中未示出，可以结合电子设备使用其它硬件和/或软件模块，包括但不限于：微代码、设备驱动器、冗余处理单元、外部磁盘驱动阵列、RAID系统、磁带驱动器以及数据备份存储系统等。
通过以上的实施方式的描述，本领域的技术人员易于理解，这里描述的示例实施方式可以通过软件实现，也可以通过软件结合必要的硬件的方式来实现。因此，根据本公开实施方式的技术方案可以以软件产品的形式体现出来，该软件产品可以存储在 一个非易失性存储介质(可以是CD-ROM，U盘，移动硬盘等)中或网络上，包括若干指令以使得一台计算设备(可以是个人计算机、服务器、终端装置、或者网络设备等)执行根据本公开实施方式的方法。
在本公开的示例性实施例中，还提供了一种计算机可读存储介质，其上存储有能够实现本说明书上述方法的程序产品。在一些可能的实施方式中，本发明的各个方面还可以实现为一种程序产品的形式，其包括程序代码，当程序产品在终端设备上运行时，程序代码用于使终端设备执行本说明书上述“示例性方法”部分中描述的根据本发明各种示例性实施方式的步骤。
参考图14所示，描述了根据本发明的实施方式的用于实现上述方法的程序产品1400，其可以采用便携式紧凑盘只读存储器(CD-ROM)并包括程序代码，并可以在终端设备，例如个人电脑上运行。然而，本发明的程序产品不限于此，在本文件中，可读存储介质可以是任何包含或存储程序的有形介质，该程序可以被指令执行系统、装置或者器件使用或者与其结合使用。
计算机可读信号介质可以包括在基带中或者作为载波一部分传播的数据信号，其中承载了可读程序代码。这种传播的数据信号可以采用多种形式，包括但不限于电磁信号、光信号或上述的任意合适的组合。可读信号介质还可以是可读存储介质以外的任何可读介质，该可读介质可以发送、传播或者传输用于由指令执行系统、装置或者器件使用或者与其结合使用的程序。
可读介质上包含的程序代码可以用任何适当的介质传输，包括但不限于无线、有线、光缆、RF等等，或者上述的任意合适的组合。
可以以一种或多种程序设计语言的任意组合来编写用于执行本发明操作的程序代码，所述程序设计语言包括面向对象的程序设计语言—诸如Java、C++等，还包括常规的过程式程序设计语言—诸如“C”语言或类似的程序设计语言。程序代码可以完全地在用户计算设备上执行、部分地在用户设备上执行、作为一个独立的软件包执行、部分在用户计算设备上部分在远程计算设备上执行、或者完全在远程计算设备或服务器上执行。在涉及远程计算设备的情形中，远程计算设备可以通过任意种类的网络，包括局域网(LAN)或广域网(WAN)，连接到用户计算设备，或者，可以连接到外部计算设备(例如利用因特网服务提供商来通过因特网连接)。
应当注意，尽管在上文详细描述中提及了用于动作执行的设备的若干模块或者单元，但是这种划分并非强制性的。实际上，根据本公开的实施方式，上文描述的两个或更多模块或者单元的特征和功能可以在一个模块或者单元中具体化。反之，上文描述的一个模块或者单元的特征和功能可以进一步划分为由多个模块或者单元来具体化。
此外，尽管在附图中以特定顺序描述了本公开中方法的各个步骤，但是，这并非要求或者暗示必须按照该特定顺序来执行这些步骤，或是必须执行全部所示的步骤才 能实现期望的结果。附加的或备选的，可以省略某些步骤，将多个步骤合并为一个步骤执行，以及/或者将一个步骤分解为多个步骤执行等。
通过以上的实施方式的描述，本领域的技术人员易于理解，这里描述的示例实施方式可以通过软件实现，也可以通过软件结合必要的硬件的方式来实现。因此，根据本公开实施方式的技术方案可以以软件产品的形式体现出来，该软件产品可以存储在一个非易失性存储介质(可以是CD-ROM，U盘，移动硬盘等)中或网络上，包括若干指令以使得一台计算设备(可以是个人计算机、服务器、移动终端、或者网络设备等)执行根据本公开实施方式的方法。
本领域技术人员在考虑说明书及实践这里公开的发明后，将容易想到本公开的其它实施方案。本申请旨在涵盖本公开的任何变型、用途或者适应性变化，这些变型、用途或者适应性变化遵循本公开的一般性原理并包括本公开未公开的本技术领域中的公知常识或惯用技术手段。说明书和实施例仅被视为示例性的，本公开的真正范围和精神由所附的权利要求指出。
Claims (14)
- 一种告警信息关联方法，其中，包括：在采集到告警信息时，对所述告警信息进行向量化处理，得到告警向量；基于所述告警向量表示的告警事件，在告警关联概率模型集合中获取与所述告警向量匹配的告警关联模型；获取所述告警向量的多个告警关联信息，根据所述告警关联模型建立所述告警向量与所述多个告警关联信息之间的关联关系；根据所述关联关系生成告警关联树，将所述告警关联树推送给监测终端。
- 根据权利要求1所述的告警信息关联方法，其中，所述在采集到告警信息时，对所述告警信息进行向量化处理，得到告警向量之前，还包括：获取处于时间戳范围内的历史告警数据；对所述历史告警数据集合进行向量化处理，得到向量化告警数据；对所述向量化告警数据进行关联性分组处理，得到分组告警数据；基于所述分组告警数据生成分组告警矩阵；根据所述分组告警矩阵推导出所述告警关联模型，以基于所述告警关联模型生成所述告警关联概率模型集合。
- 根据权利要求2所述的告警信息关联方法，其中，所述基于所述分组告警数据生成分组告警矩阵，具体包括：对每一组所述分组告警数据进行压缩操作，得到对应的精简分组数据；对所述精简分组数据进行标准化处理，得到标准化告警样本；基于所述标准化样本构建所述分组告警矩阵。
- 根据权利要求3所述的告警信息关联方法，其中，所述对所述历史告警数据集合进行向量化处理，得到向量化告警数据，具体包括：对所述历史告警数据执行聚类操作，得到用于表示所述告警事件的抽象向量；根据所述抽象向量、所述告警事件的历史发生时间、所述告警事件的历史持续时间，生成所述向量化告警数据。
- 根据权利要求4所述的告警信息关联方法，其中，所述对每一组所述分组告警数据进行压缩操作，得到对应的精简分组数据，具体包括：在检测到每一组所述分组告警数据中的第一分组告警数据和第二分组告警数据具有相同的所述抽象向量时，将所述第一分组告警数据和所述第二分组告警数据合并为第三 分组告警数据，以得到所述精简分组数据。
- 根据权利要求5所述的告警信息关联方法，其中，所述将所述第一分组告警数据和所述第二分组告警数据合并为第三分组告警数据，具体包括：将所述第一分组告警数据和所述第二分组告警数据中较早的所述历史发生时间确定为所述第三分组告警数据的历史发生时间；确定所述第一分组告警数据和所述第二分组告警数据中结束较晚的时刻信息；根据所述结束较晚的时刻信息和所述第三分组告警数据的历史发生时间，确定所述第三分组告警数据的历史持续时间；根据相同的所述抽象向量、所述第三分组告警数据的历史发生时间和所述第三分组告警数据的历史持续时间，生成所述第三分组告警数据，并删除所述第一分组告警数据和所述第二分组告警数据。
- 根据权利要求4所述的告警信息关联方法，其中，所述对所述精简分组数据进行标准化处理，得到标准化告警样本，具体包括：根据所述告警事件的最晚结束事件和最早开始时间，计算对应的所述精简分组数据的影响时长；对所述告警事件的发生时间进行排序，得到时间排序序列；对所述时间排序序列进行去重操作，对去重操作后的所述时间排序序列进行计数，得到所述告警事件的畸变次数；根据所述影响时长配置告警时长阈值，根据所述畸变次数配置畸变次数阈值；根据所述告警时长阈值和/或所述畸变次数阈值对所述精简分组数据进行过滤，将过滤后的所述精简分组数据确定为所述标准化告警样本。
- 根据权利要求3所述的告警信息关联方法，其中，所述基于所述标准化样本构建所述分组告警矩阵，具体包括：对所述告警事件基于所述发生时间进行排序，生成关系告警序列；遍历所述关系告警序列，根据所述告警事件的畸变次数，以及对应的所述抽象向量在所述关系告警序列中的位置，生成所述分组告警矩阵。
- 根据权利要求6所述的告警信息关联方法，其中，所述根据所述分组告警矩阵推导出所述告警关联模型，具体包括：根据所述分组告警矩阵统计所述标准化告警样本中每个所述抽象向量的关联抽象向量；统计所述抽象向量在所述关联抽象向量之后发生的概率；根据所述概率和所述关联抽象向量生成所述抽象向量的所述告警关联模型。
- 根据权利要求2至9中任一项所述的告警信息关联方法，其中，所述根据所述告警关联模型建立所述告警向量与所述多个告警关联信息之间的关联关系，具体包括：遍历所述多个告警关联信息构成的告警关联集合；在检测到所述多个告警关联信息中具有发声时间早于时间阈值的第一告警关联信息时，在所述告警关联集合中移除所述第一告警关联信息；在检测到所述告警关联集合为空集时，将所述告警信息确定为根源告警信息，并将所述告警向量添加至所述告警关联集合中；在检测到所述告警关联集合为非空集合时，根据所述告警关联模型计算当所述告警关联信息发生时，所述告警信息发送的概率；在检测到所述概率大于概率阈值时，建立所述告警信息和所述告警关联信息之间的关联关系。
- 根据权利要求10所述的告警信息关联方法，其中，还包括：基于所述告警信息的类型将所述告警关联树添加至所述分组告警数据中；基于所述告警关联树的生成频率确定所述告警关联模型的更新频率；基于所述更新频率更新所述告警关联模型。
- 一种告警信息关联装置，其中，包括：处理模块，用于在采集到告警信息时，对所述告警信息进行向量化处理，得到告警向量；获取模块，用于基于所述告警向量表示的告警事件，在告警关联概率模型集合中获取与所述告警向量匹配的告警关联模型；建立模块，用于获取所述告警向量的多个告警关联信息，根据所述告警关联模型建立所述告警向量与所述多个告警关联信息之间的关联关系；生成模块，用于根据所述关联关系生成告警关联树，将所述告警关联树推送给监测终端。
- 一种电子设备，其中，包括：处理器；以及存储器，用于存储所述处理器的可执行指令；其中，所述处理器配置为经由执行所述可执行指令来执行权利要求1～11中任意一 项所述的告警信息关联方法。
- 一种计算机可读存储介质，其上存储有计算机程序，其中，所述计算机程序被处理器执行时实现权利要求1～11中任意一项所述的告警信息关联方法。
Applications Claiming Priority (2)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202110638004.2A CN113381890B (zh) | 2021-06-08 | 2021-06-08 | 告警信息关联方法、装置、电子设备和可读存储介质 |
| CN202110638004.2 | 2021-06-08 |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| WO2022257423A1 true WO2022257423A1 (zh) | 2022-12-15 |
Family
ID=77576558
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| PCT/CN2021/140396 WO2022257423A1 (zh) | 2021-06-08 | 2021-12-22 | 告警信息关联方法、装置、电子设备和可读存储介质 |
Country Status (2)
| Country | Link |
|---|---|
| CN (1) | CN113381890B (zh) |
| WO (1) | WO2022257423A1 (zh) |
Cited By (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN115774653A (zh) * | 2023-02-15 | 2023-03-10 | 江西飞尚科技有限公司 | 预警研判方法、系统、可读存储介质及计算机设备 |
| CN115776409A (zh) * | 2023-01-29 | 2023-03-10 | 信联科技(南京)有限公司 | 一种工业网络安全事件基础数据定向采集方法及系统 |
| CN116015873A (zh) * | 2022-12-27 | 2023-04-25 | 北京天融信网络安全技术有限公司 | 网络安全告警处理方法、装置、设备及存储介质 |
| CN116980181A (zh) * | 2023-06-21 | 2023-10-31 | 江南信安（北京）科技有限公司 | 一种用于检测关联报警事件的方法及系统 |
| CN117112371A (zh) * | 2023-10-25 | 2023-11-24 | 杭银消费金融股份有限公司 | 一种可观测全链路日志追踪方法及系统 |
| CN117149587A (zh) * | 2023-08-28 | 2023-12-01 | 招商基金管理有限公司 | 监控台账管理方法、装置、存储介质及设备 |
| CN117201165A (zh) * | 2023-09-29 | 2023-12-08 | 中国电子科技集团公司第十五研究所 | 基于网络威胁信息的威胁告警关联分析方法 |
Families Citing this family (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN113381890B (zh) * | 2021-06-08 | 2023-01-13 | 天翼云科技有限公司 | 告警信息关联方法、装置、电子设备和可读存储介质 |
| CN114363148B (zh) * | 2021-12-20 | 2023-05-26 | 绿盟科技集团股份有限公司 | 一种检测攻击告警的方法、装置、检测设备及存储介质 |
| CN114500229B (zh) * | 2021-12-30 | 2024-02-02 | 国网河北省电力有限公司信息通信分公司 | 基于时空信息的网络告警定位及分析方法 |
| CN115150261B (zh) * | 2022-06-29 | 2024-04-19 | 北京天融信网络安全技术有限公司 | 告警分析的方法、装置、电子设备及存储介质 |
| CN115426242B (zh) * | 2022-08-05 | 2024-06-07 | 中国电信股份有限公司 | 告警事件处理方法、装置、电子设备及可读存储介质 |
| CN115756782A (zh) * | 2022-11-15 | 2023-03-07 | 支付宝(杭州)信息技术有限公司 | 一种大规模告警布防方法、装置以及设备 |
| CN116991684B (zh) * | 2023-08-03 | 2024-01-30 | 北京优特捷信息技术有限公司 | 一种告警信息处理方法、装置、设备及介质 |
Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20180150758A1 (en) * | 2016-11-30 | 2018-05-31 | Here Global B.V. | Method and apparatus for predictive classification of actionable network alerts |
| CN109117941A (zh) * | 2018-07-16 | 2019-01-01 | 北京思特奇信息技术股份有限公司 | 告警预测方法、系统、存储介质及计算机设备 |
| CN110321268A (zh) * | 2019-06-12 | 2019-10-11 | 平安科技（深圳）有限公司 | 一种告警信息处理方法及装置 |
| CN111274395A (zh) * | 2020-01-19 | 2020-06-12 | 河海大学 | 基于卷积和长短期记忆网络的电网监控告警事件识别方法 |
| CN111897673A (zh) * | 2020-07-31 | 2020-11-06 | 平安科技（深圳）有限公司 | 运维故障根因识别方法、装置、计算机设备和存储介质 |
| CN113381890A (zh) * | 2021-06-08 | 2021-09-10 | 中国电信股份有限公司 | 告警信息关联方法、装置、电子设备和可读存储介质 |
Family Cites Families (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN109189736B (zh) * | 2018-08-01 | 2021-01-26 | 中国联合网络通信集团有限公司 | 一种告警关联规则的生成方法和装置 |
| CN112202584B (zh) * | 2019-07-08 | 2022-07-29 | 中国移动通信集团浙江有限公司 | 告警关联方法、装置、计算设备及计算机存储介质 |
| CN110851321B (zh) * | 2019-10-10 | 2022-06-28 | 平安科技（深圳）有限公司 | 一种业务告警方法、设备及存储介质 |
| CN110929951B (zh) * | 2019-12-02 | 2022-04-19 | 电子科技大学 | 一种用于电网告警信号的关联分析和预测方法 |
| CN111475804B (zh) * | 2020-03-05 | 2023-10-24 | 杭州未名信科科技有限公司 | 一种告警预测方法及系统 |
| CN112118141B (zh) * | 2020-09-21 | 2021-12-17 | 中山大学 | 面向通信网络的告警事件关联压缩方法及装置 |
-
2021
- 2021-06-08 CN CN202110638004.2A patent/CN113381890B/zh active Active
- 2021-12-22 WO PCT/CN2021/140396 patent/WO2022257423A1/zh active Application Filing
Patent Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20180150758A1 (en) * | 2016-11-30 | 2018-05-31 | Here Global B.V. | Method and apparatus for predictive classification of actionable network alerts |
| CN109117941A (zh) * | 2018-07-16 | 2019-01-01 | 北京思特奇信息技术股份有限公司 | 告警预测方法、系统、存储介质及计算机设备 |
| CN110321268A (zh) * | 2019-06-12 | 2019-10-11 | 平安科技（深圳）有限公司 | 一种告警信息处理方法及装置 |
| CN111274395A (zh) * | 2020-01-19 | 2020-06-12 | 河海大学 | 基于卷积和长短期记忆网络的电网监控告警事件识别方法 |
| CN111897673A (zh) * | 2020-07-31 | 2020-11-06 | 平安科技（深圳）有限公司 | 运维故障根因识别方法、装置、计算机设备和存储介质 |
| CN113381890A (zh) * | 2021-06-08 | 2021-09-10 | 中国电信股份有限公司 | 告警信息关联方法、装置、电子设备和可读存储介质 |
Cited By (11)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN116015873A (zh) * | 2022-12-27 | 2023-04-25 | 北京天融信网络安全技术有限公司 | 网络安全告警处理方法、装置、设备及存储介质 |
| CN116015873B (zh) * | 2022-12-27 | 2023-08-29 | 北京天融信网络安全技术有限公司 | 网络安全告警处理方法、装置、设备及存储介质 |
| CN115776409A (zh) * | 2023-01-29 | 2023-03-10 | 信联科技(南京)有限公司 | 一种工业网络安全事件基础数据定向采集方法及系统 |
| CN115774653A (zh) * | 2023-02-15 | 2023-03-10 | 江西飞尚科技有限公司 | 预警研判方法、系统、可读存储介质及计算机设备 |
| CN116980181A (zh) * | 2023-06-21 | 2023-10-31 | 江南信安（北京）科技有限公司 | 一种用于检测关联报警事件的方法及系统 |
| CN116980181B (zh) * | 2023-06-21 | 2024-02-20 | 江南信安（北京）科技有限公司 | 一种用于检测关联报警事件的方法及系统 |
| CN117149587A (zh) * | 2023-08-28 | 2023-12-01 | 招商基金管理有限公司 | 监控台账管理方法、装置、存储介质及设备 |
| CN117149587B (zh) * | 2023-08-28 | 2024-05-31 | 招商基金管理有限公司 | 监控台账管理方法、装置、存储介质及设备 |
| CN117201165A (zh) * | 2023-09-29 | 2023-12-08 | 中国电子科技集团公司第十五研究所 | 基于网络威胁信息的威胁告警关联分析方法 |
| CN117112371A (zh) * | 2023-10-25 | 2023-11-24 | 杭银消费金融股份有限公司 | 一种可观测全链路日志追踪方法及系统 |
| CN117112371B (zh) * | 2023-10-25 | 2024-01-26 | 杭银消费金融股份有限公司 | 一种可观测全链路日志追踪方法及系统 |
Also Published As
| Publication number | Publication date |
|---|---|
| CN113381890B (zh) | 2023-01-13 |
| CN113381890A (zh) | 2021-09-10 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| WO2022257423A1 (zh) | 告警信息关联方法、装置、电子设备和可读存储介质 | |
| CN111694879B (zh) | 一种多元时间序列异常模式预测方法及数据采集监控装置 | |
| JP6538980B2 (ja) | 異種混成ログストリームにおける自動化された異常検出サービス | |
| CN111475804B (zh) | 一种告警预测方法及系统 | |
| CN109961204B (zh) | 一种微服务架构下业务质量分析方法和系统 | |
| US20170132523A1 (en) | Periodicity Analysis on Heterogeneous Logs | |
| CN100456687C (zh) | 网络故障实时相关性分析方法及系统 | |
| WO2023071761A1 (zh) | 一种异常定位方法及装置 | |
| CN114785666B (zh) | 一种网络故障排查方法与系统 | |
| CN111176953B (zh) | 一种异常检测及其模型训练方法、计算机设备和存储介质 | |
| CN113497726A (zh) | 告警监控方法、系统、计算机可读存储介质及电子设备 | |
| CN110287316A (zh) | 一种告警分类方法、装置、电子设备及存储介质 | |
| CN114465874B (zh) | 故障预测方法、装置、电子设备与存储介质 | |
| CN117708746B (zh) | 一种基于多模态数据融合的风险预测方法 | |
| CN115022153B (zh) | 故障根因分析方法、装置、设备和存储介质 | |
| CN101277218B (zh) | 一种网络告警的动态分析系统和方法 | |
| US11836637B2 (en) | Construction method of human-object-space interaction model based on knowledge graph | |
| CN112312443A (zh) | 海量告警数据处理方法、系统、介质、计算机设备及应用 | |
| CN113497725B (zh) | 告警监控方法、系统、计算机可读存储介质及电子设备 | |
| CN115544519A (zh) | 对计量自动化系统威胁情报进行安全性关联分析的方法 | |
| CN114598539A (zh) | 根因定位方法、装置、存储介质及电子设备 | |
| CN112800061A (zh) | 一种数据存储方法、装置、服务器及存储介质 | |
| CN113157521B (zh) | 用于区块链全生命周期的监控方法和监控系统 | |
| CN113783862B (zh) | 一种边云协同过程中进行数据校验的方法及装置 | |
| KR101213863B1 (ko) | 학습 기반 홈 네트워크 오류 인식 시스템을 위한 로그 데이터 클러스터링 분석 시스템 및 그 방법 |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| 121 | Ep: the epo has been informed by wipo that ep was designated in this application |
Ref document number: 21944919 Country of ref document: EP Kind code of ref document: A1 |
|
| NENP | Non-entry into the national phase |
Ref country code: DE |
|
| 122 | Ep: pct application non-entry in european phase |
Ref document number: 21944919 Country of ref document: EP Kind code of ref document: A1 |