CN115454787A - Alarm classification method and device, electronic equipment and storage medium - Google Patents
Alarm classification method and device, electronic equipment and storage medium Download PDFInfo
- Publication number
- CN115454787A CN115454787A CN202211303532.3A CN202211303532A CN115454787A CN 115454787 A CN115454787 A CN 115454787A CN 202211303532 A CN202211303532 A CN 202211303532A CN 115454787 A CN115454787 A CN 115454787A
- Authority
- CN
- China
- Prior art keywords
- alarm
- alarm information
- sample
- sub
- classification model
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
- 238000000034 method Methods 0.000 title claims abstract 11
- 238000013145 classification model Methods 0.000 claims abstract 21
- 238000010276 construction Methods 0.000 claims 2
- 238000007781 pre-processing Methods 0.000 claims 2
- 238000004364 calculation method Methods 0.000 claims 1
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/30—Monitoring
- G06F11/32—Monitoring with visual or acoustical indication of the functioning of the machine
- G06F11/324—Display of status information
- G06F11/327—Alarm or error message display
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/30—Monitoring
- G06F11/3065—Monitoring arrangements determined by the means or processing involved in reporting the monitored data
- G06F11/3072—Monitoring arrangements determined by the means or processing involved in reporting the monitored data where the reporting involves data filtering, e.g. pattern matching, time or event triggered, adaptive or policy-based reporting
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N3/00—Computing arrangements based on biological models
- G06N3/02—Neural networks
- G06N3/08—Learning methods
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- Quality & Reliability (AREA)
- General Health & Medical Sciences (AREA)
- Biomedical Technology (AREA)
- Data Mining & Analysis (AREA)
- Evolutionary Computation (AREA)
- Biophysics (AREA)
- Molecular Biology (AREA)
- Computing Systems (AREA)
- Computational Linguistics (AREA)
- Artificial Intelligence (AREA)
- Mathematical Physics (AREA)
- Software Systems (AREA)
- Life Sciences & Earth Sciences (AREA)
- Computer Vision & Pattern Recognition (AREA)
- Health & Medical Sciences (AREA)
- Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
Abstract
The application provides an alarm classification method, an alarm classification device, electronic equipment and a storage medium. The method comprises the following steps: acquiring characteristic data of alarm information to be classified, and constructing a graph network corresponding to the alarm information to be classified based on the characteristic data; and inputting the graph network into an alarm classification model to obtain an alarm classification result of the alarm information to be classified output by the alarm classification model. According to the scheme, the accurate alarm classification result can be obtained.
Description
Technical Field
The present application relates to big data technologies, and in particular, to an alarm classification method and apparatus, an electronic device, and a storage medium.
Background
With the development of science and technology and the coming of big data era, a large amount of information is generated in the daily operation process of the system, and the information comprises log information, transaction information and alarm information. The sources of the alarm information are numerous, each alarm information being associated with a different module in the system.
In the process of alarm processing, the severity of alarm information is different, the alarm processing modes are different, accurate alarm classification results are obtained, and the alarm processing efficiency can be effectively improved. At present, alarm classification methods are diversified, the force points of most alarm classification methods are gathered in the alarm, and the alarm classification result cannot accurately represent the severity of the alarm information. Therefore, how to accurately classify the alarm information becomes a problem to be solved urgently at present.
Disclosure of Invention
The application provides an alarm classification method, an alarm classification device, electronic equipment and a storage medium, which are used for accurately classifying alarm information.
In a first aspect, the present application provides an alarm classification method, including: acquiring characteristic data of alarm information to be classified, and constructing a graph network corresponding to the alarm information to be classified based on the characteristic data; inputting a graph network corresponding to the alarm information to be classified into an alarm classification model to obtain a classification result of the alarm information to be classified output by the alarm classification model; the alarm classification model is a graph convolution network obtained through pre-training.
In one possible embodiment, the method further comprises: generating a sample library according to the historical alarm information; the sample library comprises historical alarm information and a reference classification result of the historical alarm information, wherein the classification result of the alarm information represents the emergency degree of the alarm information; dividing the sample library into a plurality of sub sample libraries according to the reference classification result of the historical alarm information in the sample library, wherein the plurality of sub sample libraries correspond to different emergency degrees one by one; respectively constructing a graph network corresponding to each subsample library; establishing an initial alarm classification model based on a graph convolution network; and training the initial alarm classification model based on the graph networks corresponding to the plurality of sub-sample libraries respectively until the alarm classification model is obtained.
In a possible implementation manner, the establishing, for each sub-sample library, a graph network corresponding to the sub-sample library includes: dividing each sub-sample library into a plurality of sample sets, and respectively constructing a graph network corresponding to each sample set for each sample set; the training the initial alarm classification model based on the graph networks corresponding to the plurality of sub-sample libraries until the alarm classification model is obtained includes: and aiming at each sub-sample library, training the initial alarm classification model by adopting a small-batch iterative training mode based on the graph network corresponding to each sample set under the sub-sample library until the alarm classification model is obtained.
In a possible implementation manner, the training, for each sub-sample library, the initial alarm classification model based on the graph network corresponding to each sample set in the sub-sample library includes: for each sub-sample library, inputting a graph network corresponding to each sample set in the sub-sample library into a current alarm classification model to obtain a first alarm classification result output by the model; and calculating the similarity between the reference classification result corresponding to the sub-sample library to which the sample set belongs and the first alarm classification result, and adjusting an alarm classification model according to the current similarity until the current similarity meets the preset requirement, and judging that the training is finished.
In a possible embodiment, the generating a sample library according to the historical alarm information includes: determining characteristic values of the historical alarm information under various characteristic types; according to the weight corresponding to each type of feature, carrying out weighted summation calculation on the feature values of the historical alarm information under each feature type to obtain the alarm degree value of the historical alarm information; and taking the classification result corresponding to the value range of the alarm degree value of the historical alarm information as the reference classification result of the historical alarm information according to the alarm degree value of the historical alarm information and the alarm degree value range corresponding to the classification result.
In a possible embodiment, the generating a sample library according to the historical alarm information previously includes: preprocessing the historical alarm information, wherein the preprocessing comprises at least one of the following steps: data deduplication, data denoising, and data completion.
In a second aspect, the present application provides an alarm classification apparatus, including: the acquisition module is used for acquiring the characteristic data of the alarm information to be classified; the construction module is used for constructing a graph network corresponding to the alarm information to be classified based on the characteristic data; the processing module is used for inputting the graph network corresponding to the alarm information to be classified into an alarm classification model and obtaining a classification result of the alarm information to be classified output by the alarm classification model; the alarm classification model is a graph convolution network obtained through pre-training.
In a possible embodiment, the apparatus further comprises: the sample generation module is used for generating a sample library according to the historical alarm information; the sample library comprises historical alarm information and a reference classification result of the historical alarm information, wherein the alarm classification result of the alarm information represents the emergency degree of the alarm information; the dividing module is used for dividing the sample base into a plurality of sub sample bases according to the reference classification result of the historical alarm information in the sample base, and the plurality of sub sample bases correspond to different emergency degrees one by one; the construction module is further used for respectively establishing a graph network corresponding to each sub-sample library; the establishing module is used for establishing an initial alarm classification model based on the graph convolution network; and the training module is used for training the initial alarm classification model respectively based on the graph networks corresponding to the plurality of sub sample libraries until the alarm classification model is obtained.
In a possible implementation, the building module is further configured to: dividing each sub-sample library into a plurality of sample sets, and respectively constructing a graph network corresponding to each sample set for each sample set; the training module is specifically configured to: and aiming at each sub-sample library, training the initial alarm classification model by adopting a small-batch iterative training mode based on the graph network corresponding to each sample set under the sub-sample library until the alarm classification model is obtained.
In one possible embodiment, the training module includes: the processing unit is used for inputting the graph network corresponding to each sample set in each sub-sample library into the current alarm classification model aiming at each sub-sample library to obtain a first alarm classification result output by the model; the first calculation unit is used for calculating the similarity between the reference classification result corresponding to the sub sample library to which the sample set belongs and the first alarm classification result; and the model adjusting unit is used for adjusting the alarm classification model according to the current similarity until the current similarity meets the preset requirement, and judging that the training is finished.
In one possible embodiment, the sample generation module includes: the determining unit is used for determining the characteristic values of the historical alarm information under various characteristic types; the second calculation unit is used for performing weighted summation calculation on the characteristic values of the historical alarm information under each characteristic type according to the weight corresponding to each type of characteristic to obtain the alarm degree value of the historical alarm information; and the matching unit is used for taking the classification result corresponding to the value range in which the alarm degree value of the historical alarm information is positioned as the reference classification result of the historical alarm information according to the alarm degree value of the historical alarm information and the alarm degree value range corresponding to the classification result.
In a possible implementation, the apparatus further includes: the preprocessing module is used for preprocessing the historical alarm information, and the preprocessing comprises at least one of the following steps: data deduplication, data denoising, and data completion.
In a third aspect, the present application provides an electronic device, comprising: a processor, and a memory communicatively coupled to the processor; the memory stores computer execution instructions; the processor executes the computer-executable instructions stored by the memory to implement the method as previously described.
In a fourth aspect, the present application provides a computer-readable storage medium having stored therein computer-executable instructions for implementing the method as described above when executed by a processor.
According to the alarm classification method, the alarm classification device, the electronic equipment and the storage medium, the characteristic data of the alarm information to be classified is obtained, and a graph network corresponding to the alarm information to be classified is constructed based on the characteristic data; and inputting the graph network corresponding to the alarm information to be classified into the alarm classification model to obtain the classification result of the alarm information to be classified output by the alarm classification model. According to the scheme, the graph network is constructed based on the characteristic data and the classification result is obtained based on the graph convolution network, wherein the graph network can truly and deeply reflect the relation attribute between the alarm information, so that the more accurate classification result can be obtained, the method and the device can be well suitable for scenes with complex relation attributes of the alarm information, and the alarm processing efficiency is effectively improved.
Drawings
The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and together with the description, serve to explain the principles of the application.
Fig. 1 is a schematic flowchart of an alarm classification method according to an embodiment of the present application;
fig. 2 is a schematic flowchart of an alarm classification method provided in the second embodiment of the present application;
fig. 3 is a schematic diagram of a graph convolution neural network architecture according to a second embodiment of the present application;
fig. 4 is a schematic flowchart of an alarm classification method provided in the third embodiment of the present application;
fig. 5 is a schematic structural diagram of an alarm classification device according to a fourth embodiment of the present application;
fig. 6 is a schematic structural diagram of an alarm classification device according to a fifth embodiment of the present application;
fig. 7 is a schematic structural diagram of an electronic device according to a sixth embodiment of the present application.
With the above figures, there are shown specific embodiments of the present application, which will be described in more detail below. These drawings and written description are not intended to limit the scope of the inventive concepts in any manner, but rather to illustrate the inventive concepts to those skilled in the art by reference to specific embodiments.
Detailed Description
Reference will now be made in detail to the exemplary embodiments, examples of which are illustrated in the accompanying drawings. When the following description refers to the accompanying drawings, like numbers in different drawings represent the same or similar elements unless otherwise indicated. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present application. Rather, they are merely examples of apparatus and methods consistent with certain aspects of the application, as detailed in the appended claims.
It should be noted that the brief descriptions of the terms in the present application are only for the convenience of understanding the embodiments described below, and are not intended to limit the embodiments of the present application. These terms should be understood in their ordinary and customary meaning unless otherwise indicated.
The terms "first," "second," and the like in the description and claims of this application and in the above-described drawings are used for distinguishing between similar or analogous objects or entities and are not necessarily intended to limit the order or sequence Unless otherwise indicated. It is to be understood that the terms so used are interchangeable under appropriate circumstances such that the embodiments of the application are, for example, capable of operation in sequences other than those illustrated or otherwise described herein.
Furthermore, the terms "comprises" and "comprising," as well as any variations thereof, are intended to cover a non-exclusive inclusion, such that a product or device that comprises a list of elements is not necessarily limited to those elements explicitly listed, but may include other elements not expressly listed or inherent to such product or device. The term module, as used herein, refers to any known or later developed hardware, software, firmware, artificial intelligence, fuzzy logic, or combination of hardware or/and software code that is capable of performing the functionality associated with that element.
In practical application, a large amount of information is generated in the daily operation process of the system, and the information comprises log information, transaction information and alarm information. The sources of the alarm information are numerous, each alarm information being associated with a different module in the system. In the process of alarm processing, the severity of alarm information is different, the alarm processing modes are different, accurate alarm classification results are obtained, and the alarm processing efficiency can be effectively improved.
At present, most of the points of force of alarm information classification are gathered in the alarm, the association between the alarm information and the characteristic information is not mined, and the alarm classification result cannot accurately represent the severity of the alarm information. Taking the financial field as an example, the correlation attributes between the alarm information are complex, and the traditional alarm classification mode ignores the relationship attributes between the alarm information, so that an accurate alarm classification result cannot be obtained.
According to the alarm classification method, the graph network is constructed based on the characteristic data, and the classification result is obtained based on the graph convolution network, wherein the graph network can truly and deeply reflect the relation attribute between the alarm information, so that the more accurate classification result can be obtained, the method can be well suitable for the scene with the complex relation attribute of the alarm information, and the alarm processing efficiency is effectively improved.
The technical means of the present application and the technical means of the present application will be described in detail below with specific examples. The following several specific embodiments may be combined with each other, and details of the same or similar concepts or processes may not be repeated in some embodiments. In the description of the present application, unless otherwise explicitly specified and defined, each term should be understood broadly in the art. Embodiments of the present application will be described below with reference to the accompanying drawings.
Example one
Fig. 1 is a schematic flow chart of an alarm classification method provided in an embodiment of the present application, where an implementation subject of the embodiment may be an alarm classification device, and as shown in fig. 1, the method includes:
s101, obtaining characteristic data of the alarm information to be classified, and constructing a graph network corresponding to the alarm information to be classified based on the characteristic data.
The characteristic data of the alarm information to be classified is a characteristic value corresponding to the characteristics representing the generation reason and the generation source of the alarm information to be classified. The characteristics of the alarm information to be classified at least comprise: the method comprises the following steps of system name, module name, instance name, port number, abnormal index, current threshold, set threshold, first abnormal time, last abnormal time and abnormal judgment frequency.
In this embodiment, a Graph Network (GN) refers to a function set organized according to a Graph structure in a Topological Space (Topological Space) to perform Relational Reasoning (Relational learning). Graph networks are composed of interconnected Graph Network blocks (Graph Network blocks), which are also referred to as nodes in neural Network implementations. The connection between nodes is called Edge (Edge), and represents the dependency relationship between nodes. The internal state and the system state of each node of the graph network are called attributes (attributes).
Specifically, a graph network corresponding to the alarm information to be classified is constructed based on the characteristic data. Exemplarily, the system is used as a node of a graph network, each piece of alarm information is used as one edge, the direction represents the alarm influence causal relationship, and the graph network corresponding to the alarm information to be classified is constructed by combining the characteristics of the alarm information to be classified.
S102, inputting the graph network corresponding to the alarm information to be classified into an alarm classification model, and obtaining the classification result of the alarm information to be classified output by the alarm classification model.
Wherein, the alarm classification model is a graph convolution neural network obtained by pre-training. Graph Convolutional Network (GCN) refers to a Convolutional neural Network that can directly act on a Graph and utilize its structural information.
In this embodiment, the classification result of the alarm information to be classified may be: serious alarm, general alarm and normal alarm. Exemplarily, the serious alarm refers to an alarm which causes service interruption and needs to immediately perform troubleshooting; the general alarm means an alarm which affects the service and needs to immediately carry out fault maintenance; the normal alarm means that the existing service is not influenced, but the possibility of influencing the service is influenced, and the maintenance is required to avoid influencing the service.
In practical application, the graph network corresponding to the alarm information to be classified represents the characteristic data of the alarm information to be classified. The alarm classification model can obtain the classification result of the alarm information to be classified according to the graph network corresponding to the input alarm information to be classified. It can be understood that the feature data of the alarm information to be classified corresponding to the same classification result has similarity, and the generation reason and the generation source of the alarm can be judged in time according to the alarm result to be classified, so that operation and maintenance personnel can process the alarm timely and effectively.
In the alarm classification method provided by this embodiment, the feature data of the alarm information to be classified is obtained, and a graph network corresponding to the alarm information to be classified is constructed based on the feature data; and inputting the graph network corresponding to the alarm information to be classified into the alarm classification model to obtain the classification result of the alarm information to be classified output by the alarm classification model. In the embodiment, the graph network is constructed based on the characteristic data and the classification result is obtained based on the graph convolution network, wherein the graph network can truly and deeply reflect the relation attribute between the alarm information, so that the more accurate classification result can be obtained, the method can be well suitable for scenes with complex relation attributes of the alarm information, and the alarm processing efficiency is effectively improved.
Example two
Fig. 2 is a schematic flowchart of an alarm classification method provided in the second embodiment of the present application, and as shown in fig. 2, the method further includes:
s201, generating a sample library according to the historical alarm information.
In this embodiment, the sample library includes historical alarm information and a reference classification result of the historical alarm information, where the classification result of the alarm information represents an emergency degree of the alarm information.
In practical application, the reference classification result of the historical alarm information is used for judging whether the classification result of the historical alarm information is accurate or not, and when the classification result of the historical alarm information is consistent with the reference classification result of the historical alarm information, the classification of the historical alarm is accurate; and when the classification result of the historical alarm information is inconsistent with the reference classification result of the historical alarm information, the classification of the historical alarm is not accurate. For example, the reference classification result of the historical alarm information 1 is a general alarm, the classification result of the historical alarm information 1 is consistent with the reference classification result of the historical alarm information, and the classification result of the historical alarm information 1 is accurate; the reference classification result of the historical alarm information 2 is a general alarm, the classification result of the historical alarm information 2 is a serious alarm, the classification result of the historical alarm information 2 is inconsistent with the reference classification result of the historical alarm information, and the classification result of the historical alarm information 1 is inaccurate.
Regarding the generation of the sample library, in one possible embodiment, S201 includes:
determining characteristic values of historical alarm information under various characteristic types;
according to the weight corresponding to each type of characteristic, carrying out weighted summation calculation on the characteristic value of the historical alarm information under each characteristic type to obtain the alarm degree value of the historical alarm information;
and taking the classification result corresponding to the value range of the alarm degree value of the historical alarm information as a reference classification result of the historical alarm information according to the alarm degree value of the historical alarm information and the alarm degree value range corresponding to the classification result.
In an example, the weight corresponding to each type is set according to the influence of each type of feature on the alarm information. For example, for the system importance, the alarm influence range, the traffic volume, the threshold anomaly, and the alarm occurrence frequency, the weight is assigned as: 0.35,0.20,0.20,0.15,0.10. Specifically, according to the weights corresponding to the various types of features, the feature values of the historical alarm information under the various feature types are subjected to weighted summation calculation, and the alarm degree value of the historical alarm information is obtained. For example, the system importance, the alarm cause, the alarm influence range, the traffic volume, the threshold anomaly, and the alarm occurrence frequency respectively correspond to the characteristic values: 6,7, 10,4, 40%, the weight assignments are: 0.35,0.20,0.20,0.15,0.10. The alarm degree value of the historical alarm information is 6.14.
In practical application, different alarm degree value ranges corresponding to different classification results are obtained. For example, the alarm degree value range corresponding to the normal alarm is [0,3], the alarm degree value range corresponding to the general alarm is (3,6 ], and the alarm degree value range corresponding to the serious alarm is (6,10 ].
In the embodiment, the alarm degree value of the historical alarm information is obtained by calculating the weighted sum of the characteristic values of the historical alarm information under each characteristic type; and taking the classification result corresponding to the value range of the alarm degree value of the historical alarm information as a reference classification result of the historical alarm information according to the alarm degree value of the historical alarm information and the alarm degree value range corresponding to the classification result. In the embodiment, the reference classification result is determined according to the value range of the alarm degree value, and the reference is provided for the alarm classification result output in the alarm classification model training process.
In practical application, in order to ensure that a more accurate alarm classification model is obtained, the historical alarm information used for training the model can be preprocessed. For example, in a possible implementation, S201 further includes:
preprocessing historical alarm information, wherein the preprocessing comprises at least one of the following steps: data deduplication, data denoising, and data completion.
The data deduplication refers to removing repeated but meaningless alarm information generated at the same time due to the same reason under the same equipment of the same system; the data denoising refers to removing alarm information lacking characteristic values; the data completion refers to the completion of characteristic values of alarm information which has high generation frequency and large service influence range and is generated for important systems with large service transaction amount, so that the information loss is avoided when important alarms are analyzed, and the optimization of later-stage alarm information is ensured.
In the embodiment, after the historical alarm information is obtained, the alarm information is preprocessed, so that the historical alarm information which is standard, uniform and high in usability is obtained, the preprocessed historical alarm information is adopted to train the initial alarm classification model, the alarm classification model with higher accuracy can be obtained, and the accurate alarm classification result is obtained.
S202, dividing the sample library into a plurality of sub-sample libraries according to the reference classification result of the historical alarm information in the sample library;
s203, respectively constructing a graph network corresponding to each sub-sample library;
s204, establishing an initial alarm classification model based on the graph convolution neural network;
s205, training the initial alarm classification model based on the graph networks corresponding to the multiple sub-sample libraries until the alarm classification model is obtained.
Wherein, a plurality of sub-sample libraries correspond to different urgency levels one to one. Illustratively, the sample library is divided into a normal sub-sample library, a general sub-sample library and a serious sub-sample library according to the reference classification result of the historical alarm information.
It can be understood that the sub-sample library includes a plurality of historical alarm information, and a graph network corresponding to the alarm information to be classified is constructed based on the feature data of all the historical alarm information in the sub-sample library.
Specifically, in S203, a graph network corresponding to each sub-sample library is respectively constructed for each sub-sample library. For example, the sample library is divided into a normal sub-sample library, a general sub-sample library and a severe sub-sample library, and a graph network corresponding to the normal sub-sample library, a graph network corresponding to the general sub-sample library and a graph network corresponding to the severe sub-sample library are respectively constructed.
In practical application, the reference classification results corresponding to each sub-sample library are consistent, and the alarm classification information in each sub-sample library has an association relationship. Therefore, the initial alarm classification model is trained based on the graph networks corresponding to the plurality of sub-sample libraries, and the accuracy of the alarm classification model can be effectively improved.
Specifically, in S205, the initial alarm classification model is trained based on the graph networks corresponding to the multiple sub-sample libraries, respectively, until the alarm classification model is obtained. For example, training an initial alarm classification model based on a normal sub-sample library corresponding graph network until the accuracy of an alarm classification result output by the current alarm classification model meets the requirement, and obtaining a first alarm classification model; and training the first alarm classification model based on a graph network corresponding to a general sub-sample library until the accuracy of an alarm classification result output by the current alarm classification model meets the requirement, and obtaining a second alarm classification model. And training the second alarm classification model based on the graph network corresponding to the serious sub-sample library until the accuracy of the alarm classification result output by the current alarm classification model meets the requirement, and obtaining the alarm classification model.
Optionally, training the initial alarm classification model is performed circularly based on the graph network corresponding to each sub-sample library until the alarm classification model is obtained.
For better understanding of the graph convolution neural network, the graph convolution neural network in the present embodiment is described with reference to fig. 3. Fig. 3 is a schematic diagram of a graph convolution neural network architecture according to a second embodiment of the present application.
As shown in fig. 3, the convolutional neural network in the present embodiment includes an input layer 300, a hidden layer 310, and an output layer 320. Wherein, the input layer is a feature matrix composed of the distinguishing features between different nodes in the graph network. The hidden layer 310 includes Graph convolution (Graph convolution) 311, rectified Linear Unit (ReLu) 312, and random deactivation (Dropout) 313. The hidden layer 310 linearly partitions the alarm information with the sample bank information using a linear rectification function 312. Due to the large amount of alarm information data, a random deactivation layer 313 is introduced after the hidden layer 310 in order to prevent overfitting. The output layer 320 is responsible for converting the abstract features of model learning into predicted value output.
In addition, in a possible implementation, S203 specifically includes: dividing each sub sample library into a plurality of sample sets, and respectively constructing a graph network corresponding to each sample set; s205 specifically includes: and aiming at each sub-sample library, training an initial alarm classification model by adopting a small-batch iterative training mode based on the graph network corresponding to each sample set under the sub-sample library until the alarm classification model is obtained.
The small-batch iterative training refers to further dividing the sub-sample library into a plurality of sample sets with smaller single data volume, and performing multiple iterative training based on the plurality of sample sets. In practical application, the quantity of historical alarm information in the sub-sample library is large, the number of characteristic attributes is large, the generated graph network relation attribute is more complex, the training complexity of the graph network with the complex relation attribute is higher, and the required training time is longer. Therefore, in order to save training time, a small batch of iterative training mode is adopted. For example, each sub-sample library is further divided into N sample sets, and a corresponding graph network is generated according to each sample set, that is, N graph networks are obtained. And training the alarm classification model based on the N graph networks respectively. It should be noted that the model trained in each iteration is the current alarm classification model, that is, the model obtained through the last iteration training.
In practical application, a small-batch iterative training mode is adopted, the training times are increased, and the accuracy of the alarm classification model can be effectively improved.
In the embodiment, when the number of the historical alarm information in the sub-sample library is large and the characteristic attributes are large, the training time is saved in a small-batch iteration mode, and the accuracy of the alarm classification model is improved.
In a possible implementation manner, dividing each sub-sample library into a plurality of sample sets, and respectively constructing a graph network corresponding to each sample set, including:
dividing each sub-sample library into a training set and a testing set, dividing the training set and the testing set into a plurality of sample sets respectively, and constructing a graph network corresponding to each sample set respectively;
aiming at each sub-sample library, training an initial alarm classification model by adopting a small-batch iterative training mode based on a graph network corresponding to each sample set under the sub-sample library until the alarm classification model is obtained, and the method comprises the following steps:
aiming at each sub-sample library, training an initial alarm classification model by adopting a small-batch iterative training mode based on a graph network corresponding to each sample set under a sub-sample library training set; and testing the current alarm classification model by adopting a small-batch iteration test mode based on the graph network corresponding to each sample set in the test set of the sub-sample library until the alarm classification model is obtained.
Regarding the sample set training process, in a possible implementation manner, for each sub-sample library, training an initial alarm classification model based on a graph network corresponding to each sample set in the sub-sample library includes:
for each sub-sample library, inputting a graph network corresponding to each sample set in the sub-sample library into a current alarm classification model to obtain a first alarm classification result output by the model;
and calculating the similarity between the reference classification result corresponding to the sub-sample library to which the sample set belongs and the first alarm classification result, and adjusting an alarm classification model according to the current similarity until the current similarity meets the preset requirement, and judging that the training is finished.
And the similarity represents the correlation degree between the reference classification result corresponding to the sub-sample library to which the sample set belongs and the first alarm classification result, and the higher the similarity is, the more close the correlation degree is. Illustratively, the similarity may be a function value of a similarity function, the similarity may take a value in the range of [0,1], and the similarity between objects a and b may be represented as sim (a, b), where sim (a, b) =0 indicates that a and b are not related to each other, and where sim (a, b) =1 indicates that a and b are equivalent.
Specifically, the similarity between a reference classification result corresponding to the sub-sample library to which the sample set belongs and the first alarm classification result is calculated, and the alarm classification model is adjusted according to the current similarity until the current similarity meets the preset requirement, and then the training is judged to be finished. For example, the preset requirement is that the similarity is greater than 0.75, the current similarity is 0.8, and the current similarity meets the preset requirement, and it is determined that the training is completed.
In this embodiment, the similarity between the reference classification result corresponding to the sub-sample library to which the sample set belongs and the first alarm classification result is calculated, and whether the training is completed is dynamically determined according to whether the similarity meets a preset requirement.
In the alarm classification method provided by the embodiment, a sample library is generated according to historical alarm information; dividing the sample library into a plurality of sub sample libraries according to the reference classification result of the historical alarm information in the sample library; respectively constructing a graph network corresponding to each sub-sample library; establishing an initial alarm classification model based on a graph convolution neural network; and training the initial alarm classification model based on the graph networks corresponding to the plurality of sub-sample libraries until the alarm classification model is obtained. In this embodiment, an initial alarm classification model is established based on a graph convolution neural network, the initial alarm classification model is trained based on a plurality of sub-sample library corresponding graph networks, an alarm classification model is obtained, and an accurate alarm classification result can be obtained by applying the alarm classification model obtained by training.
EXAMPLE III
Fig. 4 is a schematic flowchart of an alarm classification method provided in the third embodiment of the present application, and as shown in fig. 4, the method includes:
s401, generating a sample library according to historical alarm information;
s402, dividing the sample base into a plurality of sub sample bases according to the reference classification result of the historical alarm information in the sample base.
S403, respectively constructing a graph network corresponding to each subsample library;
s404, establishing an initial alarm classification model based on the graph convolution neural network;
s405, training an initial alarm classification model based on the graph networks corresponding to the plurality of sub-sample libraries until the alarm classification model is obtained;
s406, acquiring characteristic data of the alarm information to be classified, and constructing a graph network corresponding to the alarm information to be classified based on the characteristic data;
s407, inputting the graph network corresponding to the alarm information to be classified into the alarm classification model, and obtaining the classification result of the alarm information to be classified output by the alarm classification model.
In the alarm classification method provided by this embodiment, a sample library is generated according to historical alarm information; dividing the sample library into a plurality of sub sample libraries according to the reference classification result of the historical alarm information in the sample library; respectively constructing a graph network corresponding to each sub-sample library; establishing an initial alarm classification model based on a graph convolution neural network; and training the initial alarm classification model based on the graph networks corresponding to the plurality of sub-sample libraries until the alarm classification model is obtained. Acquiring characteristic data of the alarm information to be classified, and constructing a graph network corresponding to the alarm information to be classified based on the characteristic data; and inputting the graph network corresponding to the alarm information to be classified into the alarm classification model to obtain the classification result of the alarm information to be classified output by the alarm classification model. In this embodiment, an initial alarm classification model is established based on the graph convolution neural network, the initial alarm classification model is trained based on the multiple sub-sample library corresponding graph networks, an alarm classification model is obtained, and an accurate alarm classification result can be obtained by applying the alarm classification model obtained through training.
Example four
Fig. 5 is a schematic structural diagram of an alarm classification device provided in the fourth embodiment of the present application, and as shown in fig. 5, the device includes:
an obtaining module 51, configured to obtain feature data of alarm information to be classified;
and the building module 52 is configured to build a graph network corresponding to the alarm information to be classified based on the feature data.
The characteristic data of the alarm information to be classified is a characteristic value corresponding to the characteristics representing the generation reason and the generation source of the alarm information to be classified. The characteristics of the alarm information to be classified at least comprise: the method comprises the following steps of system name, module name, instance name, port number, abnormal index, current threshold, set threshold, first abnormal time, last abnormal time and abnormal judgment frequency.
In this embodiment, a Graph Network (GN) refers to a function set organized according to a Graph structure in a Topological Space (Graph) to perform Relational Reasoning (Relational learning). Graph networks are composed of interconnected Graph Network blocks (Graph Network blocks), which are also referred to as nodes in neural Network implementations. The connection between nodes is called Edge (Edge), and represents the dependency relationship between nodes. The internal state and the system state of each node of the graph network are called attributes (attributes).
Specifically, a graph network corresponding to the alarm information to be classified is constructed based on the characteristic data. Illustratively, the system is used as a node of a graph network, each piece of alarm information is used as an edge, the direction represents the alarm effect causal relationship, and the graph network corresponding to the alarm information to be classified is constructed by combining the characteristics of the alarm information to be classified.
And the processing module 53 is configured to input the graph network corresponding to the alarm information to be classified into the alarm classification model, and obtain a classification result of the alarm information to be classified output by the alarm classification model.
Wherein, the alarm classification model is a graph convolution neural network obtained by pre-training. A graph convolution network refers to a convolutional neural network that can act directly on a graph and utilize its structural information.
In this embodiment, the classification result of the alarm information to be classified may be: serious alarm, general alarm and normal alarm. Exemplarily, the serious alarm refers to an alarm which causes service interruption and needs to immediately perform troubleshooting; the general alarm means an alarm which affects the service and needs to immediately carry out fault maintenance; the normal alarm means that the existing service is not influenced, but the possibility of influencing the service is influenced, and the maintenance is required to avoid influencing the service.
In practical application, the graph network corresponding to the alarm information to be classified represents the characteristic data of the alarm information to be classified. The alarm classification model can obtain the classification result of the alarm information to be classified according to the graph network corresponding to the input alarm information to be classified. It can be understood that the feature data of the alarm information to be classified corresponding to the same classification result has similarity, and the generation reason and the generation source of the alarm can be judged in time according to the alarm result to be classified, so that operation and maintenance personnel can process the alarm timely and effectively.
In the alarm classification device provided by this embodiment, the obtaining module obtains the feature data of the alarm information to be classified, and the construction module constructs a graph network corresponding to the alarm information to be classified based on the feature data; the processing module inputs the graph network corresponding to the alarm information to be classified into the alarm classification model to obtain the classification result of the alarm information to be classified output by the alarm classification model. In the embodiment, the graph network is constructed based on the characteristic data and the classification result is obtained based on the graph convolution network, wherein the graph network can truly and deeply reflect the relationship attribute between the alarm information, so that a more accurate classification result can be obtained, the method can be well suitable for scenes with complex relationship attribute of the alarm information, and the alarm processing efficiency is effectively improved.
EXAMPLE five
Fig. 6 is a schematic structural diagram of an alarm classification device provided in the fifth embodiment of the present application, and as shown in fig. 6, the device further includes:
and the sample generating module 61 is configured to generate a sample library according to the historical alarm information.
In this embodiment, the sample library includes historical alarm information and a reference classification result of the historical alarm information, where the classification result of the alarm information represents an emergency degree of the alarm information.
In practical application, the reference classification result of the historical alarm information is used for judging whether the classification result of the historical alarm information is accurate or not, and when the classification result of the historical alarm information is consistent with the reference classification result of the historical alarm information, the classification of the historical alarm is accurate; and when the classification result of the historical alarm information is inconsistent with the reference classification result of the historical alarm information, the classification of the historical alarm is not accurate.
In a possible embodiment, the sample generation module 61 includes:
the determining unit is used for determining the characteristic values of the historical alarm information under various characteristic types;
the second calculation unit is used for performing weighted summation calculation on the characteristic values of the historical alarm information under each characteristic type according to the weight corresponding to each type of characteristic to obtain the alarm degree value of the historical alarm information;
and the matching unit is used for taking the classification result corresponding to the value range in which the alarm degree value of the historical alarm information is positioned as the reference classification result of the historical alarm information according to the alarm degree value of the historical alarm information and the alarm degree value range corresponding to the classification result.
In an example, the weight corresponding to each type is set according to the influence of each type of feature on the alarm information. In practical application, different alarm degree value ranges corresponding to different classification results are obtained.
In the embodiment, the alarm degree value of the historical alarm information is obtained by calculating the weighted sum of the characteristic values of the historical alarm information under each characteristic type; and taking the classification result corresponding to the value range of the alarm degree value of the historical alarm information as a reference classification result of the historical alarm information according to the alarm degree value of the historical alarm information and the alarm degree value range corresponding to the classification result. In the embodiment, the reference classification result is determined according to the value range of the alarm degree value, and the reference is provided for the alarm classification result output in the alarm classification model training process.
In practical application, in order to ensure that a more accurate alarm classification model is obtained, the historical alarm information can be preprocessed. For example, in one possible implementation, the apparatus further includes:
the preprocessing module is used for preprocessing the historical alarm information, and the preprocessing comprises at least one of the following steps: data deduplication, data denoising, and data completion.
The data deduplication refers to removing repeated but meaningless alarm information generated at the same time due to the same reason under the same equipment of the same system; the data denoising refers to removing alarm information lacking characteristic values; the data completion refers to the completion of characteristic values of alarm information which has high generation frequency and large service influence range and is generated for important systems with large service transaction amount, so that the information loss is avoided when important alarms are analyzed, and the optimization of later-stage alarm information is ensured.
In the embodiment, after the historical alarm information is obtained, the alarm information is preprocessed, so that the historical alarm information which is standard, uniform and high in usability is obtained, the preprocessed historical alarm information is adopted to train the initial alarm classification model, the alarm classification model with higher accuracy can be obtained, and the accurate alarm classification result is obtained.
And the dividing module 62 is configured to divide the sample library into a plurality of sub-sample libraries according to the reference classification result of the historical alarm information in the sample library.
Wherein, a plurality of sub-sample libraries correspond to different urgency levels one to one. Illustratively, the sample library is divided into a normal sub-sample library, a general sub-sample library and a serious sub-sample library according to the reference classification result of the historical alarm information.
The building module 52 is further configured to respectively build a graph network corresponding to each sub-sample library.
It can be understood that the sub-sample library includes a plurality of historical alarm information, and a graph network corresponding to the alarm information to be classified is constructed based on the feature data of all the historical alarm information in the sub-sample library.
The establishing module 63 is used for establishing an initial alarm classification model based on the graph convolution neural network;
and the training module 64 is configured to train the initial alarm classification model based on the graph networks corresponding to the multiple sub-sample libraries, respectively, until the alarm classification model is obtained.
In practical application, the reference classification results corresponding to each sub-sample library are consistent, and the alarm classification information in each sub-sample library has an association relationship. Therefore, the initial alarm classification model is trained based on the graph networks corresponding to the multiple sub-sample libraries, and the accuracy of the alarm classification model can be effectively improved.
Optionally, training the initial alarm classification model is performed circularly based on the graph network corresponding to each sub-sample library until the alarm classification model is obtained.
In one possible embodiment, module 52 is further configured to: dividing each sub-sample library into a plurality of sample sets, and respectively constructing a graph network corresponding to each sample set for each sample set; the training module 64 is specifically configured to: and aiming at each sub-sample library, training the initial alarm classification model by adopting a small-batch iterative training mode based on the graph network corresponding to each sample set under the sub-sample library until the alarm classification model is obtained.
The small-batch iterative training refers to the step of further dividing the sub-sample library into a plurality of sample sets with smaller single data volume, and performing multiple iterative training based on the plurality of sample sets. In practical application, the quantity of historical alarm information in the sub-sample library is large, the number of characteristic attributes is large, the generated graph network relation attribute is more complex, the training complexity of the graph network with the complex relation attribute is higher, and the required training time is longer. Therefore, in order to save training time, a small batch of iterative training mode is adopted. For example, each sub-sample library is further divided into N sample sets, and a corresponding graph network is generated according to each sample set, that is, N graph networks are obtained. And training the alarm classification model based on the N graph networks respectively. It should be noted that the model trained in each iteration is the current alarm classification model, that is, the model obtained through the last iteration training.
In practical application, a small-batch iterative training mode is adopted, the training times are increased, and the accuracy of the alarm classification model can be effectively improved.
In the embodiment, when the number of the historical alarm information in the sub-sample library is large and the characteristic attributes are large, the training time is saved in a small-batch iteration mode, and the accuracy of the alarm classification model is improved.
In one possible embodiment, module 52 is further configured to:
dividing each sub-sample library into a training set and a testing set, dividing the training set and the testing set into a plurality of sample sets respectively, and constructing a graph network corresponding to each sample set respectively;
the training module 64 is specifically configured to:
aiming at each sub-sample library, training an initial alarm classification model by adopting a small batch iterative training mode based on a graph network corresponding to each sample set under a sub-sample library training set; and testing the current alarm classification model by adopting a small-batch iteration test mode based on the graph network corresponding to each sample set in the test set of the sub-sample library until the alarm classification model is obtained.
In one possible implementation, the training module 64 includes:
the processing unit is used for inputting the graph network corresponding to each sample set in each sub-sample library into the current alarm classification model aiming at each sub-sample library to obtain a first alarm classification result output by the model;
the first calculation unit is used for calculating the similarity between a reference classification result corresponding to the sub sample library to which the sample set belongs and a first alarm classification result;
and the model adjusting unit is used for adjusting the alarm classification model according to the current similarity until the current similarity meets the preset requirement, and judging that the training is finished.
And the similarity represents the correlation degree of the reference classification result corresponding to the sub-sample library to which the sample set belongs and the first alarm classification result, and the greater the similarity is, the closer the correlation degree is.
In this embodiment, the similarity between the reference classification result corresponding to the sub-sample library to which the sample set belongs and the first alarm classification result is calculated, and whether the training is completed is dynamically determined according to whether the similarity meets a preset requirement.
In the alarm classification device provided by this embodiment, the sample generation module generates a sample library according to historical alarm information; the dividing module divides the sample base into a plurality of sub sample bases according to the reference classification result of the historical alarm information in the sample base; the construction module is used for respectively constructing a graph network corresponding to each sub-sample library; the establishing module establishes an initial alarm classification model based on the graph convolution neural network; and the training module trains the initial alarm classification model based on the graph networks corresponding to the plurality of sub-sample libraries until the alarm classification model is obtained. In this embodiment, an initial alarm classification model is established based on a graph convolution neural network, the initial alarm classification model is trained based on a plurality of sub-sample library corresponding graph networks, an alarm classification model is obtained, and an accurate alarm classification result is obtained by applying the alarm classification model obtained by training.
EXAMPLE six
Fig. 7 is a schematic structural diagram of an electronic device according to a sixth embodiment of the present application, and as shown in fig. 7, the electronic device includes:
a processor (processor) 71, the electronic device further comprising a memory (memory) 72; a Communication Interface 73 and bus 74 may also be included. The processor 71, the memory 72, and the communication interface 73 can communicate with each other through the bus 74. The communication interface 73 may be used for information transfer. Processor 71 may call logic instructions in memory 72 to perform the methods of the above-described embodiments.
Furthermore, the logic instructions in the memory 72 may be implemented in software functional units and stored in a computer readable storage medium when sold or used as a stand-alone product.
The memory 72 is a computer-readable storage medium for storing software programs, computer-executable programs, such as program instructions/modules corresponding to the methods in the embodiments of the present application. The processor 71 executes the functional application and data processing by executing the software program, instructions and modules stored in the memory 72, namely, implements the method in the above-described method embodiments.
The memory 72 may include a storage program area and a storage data area, wherein the storage program area may store an operating system, an application program required for at least one function; the storage data area may store data created according to the use of the terminal device, and the like. Further, the memory 72 may include high speed random access memory and may also include non-volatile memory.
The embodiment of the present application provides a non-transitory computer-readable storage medium, in which computer-executable instructions are stored, and when the computer-executable instructions are executed by a processor, the method according to the foregoing embodiment is implemented.
Other embodiments of the present application will be apparent to those skilled in the art from consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of the invention following, in general, the principles of the application and including such departures from the present disclosure as come within known or customary practice within the art to which the invention pertains. It is intended that the specification and examples be considered as exemplary only, with a true scope and spirit of the application being indicated by the following claims.
It will be understood that the present application is not limited to the precise arrangements described above and shown in the drawings and that various modifications and changes may be made without departing from the scope thereof. The scope of the application is limited only by the appended claims.
Claims (10)
1. An alarm classification method, comprising:
acquiring characteristic data of alarm information to be classified, and constructing a graph network corresponding to the alarm information to be classified based on the characteristic data;
inputting a graph network corresponding to the alarm information to be classified into an alarm classification model to obtain a classification result of the alarm information to be classified output by the alarm classification model; the alarm classification model is a graph convolution network obtained through pre-training.
2. The method of claim 1, further comprising:
generating a sample library according to historical alarm information; the sample library comprises historical alarm information and a reference classification result of the historical alarm information, wherein the classification result of the alarm information represents the emergency degree of the alarm information;
dividing the sample library into a plurality of sub sample libraries according to the reference classification result of the historical alarm information in the sample library, wherein the plurality of sub sample libraries correspond to different emergency degrees one by one;
respectively constructing a graph network corresponding to each sub-sample library; establishing an initial alarm classification model based on a graph convolution network;
and training the initial alarm classification model based on the graph networks corresponding to the plurality of sub-sample libraries until the alarm classification model is obtained.
3. The method according to claim 2, wherein the establishing a graph network corresponding to each sub-sample library comprises:
dividing each sub sample library into a plurality of sample sets, and respectively constructing a graph network corresponding to each sample set;
the training the initial alarm classification model based on the graph networks corresponding to the plurality of sub-sample libraries until the alarm classification model is obtained includes:
and aiming at each sub-sample library, training the initial alarm classification model by adopting a small-batch iterative training mode based on the graph network corresponding to each sample set under the sub-sample library until the alarm classification model is obtained.
4. The method of claim 3, wherein the training the initial alarm classification model based on the graph network corresponding to each sample set in the sub-sample library for each sub-sample library comprises:
for each sub-sample library, inputting a graph network corresponding to each sample set in the sub-sample library into a current alarm classification model to obtain a first alarm classification result output by the model;
and calculating the similarity between the reference classification result corresponding to the sub-sample library to which the sample set belongs and the first alarm classification result, and adjusting an alarm classification model according to the current similarity until the current similarity meets the preset requirement, and judging that the training is finished.
5. The method of claim 2, wherein generating a sample library from historical alarm information comprises:
determining characteristic values of the historical alarm information under various characteristic types;
according to the weight corresponding to each type of characteristic, carrying out weighted summation calculation on the characteristic value of the historical alarm information under each characteristic type to obtain the alarm degree value of the historical alarm information;
and taking the classification result corresponding to the value range of the alarm degree value of the historical alarm information as the reference classification result of the historical alarm information according to the alarm degree value of the historical alarm information and the alarm degree value range corresponding to the classification result.
6. The method according to any of claims 2-5, wherein the generating a sample library from historical alert information previously comprises:
preprocessing the historical alarm information, wherein the preprocessing comprises at least one of the following steps: data deduplication, data denoising, and data completion.
7. An alarm classification device, comprising:
the acquisition module is used for acquiring the characteristic data of the alarm information to be classified;
the construction module is used for constructing a graph network corresponding to the alarm information to be classified based on the characteristic data;
the processing module is used for inputting the graph network corresponding to the alarm information to be classified into an alarm classification model and obtaining a classification result of the alarm information to be classified output by the alarm classification model; the alarm classification model is a graph convolution network obtained through pre-training.
8. The apparatus of claim 7, further comprising:
the sample generating module is used for generating a sample library according to the historical alarm information; the sample library comprises historical alarm information and a reference classification result of the historical alarm information, wherein the alarm classification result of the alarm information represents the emergency degree of the alarm information;
the dividing module is used for dividing the sample base into a plurality of sub sample bases according to the reference classification result of the historical alarm information in the sample base, and the plurality of sub sample bases correspond to different emergency degrees one by one;
the construction module is further used for respectively establishing a graph network corresponding to each sub-sample library;
the establishing module is used for establishing an initial alarm classification model based on the graph convolution network;
and the training module is used for training the initial alarm classification model respectively based on the graph networks corresponding to the plurality of sub-sample libraries until the alarm classification model is obtained.
9. An electronic device, comprising: a processor, and a memory communicatively coupled to the processor;
the memory stores computer-executable instructions;
the processor executes computer-executable instructions stored by the memory to implement the method of any of claims 1-6.
10. A computer-readable storage medium having computer-executable instructions stored therein, which when executed by a processor, are configured to implement the method of any one of claims 1-6.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202211303532.3A CN115454787A (en) | 2022-10-24 | 2022-10-24 | Alarm classification method and device, electronic equipment and storage medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202211303532.3A CN115454787A (en) | 2022-10-24 | 2022-10-24 | Alarm classification method and device, electronic equipment and storage medium |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN115454787A true CN115454787A (en) | 2022-12-09 |
Family
ID=84310937
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202211303532.3A Pending CN115454787A (en) | 2022-10-24 | 2022-10-24 | Alarm classification method and device, electronic equipment and storage medium |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN115454787A (en) |
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN116016118A (en) * | 2022-12-30 | 2023-04-25 | 中国联合网络通信集团有限公司 | A cloud-network cross-domain alarm clustering method and device based on graph neural network |
-
2022
- 2022-10-24 CN CN202211303532.3A patent/CN115454787A/en active Pending
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN116016118A (en) * | 2022-12-30 | 2023-04-25 | 中国联合网络通信集团有限公司 | A cloud-network cross-domain alarm clustering method and device based on graph neural network |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN111124840B (en) | Method and device for predicting alarm in business operation and maintenance and electronic equipment | |
| CN110457175B (en) | Service data processing method and device, electronic equipment and medium | |
| CN108989075A (en) | A kind of network failure locating method and system | |
| CN105471647B (en) | A kind of power communication network fault positioning method | |
| CN115204536A (en) | Building equipment fault prediction method, device, equipment and storage medium | |
| CN115718846A (en) | Big data mining method and system for intelligent interactive network | |
| CN113191062A (en) | Power distribution network fault section positioning method and system based on multi-source incomplete information | |
| CN112906891A (en) | Expert system knowledge base construction method and device based on machine learning | |
| CN113495831B (en) | Method, system, equipment and medium for generating test case based on keywords | |
| CN115454787A (en) | Alarm classification method and device, electronic equipment and storage medium | |
| CN112559316A (en) | Software testing method and device, computer storage medium and server | |
| CN113239272B (en) | Intention prediction method and intention prediction device of network management and control system | |
| CN117376084A (en) | Fault detection method, electronic equipment and medium thereof | |
| CN111953531B (en) | Network fault analysis method and device | |
| US20240338270A1 (en) | Method and apparatus for reliability evaluation based on multiple performance degradation, and device | |
| CN117519951A (en) | Real-time data processing method and system based on message center | |
| CN113887452B (en) | Fault diagnosis optimization method based on correlation matrix | |
| CN116780515A (en) | Power consumption prediction method and device, computer equipment and storage medium | |
| CN114282598A (en) | Multi-source heterogeneous power grid data fusion method, device, equipment and computer medium | |
| CN114281474A (en) | Resource adjusting method and device | |
| KR20220042687A (en) | Method of Determining Whether A Smart Farm Sensor has failed using a Recurrent Neural Network(RNN) | |
| WO2022156743A1 (en) | Feature construction method and apparatus, model training method and apparatus, and device and medium | |
| CN118447459B (en) | Landslide accumulation monitoring method and system based on deep learning | |
| JP4780670B2 (en) | Traffic analysis model construction method, apparatus, construction program, and storage medium thereof | |
| Hsieh | Employing data mining technique to achieve the parameter optimization based on manufacturing intelligence |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination |