CN114358143A - Alarm event classification method, device, equipment and storage medium - Google Patents
Alarm event classification method, device, equipment and storage medium Download PDFInfo
- Publication number
- CN114358143A CN114358143A CN202111539912.2A CN202111539912A CN114358143A CN 114358143 A CN114358143 A CN 114358143A CN 202111539912 A CN202111539912 A CN 202111539912A CN 114358143 A CN114358143 A CN 114358143A
- Authority
- CN
- China
- Prior art keywords
- alarm event
- target
- alarm
- event
- unique identifier
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
- 238000000034 method Methods 0.000 title claims abstract description 63
- 238000012545 processing Methods 0.000 claims description 66
- 238000004422 calculation algorithm Methods 0.000 claims description 19
- 230000002159 abnormal effect Effects 0.000 claims description 17
- 238000004590 computer program Methods 0.000 claims description 12
- 238000012423 maintenance Methods 0.000 abstract description 18
- 238000010586 diagram Methods 0.000 description 17
- 230000008569 process Effects 0.000 description 12
- 230000006870 function Effects 0.000 description 9
- 238000004891 communication Methods 0.000 description 5
- 238000012986 modification Methods 0.000 description 5
- 230000004048 modification Effects 0.000 description 5
- 238000013145 classification model Methods 0.000 description 4
- 238000004364 calculation method Methods 0.000 description 3
- 239000000284 extract Substances 0.000 description 3
- 238000013473 artificial intelligence Methods 0.000 description 2
- 238000001514 detection method Methods 0.000 description 2
- 230000003287 optical effect Effects 0.000 description 2
- 238000012549 training Methods 0.000 description 2
- 101100514855 Mus musculus Mtx1 gene Proteins 0.000 description 1
- 230000004075 alteration Effects 0.000 description 1
- 230000005540 biological transmission Effects 0.000 description 1
- 230000019771 cognition Effects 0.000 description 1
- 230000003111 delayed effect Effects 0.000 description 1
- 238000005553 drilling Methods 0.000 description 1
- 230000003993 interaction Effects 0.000 description 1
- 238000002372 labelling Methods 0.000 description 1
- 238000002865 local sequence alignment Methods 0.000 description 1
- 238000004519 manufacturing process Methods 0.000 description 1
- 230000003068 static effect Effects 0.000 description 1
- 230000026676 system process Effects 0.000 description 1
Images
Landscapes
- Alarm Systems (AREA)
Abstract
The embodiment of the application provides an alarm event classification method, an alarm event classification device, alarm event classification equipment and a storage medium, and relates to the technical field of operation and maintenance, wherein the method comprises the following steps: the method comprises the steps of obtaining target alarm information corresponding to a target alarm event, extracting target trunk content of the target alarm information, generating a target unique identifier of the target alarm event based on the target trunk content, determining alarm event categories corresponding to the target alarm event based on the target unique identifier, and directly classifying the alarm events without performing an early supervised learning stage, so that the efficiency of classifying the alarm events is improved. And secondly, generating a target unique identifier of the target alarm event based on the extracted target main content, so that the target alarm event can be accurately represented, and the fuzzy characteristic of the alarm event is not determined from the text of the target alarm information, thereby improving the accuracy of alarm event classification.
Description
Technical Field
The embodiment of the invention relates to the technical field of operation and maintenance, in particular to a method, a device, equipment and a storage medium for classifying alarm events.
Background
As the business grows, the number of applications increases, and the number of alarm events generated by the applications increases sharply. Operation and maintenance personnel need to identify, classify and process tens of thousands of alarm events, and the operation and maintenance personnel are time-consuming and labor-consuming.
The traditional alarm event classification method is as follows: and training a classification model by adopting a supervised learning mode, and then setting the classification model on an event processing platform. And when the alarm information is collected, determining the category of the alarm event by adopting a classification model.
However, the above-mentioned method takes much time and labor for sample labeling and model training, which results in low efficiency of alarm event classification, and the classification model searches for features from the text of the alarm information itself for classification, which results in low accuracy of alarm event classification.
Disclosure of Invention
The embodiment of the application provides an alarm event classification method, an alarm event classification device, alarm event classification equipment and a storage medium, which are used for improving the accuracy and efficiency of alarm event classification.
In one aspect, an embodiment of the present application provides an alarm event classification method, where the method includes:
acquiring target alarm information corresponding to a target alarm event, and extracting target main content of the target alarm information;
generating a target unique identifier of the target alarm event based on the target main content;
and determining the alarm event category corresponding to the target alarm event based on the target unique identifier.
Optionally, the extracting the target main content of the target warning information includes:
extracting alarm attribute information of the target alarm event;
identifying variable information contained in the target alarm information;
removing the variable information from the target alarm information to obtain primary trunk information;
and splicing the primary trunk information and the alarm attribute information to obtain the target trunk content.
Optionally, the variable information comprises one or more of:
time information, address information, primary key information, host information, error codes and stop words.
Optionally, the generating a target unique identifier of the target alarm event based on the target backbone content includes:
and generating a target unique identifier of the target alarm event based on the target main content by adopting a message digest algorithm.
Optionally, the determining, based on the target unique identifier, an alarm event category corresponding to the target alarm event includes:
if the alarm event matched with the target unique identifier does not exist in the alarm event library, determining the alarm event type corresponding to the target alarm event as a new alarm event;
and if the alarm event matched with the target unique identifier exists in the alarm event library, determining the alarm event type corresponding to the target alarm event based on the matching result.
Optionally, if an alarm event matching the target unique identifier exists in the alarm event library, determining an alarm event category corresponding to the target alarm event based on a matching result, including:
and if the alarm event matched with the target unique identifier exists in the important event list contained in the alarm event library, determining the alarm event type corresponding to the target alarm event as the important alarm event.
Optionally, the method further comprises:
and if the alarm event matched with the target unique identifier exists in a standard event list contained in the alarm event library, determining that the alarm event type corresponding to the target alarm event is a standard alarm event.
Optionally, the method further comprises:
if an alarm event matched with the target unique identifier exists in a scenario event list contained in the alarm event library, determining that the alarm event category corresponding to the target alarm event is a scenario alarm event, wherein each scenario alarm event in the scenario event list contains a plurality of alarm events of different categories.
Optionally, the method further comprises:
and if the alarm event matched with the target unique identifier exists in the alarm event library and the occurrence frequency of the target alarm event is greater than the preset frequency within the first preset time, determining that the alarm event type of the target alarm event is a high-frequency alarm event.
Optionally, the method further comprises:
if the alarm event matched with the target unique identifier exists in the alarm event library and the occurrence frequency of the target alarm event is greater than the expected occurrence frequency within a second preset time length, determining that the alarm event type of the target alarm event is an abnormal alarm event, wherein the expected occurrence frequency is determined based on the historical occurrence frequency of the target alarm event.
Optionally, after determining the alarm event category corresponding to the target alarm event based on the target unique identifier, the method further includes:
determining alarm feedback information corresponding to the target alarm event based on the alarm event category corresponding to the target alarm event;
and sending the alarm feedback information to terminal equipment.
In one aspect, an embodiment of the present application provides an alarm event classification apparatus, where the apparatus includes:
the acquisition module is used for acquiring target alarm information corresponding to a target alarm event and extracting target main content of the target alarm information;
the processing module is used for generating a target unique identifier of the target alarm event based on the target main content;
and the classification module is used for determining the alarm event category corresponding to the target alarm event based on the target unique identifier.
Optionally, the obtaining module is specifically configured to:
extracting alarm attribute information of the target alarm event;
identifying variable information contained in the target alarm information;
removing the variable information from the target alarm information to obtain primary trunk information;
and splicing the primary trunk information and the alarm attribute information to obtain the target trunk content.
Optionally, the variable information comprises one or more of:
time information, address information, primary key information, host information, error codes and stop words.
Optionally, the processing module is specifically configured to:
and generating a target unique identifier of the target alarm event based on the target main content by adopting a message digest algorithm.
Optionally, the classification module is specifically configured to:
if the alarm event matched with the target unique identifier does not exist in the alarm event library, determining the alarm event type corresponding to the target alarm event as a new alarm event;
and if the alarm event matched with the target unique identifier exists in the alarm event library, determining the alarm event type corresponding to the target alarm event based on the matching result.
Optionally, the classification module is specifically configured to:
and if the alarm event matched with the target unique identifier exists in the important event list contained in the alarm event library, determining the alarm event type corresponding to the target alarm event as the important alarm event.
Optionally, the classification module is further configured to:
and if the alarm event matched with the target unique identifier exists in a standard event list contained in the alarm event library, determining that the alarm event type corresponding to the target alarm event is a standard alarm event.
Optionally, the classification module is further configured to:
if an alarm event matched with the target unique identifier exists in a scenario event list contained in the alarm event library, determining that the alarm event category corresponding to the target alarm event is a scenario alarm event, wherein each scenario alarm event in the scenario event list contains a plurality of alarm events of different categories.
Optionally, the classification module is further configured to:
and if the alarm event matched with the target unique identifier exists in the alarm event library and the occurrence frequency of the target alarm event is greater than the preset frequency within the first preset time, determining that the alarm event type of the target alarm event is a high-frequency alarm event.
Optionally, the classification module is further configured to:
if the alarm event matched with the target unique identifier exists in the alarm event library and the occurrence frequency of the target alarm event is greater than the expected occurrence frequency within a second preset time length, determining that the alarm event type of the target alarm event is an abnormal alarm event, wherein the expected occurrence frequency is determined based on the historical occurrence frequency of the target alarm event.
Optionally, the processing module is further configured to:
determining alarm feedback information corresponding to the target alarm event based on the alarm event category corresponding to the target alarm event after determining the alarm event category corresponding to the target alarm event based on the target unique identifier;
and sending the alarm feedback information to terminal equipment.
In one aspect, an embodiment of the present application provides a computer device, which includes a memory, a processor, and a computer program stored in the memory and executable on the processor, where the processor implements the steps of the alarm event classification method when executing the program.
In one aspect, embodiments of the present application provide a computer-readable storage medium, which stores a computer program executable by a computer device, and when the program runs on the computer device, the computer device is caused to execute the steps of the alarm event classification method.
In the embodiment of the application, the target trunk content of the target alarm information is extracted, the target unique identifier of the target alarm event is generated based on the target trunk content, the alarm event category corresponding to the target alarm event is determined based on the target unique identifier, the early supervised learning stage is not needed, and the alarm event classification can be directly carried out, so that the efficiency of the alarm event classification is improved. And secondly, generating a target unique identifier of the target alarm event based on the extracted target main content, so that the target alarm event can be accurately represented, and the fuzzy characteristic of the alarm event is not determined from the text of the target alarm information, thereby improving the accuracy of alarm event classification. In addition, the alarm event classification method in the embodiment of the application has certain universality, all formatted alarm information can be identified and classified by using the method in the application, and the method is concise and efficient, has high calculation speed and can perform high concurrent processing.
Drawings
In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings needed to be used in the description of the embodiments will be briefly introduced below, and it is obvious that the drawings in the following description are only some embodiments of the present invention, and it is obvious for those skilled in the art to obtain other drawings based on these drawings without inventive exercise.
Fig. 1 is a schematic structural diagram of a system architecture according to an embodiment of the present application;
fig. 2 is a schematic flowchart of an alarm event classification method according to an embodiment of the present application;
fig. 3 is a schematic diagram of target warning information provided in an embodiment of the present application;
fig. 4 is a schematic diagram of primary backbone information provided in an embodiment of the present application;
fig. 5 is a flowchart illustrating an alarm event classification method according to an embodiment of the present application;
fig. 6 is a schematic structural diagram of an alarm event classification device according to an embodiment of the present application;
fig. 7 is a schematic structural diagram of a computer device according to an embodiment of the present application.
Detailed Description
In order to make the objects, technical solutions and advantages of the present invention more clearly apparent, the present invention is described in further detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.
For convenience of understanding, terms referred to in the embodiments of the present invention are explained below.
Smith-waterman algorithm: smith-waterman algorithm, an algorithm for local sequence alignment.
The Lauda criterion: firstly, a group of detection data is supposed to only contain random errors, the detection data is calculated to obtain standard deviation, an interval is determined according to a certain probability, the errors exceeding the interval are considered not to belong to the random errors but to be coarse errors, and the data containing the errors are removed.
MD 5: MD5 Message Digest Algorithm (MD5 Message-Digest Algorithm), a widely used cryptographic hash function, may generate a 128-bit (16-byte) hash value (hash value) to ensure the integrity of the Message transmission.
Sha (secure Hash algorithm): secure hash algorithm, a family of cryptographic hash functions, is an algorithm that can compute a fixed-length string (also called a message digest) corresponding to a digital message.
Referring to fig. 1, it is a system architecture diagram applicable to the embodiment of the present application, where the system architecture at least includes an application system 101, an event processing system 102, and a terminal device 103, the number of the application systems 101 may be one or more, the number of the event processing system 102 may be one or more, and the number of the terminal device 103 may be one or more, and the present application does not specifically limit the numbers of the application systems 101, the event processing systems 102, and the terminal devices 103.
The application system 101 provides related application service for a user side, the application system 101 may be an independent physical server, a server cluster or a distributed system formed by a plurality of physical servers, or a cloud server providing basic cloud computing services such as a cloud service, a cloud database, cloud computing, a cloud function, cloud storage, a Network service, cloud communication, middleware service, a domain name service, a security service, a Content Delivery Network (CDN), a big data and artificial intelligence platform, and the like.
The event processing system 102 is used to classify alarm events while providing some solution to the handling of alarm events. The event processing system 102 may be an independent physical server, a server cluster or a distributed system formed by a plurality of physical servers, or a cloud server providing basic cloud computing services such as a cloud service, a cloud database, cloud computing, a cloud function, cloud storage, a Network service, cloud communication, a middleware service, a domain name service, a security service, a Content Delivery Network (CDN), a big data and artificial intelligence platform, and the like. The application system 101 and the event processing system 102 may be directly or indirectly connected through wired or wireless communication, and the application is not limited herein.
The operation and maintenance application related to operation and maintenance is pre-installed in the terminal device 103, wherein the operation and maintenance application is a client application, a web page application, an applet application, and the like. The terminal device 103 may be a smart phone, a tablet computer, a notebook computer, a desktop computer, an intelligent household appliance, an intelligent voice interaction device, an intelligent vehicle-mounted device, and the like, but is not limited thereto. The event processing system 102 and the terminal device 103 may be directly or indirectly connected through wired or wireless communication, and the application is not limited herein.
In the embodiment of the present application, the application system 101 sends target alarm information corresponding to a target alarm event to the event processing system 102. The event processing system 102 extracts the target backbone content of the target alarm information and then generates a target unique identifier for the target alarm event based on the target backbone content. And determining the alarm event type corresponding to the target alarm event based on the target unique identifier. The event processing system 102 determines alarm feedback information corresponding to the target alarm event based on the alarm event category corresponding to the target alarm event, and then sends the alarm feedback information to the terminal device 103. The operation and maintenance personnel can obtain the alarm event category of the target alarm event and the processing scheme of the target alarm event through the operation and maintenance application in the terminal device 103, so that the operation and maintenance personnel can timely and accurately process the target alarm event, and the processing quality and efficiency of the target alarm event are improved.
Based on the system architecture diagram shown in fig. 1, an embodiment of the present application provides a flow of an alarm event classification method, as shown in fig. 2, where the flow of the method is executed by a computer device, which may be the event processing system 102 shown in fig. 1, and includes the following steps:
step S201, obtain the target alarm information corresponding to the target alarm event, and extract the target backbone content of the target alarm information.
Specifically, the main content refers to the unchanged content in the similar alarm information. When the application system processes the transaction, the same error processing logic is executed for the same error reporting content when the program processes, so that the main content in the alarm information is consistent, and the different is variable information, wherein the variable information comprises one or more of the following items: time information, address information, primary key information, host information, error codes, stop words, etc.
Aiming at target alarm information, the embodiment of the application at least provides the following implementation modes to extract the target main content:
extracting alarm attribute information of the target alarm event, identifying variable information contained in the target alarm information, and removing the variable information from the target alarm information to obtain primary trunk information. And splicing the primary backbone information and the alarm attribute information to obtain the target backbone content.
In a specific implementation, the alarm attribute information of the target alarm event refers to feature information of the target alarm event. For example, if the target alarm event is from the application system a, "application system a" is used as the alarm attribute information of the target alarm event.
And identifying pause words contained in the target alarm information, and removing the pause words from the target alarm information, wherein the pause words comprise Chinese and English pause words. And identifying a variable character string contained in the target alarm information, wherein the variable character string comprises an IP address, a time character string, a primary key number, an error code and the like, and then removing the variable character string from the target alarm information to obtain primary backbone information. And splicing the primary backbone information and the alarm attribute information to obtain the target backbone content.
It should be noted that, in the embodiment of the present application, the primary backbone information may also be directly used as the target backbone content, and the present application is not limited specifically.
Step S202, based on the target main content, generating a target unique identifier of the target alarm event.
Specifically, a message digest algorithm is adopted to generate a target unique identifier of the target alarm event based on the target main content, wherein the message digest algorithm may be an MD5 algorithm, an SHA algorithm, or the like.
For example, referring to fig. 3, a schematic diagram of target warning information provided in the embodiment of the present application is shown.
Since the target alarm message is from the application system a, the extracted alarm attribute information of the target alarm event is "application system a".
Identifying variable information such as time character strings, primary key numbers, stop words and the like contained in the target alarm message, then removing the variable information of the target alarm message, and obtaining primary trunk information, as shown in fig. 4, wherein the primary trunk information comprises: service name, mtxn, KEY, transaction failure, partial failure of update, index table lookup, round overrun.
Splicing the primary trunk information and the alarm attribute information of the target alarm event to obtain target trunk content, then inputting the target trunk content into an MD5 algorithm to obtain a target unique identifier (MD5 value) of the target alarm event as follows: f338b472c48a2534b0f9aa3509680a6 b.
In the embodiment of the application, a message digest algorithm is adopted, and the target unique identifier of the target alarm event is generated based on the target main content, so that the target alarm event is accurately represented. And obtaining the alarm event category corresponding to the target alarm event through unique identifier matching, and realizing accurate classification of the target alarm event.
Step S203, based on the target unique identifier, determining the alarm event category corresponding to the target alarm event.
Specifically, the alarm event category corresponding to the target alarm event may be one or more of the following categories: new alarm events, important alarm events, standard alarm events, scenized alarm events, high frequency alarm events, abnormal alarm events, and the like.
In the embodiment of the application, the target trunk content of the target alarm information is extracted, the target unique identifier of the target alarm event is generated based on the target trunk content, the alarm event category corresponding to the target alarm event is determined based on the target unique identifier, the early supervised learning stage is not needed, and the alarm event classification can be directly carried out, so that the efficiency of the alarm event classification is improved. And secondly, generating a target unique identifier of the target alarm event based on the extracted target main content, so that the target alarm event can be accurately represented, and the fuzzy characteristic of the alarm event is not determined from the text of the target alarm information, thereby improving the accuracy of alarm event classification.
Optionally, after determining the alarm event category corresponding to the target alarm event based on the target unique identifier, determining alarm feedback information corresponding to the target alarm event based on the alarm event category corresponding to the target alarm event, and then sending the alarm feedback information to the terminal device.
Specifically, the alarm feedback information includes an alarm event category corresponding to the target alarm event, and may also include a processing scheme of the target alarm event or other information. The alarm feedback information is sent to the terminal equipment, and the terminal equipment can display the alarm feedback information in the display interface, so that operation and maintenance personnel can accurately know the alarm event type corresponding to the target alarm event and the processing scheme of the target alarm event, so that the operation and maintenance personnel can timely and accurately process the target alarm event, and the processing quality and efficiency of the target alarm event are improved.
Optionally, in step S203, if there is no alarm event matching the target unique identifier in the alarm event library, the alarm event category corresponding to the target alarm event is determined to be a new alarm event. And if the alarm event matched with the target unique identifier exists in the alarm event library, determining the alarm event type corresponding to the target alarm event based on the matching result.
Specifically, if the alarm event matched with the target unique identifier does not exist in the alarm event library, the target alarm event is determined to be a new alarm event, and the target alarm event and the target unique identifier are correspondingly stored in the alarm event library. Furthermore, according to the characteristics of the target alarm event, the target alarm event and the corresponding target unique identifier can be stored in an important event list, a standard event list, a scene event list and other alarm event lists of specific categories in the alarm event library, so that continuous learning of the occurred alarm event is realized, and the alarm event library is automatically updated.
In the embodiment of the application, the target unique identifier of the target alarm event is obtained by extracting the target main content of the target alarm information, and then whether the target alarm event is a new alarm event is determined by matching the target unique identifier with the alarm event library, so that the new alarm event is accurately identified without learning in advance.
Optionally, in view of the fact that an alarm event matching the target unique identifier exists in the alarm event library, the embodiments of the present application at least provide the following embodiments, and determine an alarm event category corresponding to the target alarm event:
in the first embodiment, if an alarm event matched with the target unique identifier exists in an important event list contained in the alarm event library, the alarm event category corresponding to the target alarm event is determined to be an important alarm event.
Specifically, a significant event list is configured in advance, and the significant alarm events in the significant event list are obtained in the following manner:
in the first mode, in the process of executing alarm event classification, if the target alarm event is a new alarm event and the target alarm event conforms to the characteristics of the important alarm event, the target alarm event and the corresponding target unique identifier are added to an important event list.
And secondly, aiming at the existing historical alarm event, if the historical alarm event accords with the characteristics of the important alarm event, extracting the main content of the historical alarm event, and then generating the unique identifier of the historical alarm event based on the main content of the historical alarm event. The historical alarm events and corresponding unique identifications are then added to the list of significant events.
In addition, for each important alarm event in the important event list, a processing scheme of the important alarm event is configured in advance.
In the alarm event classification process, aiming at a target alarm event, the unique target identifier is compared with the unique identifiers of all important alarm events in an important event list. And if the important alarm event matched with the target unique identifier exists in the important event list, determining the target alarm event as the important alarm event, and simultaneously acquiring a processing scheme of the target alarm event. And then sending the alarm event category and the processing scheme of the target alarm event to the terminal equipment.
And the terminal equipment displays the alarm event category of the target alarm event in a display interface and simultaneously displays the processing scheme of the target alarm event. And if the important alarm event matched with the target unique identifier does not exist in the important event list, determining that the target alarm event is a non-important alarm event.
After determining that the target alarm event is an important alarm event or a non-important alarm event, it may be further determined whether the target alarm event is of another alarm event category, where the another alarm event category includes a standard alarm event, a scenario alarm event, a high-frequency alarm event, an abnormal alarm event, and the like.
In the embodiment of the application, the important event list is set in the alarm event library to store the occurred important alarm events, so that when the important alarm events occur again, the important event list is matched through the unique identifier, the important alarm events can be found in time and the processing scheme of the important alarm events can be pushed, operation and maintenance personnel can process the important alarm events in time, the processing opportunity is prevented from being delayed due to the fact that the cognition degree of the important alarm events is not enough, and the processing quality and efficiency of the important alarm events are improved.
And in the second implementation mode, if the alarm event matched with the target unique identifier exists in the standard event list contained in the alarm event library, determining the alarm event type corresponding to the target alarm event as the standard alarm event.
Specifically, the standard event list is configured in advance, and a manner of obtaining the standard alarm event in the standard event list is the same as a manner of obtaining the important alarm event in the important event list, and details are not repeated here.
In addition, a standard processing scheme of the standard alarm event is configured in advance aiming at each important alarm event in the standard event list.
In the alarm event classification process, aiming at a target alarm event, the unique target identifier is compared with the unique identifier of each standard alarm event in the standard event list. And if the standard event list has the standard alarm event matched with the target unique identifier, determining the target alarm event as the standard alarm event, and simultaneously acquiring a standard processing scheme of the target alarm event. And then sending the alarm event category and the standard processing scheme of the target alarm event to the terminal equipment.
And the terminal equipment displays the alarm event category of the target alarm event in a display interface and simultaneously displays the standard processing scheme of the target alarm event. And if the standard alarm event matched with the target unique identifier does not exist in the standard event list, determining that the target alarm event is a non-standard alarm event.
After determining that the target alarm event is a standard alarm event or a non-standard alarm event, it may be further determined whether the target alarm event is of another alarm event category, where the another alarm event category includes an important alarm event, a scenario alarm event, a high-frequency alarm event, an abnormal alarm event, and the like.
In the embodiment of the application, the standard event list is set in the alarm event library to store the occurred standard alarm events, so that when the standard alarm events occur again, the important alarm events can be found in time and the processing scheme of the important alarm events can be pushed through matching the unique identifier with the standard event list, so that operation and maintenance personnel can conveniently carry out standardized processing on the standard alarm events in time, the automatic processing of the alarm events is realized, and the processing efficiency of the alarm events is improved.
And if the alarm event matched with the target unique identifier exists in the scene event list contained in the alarm event library, determining the alarm event type corresponding to the target alarm event as the scene alarm event.
Specifically, each of the scenized alarm events in the scenized event list contains a plurality of different categories of alarm events. For example, in a scenario in which a switch port is down, some types of alarm events occur in an application system, a network device, a physical system device, and the like.
A scene event list is configured in advance, and scene alarm events in the scene event list are obtained in the following mode:
and aiming at the drilling scene or the actual scene, when the scene occurs, marking and integrating the categories of the corresponding reported alarm events to obtain the scene alarm events. And then extracting the main content of the scene alarm event, and generating the unique identifier of the scene alarm event based on the main content of the scene alarm event. And then adding the scenario alarm event and the corresponding unique identifier to a scenario event list. In addition, a processing scheme of the scenized alarm event is configured in advance for each scenized alarm event in the scenized event list.
In the alarm event classification process, aiming at a target alarm event, the target unique identifier is compared with the unique identifier of each scene alarm event in the scene event list. And if the scene alarm event matched with the target unique identifier exists in the scene event list, determining the target alarm event as the scene alarm event, and simultaneously acquiring a processing scheme of the target alarm event. And then sending the alarm event category and the processing scheme of the target alarm event to the terminal equipment.
And the terminal equipment displays the alarm event category of the target alarm event in a display interface and simultaneously displays the processing scheme of the target alarm event. And if the scene alarm event matched with the target unique identifier does not exist in the scene event list, determining that the target alarm event is a non-scene alarm event.
After determining that the target alarm event is a scenic alarm event or a non-scenic alarm event, it may be further determined whether the target alarm event is of other alarm event categories, where the other alarm event categories include an important alarm event, a standard alarm event, a high-frequency alarm event, an abnormal alarm event, and the like.
In the embodiment of the application, multiple types of alarm events associated with the same scene are intelligently associated to form a scene event, so that the problem that the fault reason cannot be judged by independently analyzing some alarm events is solved, and operation and maintenance personnel are effectively helped to locate the root cause of the fault. And secondly, setting a scene event list in the alarm event library to store the occurred scene alarm events, so that when the scene alarm events occur again, the scene event list is matched through the unique identifier, the scene alarm events can be timely found and a processing scheme of the scene alarm events can be pushed, operation and maintenance personnel can timely process the scene alarm events, and the processing efficiency and accuracy of the alarm events are improved.
And if the alarm event matched with the target unique identifier exists in the alarm event library and the occurrence frequency of the target alarm event is greater than the preset frequency within the first preset time, determining that the alarm event type of the target alarm event is a high-frequency alarm event.
In particular, some alarm events may not need to be processed when they occur once, but may have a serious hidden danger when they occur many times in a short time, so that attention needs to be paid to such alarm events, which may also be referred to as high-frequency alarm events.
The first preset time and the preset times can be set according to actual conditions so as to identify the high-frequency alarm event. In addition, if the alarm event matched with the target unique identifier exists in the alarm event library and the occurrence frequency of the target alarm event in the first preset time length is less than or equal to the preset frequency, determining that the alarm event type of the target alarm event is a non-high-frequency alarm event.
For example, the first preset time period is set to be 1 hour, and the preset number of times is set to be 3 times. And if the alarm event matched with the target unique identifier exists in the alarm event library and the occurrence frequency of the target alarm event is more than 3 times within 1 hour, determining that the alarm event type of the target alarm event is a high-frequency alarm event.
And if the alarm event matched with the target unique identifier exists in the alarm event library and the occurrence frequency of the target alarm event is less than or equal to 3 times within 1 hour, determining that the alarm event type of the target alarm event is a non-high-frequency alarm event.
After determining that the target alarm event is a high-frequency alarm event or a non-high-frequency alarm event, it may be further determined whether the target alarm event is of another alarm event category, where the another alarm event category includes an important alarm event, a standard alarm event, a scenario alarm event, an abnormal alarm event, and the like.
In the embodiment of the application, when the target alarm event exists in the alarm event library is determined by matching the unique identifier, the occurrence frequency of the target alarm event within the first preset time length is counted, so that the high-frequency alarm event can be found in time and is correspondingly processed, and the processing efficiency and accuracy of the alarm event are improved.
And in the fifth implementation mode, if the alarm event matched with the target unique identifier exists in the alarm event library and the occurrence frequency of the target alarm event is greater than the expected occurrence frequency within the second preset time length, determining that the alarm event type of the target alarm event is an abnormal alarm event, wherein the expected occurrence frequency is determined based on the historical occurrence frequency of the target alarm event.
Specifically, the expected occurrence number of the target alarm event is determined based on the historical occurrence number of the target alarm event within the second preset time length through the Lauda criterion. And if the occurrence frequency of the target alarm event is greater than the expected occurrence frequency within the second preset time length, determining that the alarm event type of the target alarm event is an abnormal alarm event. And if the alarm event matched with the target unique identifier exists in the alarm event library and the occurrence frequency of the target alarm event is not greater than the expected occurrence frequency within the second preset time length, determining that the alarm event type of the target alarm event is a normal alarm event.
For example, setting the second preset duration to be one day, the expected number of times today is determined to be 10 times based on the historical number of times the target alarm event occurred each day in the past.
And if the alarm event matched with the target unique identifier exists in the alarm event library and the occurrence frequency of the target alarm event is more than 10 times in today, determining that the alarm event type of the target alarm event is an abnormal alarm event.
And if the alarm event matched with the target unique identifier exists in the alarm event library and the occurrence frequency of the target alarm event in the current day is less than or equal to 10 times, determining that the alarm event type of the target alarm event is a normal alarm event.
After determining that the target alarm event is an abnormal alarm event or a normal alarm event, it may be further determined whether the target alarm event is of another alarm event category, where the another alarm event category includes an important alarm event, a standard alarm event, a scenario alarm event, a high-frequency alarm event, and the like.
In the embodiment of the application, aiming at frequently occurring alarm events, the expected occurrence frequency of the alarm events is determined based on the historical occurrence frequency of the alarm events, and then when the target alarm events exist in the alarm event library is determined through matching the unique identifier, whether the occurrence frequency of the target alarm events in the second preset time exceeds the expected occurrence frequency is judged, so that abnormal alarm events can be found in time, corresponding processing is carried out, and the processing efficiency and accuracy of the alarm events are improved.
It should be noted that, in this embodiment of the present application, when determining the alarm event category corresponding to the target alarm event based on the matching result, any one or more of the first to fifth embodiments may be executed, and meanwhile, the alarm event category corresponding to the target alarm event may be any one or more of the above-mentioned important alarm event, standard alarm event, scenario alarm event, high-frequency alarm event, and abnormal alarm event. In addition, the types of the alarm events are not limited to alarm events, standard alarm events, scenario alarm events, high-frequency alarm events, and abnormal alarm events, and may be other types, which is not specifically limited in this application.
To better explain the embodiment of the present application, an alarm event classification method provided by the embodiment of the present application is described below with reference to specific implementation scenarios, as shown in fig. 5, a flow of the method is executed by a computer device, which may be the event processing system 102 shown in fig. 1, and includes the following steps:
step S501, target alarm information corresponding to the target alarm event is obtained.
Step S502, extracting the alarm attribute information of the target alarm event.
Step S503, recognizing Chinese and English stop words.
In step S504, a variable string is identified.
Specifically, the variable character string includes an IP address, a time character string, a primary key number, and the like.
And step S505, removing Chinese and English stop words and variable character strings from the target warning information to obtain primary trunk information.
Step S506, the primary backbone information and the alarm attribute information are spliced to obtain the target backbone content.
And step S507, converting the target main content into an MD5 value by adopting an MD5 algorithm.
In step S508, it is determined whether the target alarm event is a new alarm event based on the MD5 value, if so, step S514 is executed, otherwise, step S509 is executed.
And if the alarm event matched with the MD5 value does not exist in the alarm event library, determining the target alarm event as a new alarm event, and then storing the MD5 value corresponding to the target alarm event in the alarm event library for updating the alarm event library. If there is an alarm event in the alarm event library that matches the MD5 value, then it is determined that the target alarm event is not a new alarm event.
In step S509, the important alarm event is matched.
Specifically, the MD5 value is compared with the unique identifier of each significant alarm event in the significant event list. And if the important alarm event which is matched with the MD5 value exists in the important event list, determining that the target alarm event is the important alarm event, and acquiring the processing scheme of the target alarm event.
If there is no significant alarm event in the significant event list that matches the MD5 value, the target alarm event is determined to be a non-significant alarm event.
Step S510, standard alarm event matching.
Specifically, the MD5 value is compared to the unique identifier of each standard alarm event in the standard event list. And if the standard alarm event matched with the MD5 value exists in the standard event list, determining the target alarm event as the standard alarm event, and acquiring a standard processing scheme of the target alarm event.
If there is no standard alarm event in the standard event list that matches the MD5 value, the target alarm event is determined to be a non-standard alarm event.
And step S511, matching the scene alarm event.
Specifically, the MD5 value is compared with the unique identifier of each of the scenized alarm events in the scenized event list. And if the scene alarm event matched with the MD5 value exists in the scene event list, determining the target alarm event as the scene alarm event, and acquiring a processing scheme of the target alarm event.
And if no scene alarm event which is matched with the MD5 value exists in the scene event list, determining that the target alarm event is a non-scene alarm event.
And step S512, judging a high-frequency alarm event.
And if the alarm event matched with the MD5 value exists in the alarm event library and the occurrence frequency of the target alarm event in the first preset time length is greater than the preset frequency, determining that the target alarm event is a high-frequency alarm event. And if the alarm event matched with the MD5 value exists in the alarm event library and the occurrence frequency of the target alarm event in the first preset time length is less than or equal to the preset frequency, determining that the target alarm event is a non-high-frequency alarm event.
And step S513, judging the occurrence frequency of the alarm event.
And if the alarm event matched with the MD5 value exists in the alarm event library and the occurrence frequency of the target alarm event is greater than the expected occurrence frequency within the second preset time length, determining that the target alarm event is an abnormal alarm event. And if the alarm event matched with the MD5 value exists in the alarm event library and the occurrence frequency of the target alarm event in the second preset time length is less than or equal to the expected occurrence frequency, determining that the target alarm event is a normal alarm event.
Step S514, based on the alarm event category corresponding to the target alarm event, generating alarm feedback information corresponding to the target alarm event.
Specifically, the alarm feedback information includes an alarm event category corresponding to the target alarm event, and may also include a processing scheme of the target alarm event or other information. The alarm feedback information is sent to the terminal equipment, and the terminal equipment can display the alarm feedback information in the display interface, so that operation and maintenance personnel can accurately know the alarm event type corresponding to the target alarm event and the processing scheme of the target alarm event, so that the operation and maintenance personnel can timely and accurately process the target alarm event, and the processing quality and efficiency of the target alarm event are improved.
In the embodiment of the application, the target trunk content of the target alarm information is extracted, the target unique identifier of the target alarm event is generated based on the target trunk content, the alarm event category corresponding to the target alarm event is determined based on the target unique identifier, the early supervised learning stage is not needed, and the alarm event classification can be directly carried out, so that the efficiency of the alarm event classification is improved. And secondly, generating a target unique identifier of the target alarm event based on the extracted target main content, so that the target alarm event can be accurately represented, and the fuzzy characteristic of the alarm event is not determined from the text of the target alarm information, thereby improving the accuracy of alarm event classification. In addition, the alarm event classification method in the embodiment of the application has certain universality, all formatted alarm information can be identified and classified by using the method in the application, and the method is concise and efficient, has high calculation speed and can perform high concurrent processing.
Based on the same technical concept, an embodiment of the present application provides a schematic structural diagram of an alarm event classification device, as shown in fig. 6, the device 600 includes:
an obtaining module 601, configured to obtain target alarm information corresponding to a target alarm event, and extract target backbone content of the target alarm information;
a processing module 602, configured to generate a target unique identifier of the target alarm event based on the target backbone content;
the classification module 603 is configured to determine, based on the target unique identifier, an alarm event category corresponding to the target alarm event.
Optionally, the obtaining module 601 is specifically configured to:
extracting alarm attribute information of the target alarm event;
identifying variable information contained in the target alarm information;
removing the variable information from the target alarm information to obtain primary trunk information;
and splicing the primary trunk information and the alarm attribute information to obtain the target trunk content.
Optionally, the variable information comprises one or more of:
time information, address information, primary key information, host information, error codes and stop words.
Optionally, the processing module 602 is specifically configured to:
and generating a target unique identifier of the target alarm event based on the target main content by adopting a message digest algorithm.
Optionally, the classification module 603 is specifically configured to:
if the alarm event matched with the target unique identifier does not exist in the alarm event library, determining the alarm event type corresponding to the target alarm event as a new alarm event;
and if the alarm event matched with the target unique identifier exists in the alarm event library, determining the alarm event type corresponding to the target alarm event based on the matching result.
Optionally, the classification module 603 is specifically configured to:
and if the alarm event matched with the target unique identifier exists in the important event list contained in the alarm event library, determining the alarm event type corresponding to the target alarm event as the important alarm event.
Optionally, the classification module 603 is further configured to:
and if the alarm event matched with the target unique identifier exists in a standard event list contained in the alarm event library, determining that the alarm event type corresponding to the target alarm event is a standard alarm event.
Optionally, the classification module 603 is further configured to:
if an alarm event matched with the target unique identifier exists in a scenario event list contained in the alarm event library, determining that the alarm event category corresponding to the target alarm event is a scenario alarm event, wherein each scenario alarm event in the scenario event list contains a plurality of alarm events of different categories.
Optionally, the classification module 603 is further configured to:
and if the alarm event matched with the target unique identifier exists in the alarm event library and the occurrence frequency of the target alarm event is greater than the preset frequency within the first preset time, determining that the alarm event type of the target alarm event is a high-frequency alarm event.
Optionally, the classification module 603 is further configured to:
if the alarm event matched with the target unique identifier exists in the alarm event library and the occurrence frequency of the target alarm event is greater than the expected occurrence frequency within a second preset time length, determining that the alarm event type of the target alarm event is an abnormal alarm event, wherein the expected occurrence frequency is determined based on the historical occurrence frequency of the target alarm event.
Optionally, the processing module 602 is further configured to:
determining alarm feedback information corresponding to the target alarm event based on the alarm event category corresponding to the target alarm event after determining the alarm event category corresponding to the target alarm event based on the target unique identifier;
and sending the alarm feedback information to terminal equipment.
In the embodiment of the application, the target trunk content of the target alarm information is extracted, the target unique identifier of the target alarm event is generated based on the target trunk content, the alarm event category corresponding to the target alarm event is determined based on the target unique identifier, the early supervised learning stage is not needed, and the alarm event classification can be directly carried out, so that the efficiency of the alarm event classification is improved. And secondly, generating a target unique identifier of the target alarm event based on the extracted target main content, so that the target alarm event can be accurately represented, and the fuzzy characteristic of the alarm event is not determined from the text of the target alarm information, thereby improving the accuracy of alarm event classification. In addition, the alarm event classification method in the embodiment of the application has certain universality, all formatted alarm information can be identified and classified by using the method in the application, and the method is concise and efficient, has high calculation speed and can perform high concurrent processing.
Based on the same technical concept, the embodiment of the present application provides a computer device, which may be the event processing system 102 shown in fig. 1, as shown in fig. 7, and includes at least one processor 701 and a memory 702 connected to the at least one processor, where a specific connection medium between the processor 701 and the memory 702 is not limited in the embodiment of the present application, and the processor 701 and the memory 702 are connected through a bus in fig. 7 as an example. The bus may be divided into an address bus, a data bus, a control bus, etc.
In the embodiment of the present application, the memory 702 stores instructions executable by the at least one processor 701, and the at least one processor 701 may execute the steps of the alarm event classification method by executing the instructions stored in the memory 702.
The processor 701 is a control center of the computer device, and may connect various parts of the computer device by using various interfaces and lines, and implement alarm event classification by executing or executing instructions stored in the memory 702 and calling data stored in the memory 702. Optionally, the processor 701 may include one or more processing units, and the processor 701 may integrate an application processor and a modem processor, wherein the application processor mainly handles an operating system, a user interface, an application program, and the like, and the modem processor mainly handles wireless communication. It will be appreciated that the modem processor described above may not be integrated into the processor 701. In some embodiments, processor 701 and memory 702 may be implemented on the same chip, or in some embodiments, they may be implemented separately on separate chips.
The processor 701 may be a general-purpose processor, such as a Central Processing Unit (CPU), a digital signal processor, an Application Specific Integrated Circuit (ASIC), a field programmable gate array or other programmable logic device, discrete gate or transistor logic, discrete hardware components, or any combination thereof, configured to implement or perform the methods, steps, and logic blocks disclosed in the embodiments of the present Application. A general purpose processor may be a microprocessor or any conventional processor or the like. The steps of a method disclosed in connection with the embodiments of the present application may be directly implemented by a hardware processor, or may be implemented by a combination of hardware and software modules in a processor.
Based on the same inventive concept, embodiments of the present application provide a computer-readable storage medium storing a computer program executable by a computer device, which, when the program is run on the computer device, causes the computer device to perform the steps of the above alarm event classification method.
It should be apparent to those skilled in the art that embodiments of the present invention may be provided as a method, or computer program product. Accordingly, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, and the like) having computer-usable program code embodied therein.
The present invention is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each flow and/or block of the flow diagrams and/or block diagrams, and combinations of flows and/or blocks in the flow diagrams and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instruction means which implement the function specified in the flowchart flow or flows and/or block diagram block or blocks.
These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
While preferred embodiments of the present invention have been described, additional variations and modifications in those embodiments may occur to those skilled in the art once they learn of the basic inventive concepts. Therefore, it is intended that the appended claims be interpreted as including preferred embodiments and all such alterations and modifications as fall within the scope of the invention.
It will be apparent to those skilled in the art that various changes and modifications may be made in the present invention without departing from the spirit and scope of the invention. Thus, if such modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include such modifications and variations.
Claims (14)
1. An alarm event classification method is characterized by comprising the following steps:
acquiring target alarm information corresponding to a target alarm event, and extracting target main content of the target alarm information;
generating a target unique identifier of the target alarm event based on the target main content;
and determining the alarm event category corresponding to the target alarm event based on the target unique identifier.
2. The method of claim 1, wherein the extracting the target backbone content of the target warning information comprises:
extracting alarm attribute information of the target alarm event;
identifying variable information contained in the target alarm information;
removing the variable information from the target alarm information to obtain primary trunk information;
and splicing the primary trunk information and the alarm attribute information to obtain the target trunk content.
3. The method of claim 2, wherein the variable information comprises one or more of:
time information, address information, primary key information, host information, error codes and stop words.
4. The method of claim 1, wherein generating the target unique identification of the target alarm event based on the target backbone content comprises:
and generating a target unique identifier of the target alarm event based on the target main content by adopting a message digest algorithm.
5. The method of claim 1, wherein the determining the alarm event category corresponding to the target alarm event based on the target unique identifier comprises:
if the alarm event matched with the target unique identifier does not exist in the alarm event library, determining the alarm event type corresponding to the target alarm event as a new alarm event;
and if the alarm event matched with the target unique identifier exists in the alarm event library, determining the alarm event type corresponding to the target alarm event based on the matching result.
6. The method of claim 5, wherein if there is an alarm event in the alarm event library that matches the target unique identifier, determining the alarm event category corresponding to the target alarm event based on the matching result comprises:
and if the alarm event matched with the target unique identifier exists in the important event list contained in the alarm event library, determining the alarm event type corresponding to the target alarm event as the important alarm event.
7. The method of claim 5, further comprising:
and if the alarm event matched with the target unique identifier exists in a standard event list contained in the alarm event library, determining that the alarm event type corresponding to the target alarm event is a standard alarm event.
8. The method of claim 5, further comprising:
if an alarm event matched with the target unique identifier exists in a scenario event list contained in the alarm event library, determining that the alarm event category corresponding to the target alarm event is a scenario alarm event, wherein each scenario alarm event in the scenario event list contains a plurality of alarm events of different categories.
9. The method of claim 5, further comprising:
and if the alarm event matched with the target unique identifier exists in the alarm event library and the occurrence frequency of the target alarm event is greater than the preset frequency within the first preset time, determining that the alarm event type of the target alarm event is a high-frequency alarm event.
10. The method of claim 5, further comprising:
if the alarm event matched with the target unique identifier exists in the alarm event library and the occurrence frequency of the target alarm event is greater than the expected occurrence frequency within a second preset time length, determining that the alarm event type of the target alarm event is an abnormal alarm event, wherein the expected occurrence frequency is determined based on the historical occurrence frequency of the target alarm event.
11. The method according to any one of claims 1 to 10, wherein after determining the alarm event category corresponding to the target alarm event based on the target unique identifier, further comprising:
determining alarm feedback information corresponding to the target alarm event based on the alarm event category corresponding to the target alarm event;
and sending the alarm feedback information to terminal equipment.
12. An alarm event classification device, comprising:
the acquisition module is used for acquiring target alarm information corresponding to a target alarm event and extracting target main content of the target alarm information;
the processing module is used for generating a target unique identifier of the target alarm event based on the target main content;
and the classification module is used for determining the alarm event category corresponding to the target alarm event based on the target unique identifier.
13. A computer device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, wherein the steps of the method of any of claims 1 to 11 are performed when the program is executed by the processor.
14. A computer-readable storage medium, storing a computer program executable by a computer device, the program, when executed on the computer device, causing the computer device to perform the steps of the method of any one of claims 1 to 11.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202111539912.2A CN114358143A (en) | 2021-12-15 | 2021-12-15 | Alarm event classification method, device, equipment and storage medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202111539912.2A CN114358143A (en) | 2021-12-15 | 2021-12-15 | Alarm event classification method, device, equipment and storage medium |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN114358143A true CN114358143A (en) | 2022-04-15 |
Family
ID=81100190
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202111539912.2A Pending CN114358143A (en) | 2021-12-15 | 2021-12-15 | Alarm event classification method, device, equipment and storage medium |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN114358143A (en) |
Citations (8)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20150193296A1 (en) * | 2012-07-02 | 2015-07-09 | Tencent Technology (Shenzhen) Company Limited | Run-time error repairing method, device and system |
| US20200073738A1 (en) * | 2018-08-28 | 2020-03-05 | Sap Se | Error incident fingerprinting with unique static identifiers |
| CN111262730A (en) * | 2020-01-10 | 2020-06-09 | 中国银联股份有限公司 | Method and device for processing alarm information |
| CN111953541A (en) * | 2020-08-10 | 2020-11-17 | 腾讯科技（深圳）有限公司 | Alarm information processing method and device, computer equipment and storage medium |
| CN112087465A (en) * | 2020-09-17 | 2020-12-15 | 北京微步在线科技有限公司 | Method and device for determining threat event based on aggregated information |
| WO2021174835A1 (en) * | 2020-03-04 | 2021-09-10 | 平安科技（深圳）有限公司 | Alarm information processing method and apparatus, and computer apparatus and storage medium |
| CN113377820A (en) * | 2021-07-12 | 2021-09-10 | 杭州安恒信息技术股份有限公司 | Aggregation alarm method and device, electronic equipment and storage medium |
| CN113778800A (en) * | 2021-09-14 | 2021-12-10 | 上海绚显科技有限公司 | Error reporting information processing method, device, system, equipment and storage medium |
-
2021
- 2021-12-15 CN CN202111539912.2A patent/CN114358143A/en active Pending
Patent Citations (8)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20150193296A1 (en) * | 2012-07-02 | 2015-07-09 | Tencent Technology (Shenzhen) Company Limited | Run-time error repairing method, device and system |
| US20200073738A1 (en) * | 2018-08-28 | 2020-03-05 | Sap Se | Error incident fingerprinting with unique static identifiers |
| CN111262730A (en) * | 2020-01-10 | 2020-06-09 | 中国银联股份有限公司 | Method and device for processing alarm information |
| WO2021174835A1 (en) * | 2020-03-04 | 2021-09-10 | 平安科技（深圳）有限公司 | Alarm information processing method and apparatus, and computer apparatus and storage medium |
| CN111953541A (en) * | 2020-08-10 | 2020-11-17 | 腾讯科技（深圳）有限公司 | Alarm information processing method and device, computer equipment and storage medium |
| CN112087465A (en) * | 2020-09-17 | 2020-12-15 | 北京微步在线科技有限公司 | Method and device for determining threat event based on aggregated information |
| CN113377820A (en) * | 2021-07-12 | 2021-09-10 | 杭州安恒信息技术股份有限公司 | Aggregation alarm method and device, electronic equipment and storage medium |
| CN113778800A (en) * | 2021-09-14 | 2021-12-10 | 上海绚显科技有限公司 | Error reporting information processing method, device, system, equipment and storage medium |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN111475804A (en) | Alarm prediction method and system | |
| CN109086182B (en) | Automatic database alarming method and terminal equipment | |
| CN109582772B (en) | Contract information extraction method, contract information extraction device, computer equipment and storage medium | |
| US10839308B2 (en) | Categorizing log records at run-time | |
| CN106997431B (en) | Data processing method and device | |
| EP2807802A1 (en) | Systems and methods for spam detection using character histograms | |
| CN110929125A (en) | Search recall method, apparatus, device and storage medium thereof | |
| CN113656807A (en) | Vulnerability management method, device, equipment and storage medium | |
| WO2019153589A1 (en) | Message data processing method and apparatus, and computer device and storage medium | |
| US20210288814A1 (en) | A block chain-based system for multi-party, multistage process verification | |
| CN114693192A (en) | Wind control decision method and device, computer equipment and storage medium | |
| CN111339293A (en) | Data processing method and device of alarm event and classification method of alarm event | |
| CN115208835A (en) | API classification method, device, electronic equipment, medium and product | |
| CN111259207A (en) | Short message identification method, device and equipment | |
| CN114840286B (en) | Service processing method and server based on big data | |
| CN110138583B (en) | Display method for intelligent alarm analysis | |
| CN114358143A (en) | Alarm event classification method, device, equipment and storage medium | |
| CN117827952A (en) | Data association analysis method, device, equipment and medium | |
| CN109491970B (en) | Bad picture detection method and device for cloud storage and storage medium | |
| WO2023039973A1 (en) | Abnormal false alarm processing method and apparatus, and storage medium and terminal | |
| CN109918077A (en) | Code administration method, apparatus, computer equipment and storage medium | |
| CN117220911A (en) | Industrial control safety audit system based on protocol depth analysis | |
| CN112612817B (en) | Data processing method, device, terminal equipment and computer readable storage medium | |
| CN115795466A (en) | Malicious software organization identification method and equipment | |
| CN114003737A (en) | Double-record examination assisting method, device, equipment and medium based on artificial intelligence |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination |