CN115758908A - Alarm online prediction method under alarm flooding condition based on deep learning - Google Patents
Alarm online prediction method under alarm flooding condition based on deep learning Download PDFInfo
- Publication number
- CN115758908A CN115758908A CN202211509467.XA CN202211509467A CN115758908A CN 115758908 A CN115758908 A CN 115758908A CN 202211509467 A CN202211509467 A CN 202211509467A CN 115758908 A CN115758908 A CN 115758908A
- Authority
- CN
- China
- Prior art keywords
- alarm
- flooding
- sequence
- prediction
- prediction model
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Images
Landscapes
- Alarm Systems (AREA)
Abstract
The invention provides an alarm online prediction method under the condition of alarm flooding based on deep learning, which comprises the steps of preprocessing acquired alarm log data, extracting alarm flooding segments according to alarm rate, capturing predicted mapping relation between front and rear alarms through iterative slicing, coding to obtain a data set with a label, training a model to obtain a trained model; in the online prediction stage, a current alarm flooding sequence is firstly identified and acquired, whether a new alarm exists or not is judged, if yes, the alarm flooding sequence is updated to predict immediately, and if not, a plurality of times are waited to predict periodically; during prediction, according to a sliding window selection mechanism, an alarm sequence is input into a trained prediction model to obtain an alarm candidate set and probability distribution, and alarm dynamic prediction is realized through cyclic operation until alarm flooding is finished. The invention has the beneficial effects that: the calculation speed is high, the model building time is short, and the real-time requirements of actual industrial monitoring and diagnosis can be met.
Description
Technical Field
The invention relates to the field of alarm flooding analysis in an industrial process, in particular to an alarm online prediction method under the condition of alarm flooding based on deep learning.
Background
In the modern industrial process, an alarm system reminds an operator to take measures in time to prevent the situation from further worsening by monitoring real-time data and finding out abnormality, and the importance of the alarm system for guaranteeing the safety of industrial operation is self-evident. With the introduction of distributed control systems by modern industry, although alarm settings become very convenient and cheap, existing alarm systems suffer from the common problem of unreasonable and inefficient design, since the setting of alarm points and thresholds requires a high level of knowledge for alarm management, which can lead to a large number of invalid alarms, leading to alarm flooding.
Alarm flooding refers to the situation that a large number of alarms are generated in a short time by an alarm system, so that an operator cannot timely remove faults according to alarm prompts. According to the ISA-18.2 standard, the beginning of the alarm flood is considered when the number of alarm occurrences within 10 minutes exceeds 10 for the first time, the end of the alarm flood is considered when the number of alarm occurrences within 10 minutes is below 5 for the first time, and the time of occurrence of the alarm flood is recommended to be not more than 1% of the total operating time. Alarm flooding seriously restricts the safety of the production process, and if the alarm flooding cannot be processed in time, industrial accidents can be caused, so that casualties and economic losses are caused. Therefore, analytical research for alarm flooding has become a common concern in both academic and industrial circles.
When a segment of alarm flood is occurring, effective decision-making assistance can be provided to the operator if the next possible alarm can be predicted from the currently occurring alarm sequence. However, since there are few studies on the alarm flooding in the industrial process, there are problems such as the following: 1) The existing research of alarm prediction is mostly based on an alarm flooding sequence comparison method, namely, historical alarm data and the occurring alarm flooding are subjected to similarity comparison, and the alarm sequences with high similarity scores are predicted, but the method for pairwise comparison of the sequences is difficult to ensure the real-time performance of alarm prediction because of high time complexity, and on the other hand, because the online alarm flooding sequence is a dynamically updated data stream, the alarm sequence comparison cannot adapt to the real-time change in the calculation process, and has great influence on the accuracy of the prediction result; 2) Due to the complex nature of the industrial process, the propagation diffusion path of the alarm is generally complex and variable, and from the view of actual alarm data, even if the same alarm sequence is started, different subsequent alarms can be caused, so that the result that a group of possible candidates is given for alarm prediction is obviously more appropriate, however, most of the existing researches only give one most possible alarm and predict the next alarm based on the alarm, and when the alarm is wrong, the subsequent alarms can be caused to be wrong, thereby influencing the judgment of operators.
Disclosure of Invention
In order to solve the problems, the invention provides an alarm online prediction method under the condition of alarm flooding based on deep learning, which is characterized in that alarm log data acquired by industrial process simulation software are subjected to data preprocessing to extract fragments in which alarm flooding occurs, and an alarm flooding sequence library is generated; by carrying out iterative slicing on the alarm flooding sequence, the predicted mapping relation between the front alarm and the rear alarm is better captured, and the alarm flooding with different sequence lengths is kept in a uniform dimension by utilizing a completion means, so that a data set with a label is obtained; and finally, extracting features by adopting a Long Short Term Memory network (LSTM), and obtaining an alarm prediction model through training.
The method aims at the problem that the high real-time requirement of prediction alarm flooding is caused by the over-high time complexity of a sequence alignment algorithm. The invention takes a trained neural network as an alarm prediction model, and designs an alarm sequence real-time updating strategy based on a sliding window on the basis, namely that the sliding window automatically captures the section of alarm sequence every time an alarm occurs or no new alarm occurs within a certain time, and real-time prediction is carried out based on the section of alarm sequence. The training of the network structure is completed in the off-line process, the moving calculation speed of the sliding window is high, the model building time is short, and the real-time requirements of real-time monitoring and diagnosis of the actual industry can be met.
The method comprises the following specific steps:
1) Obtaining an alarm flooding sequence library;
generating an alarm event log by triggering a fault, acquiring a historical alarm event log within a certain time period by means of industrial simulation software, preprocessing the historical alarm event log, extracting an alarm flooding fragment sequence, and comparing an alarm rate with an International Institute of Automation (ISA) standard to obtain an alarm flooding sequence;
the alarm event log preprocessing steps are as follows:
a) The data format of the standard alarm event information mainly comprises the following steps: 1. combining the alarm type and the alarm variable and mapping the alarm type and the alarm variable into a real number as an alarm tag; 2. redundant attributes such as alarm description and alarm affiliated units are deleted to carry out dimension stipulations; 3. setting a time step to regard a plurality of alarms with close timestamps as simultaneous occurrence;
b) The redundant alarm in the alarm log is removed by setting technologies such as a delayer, a filter, a dead zone and the like, so that the interference of the redundant alarm on the identification of the real alarm flooding fragment is avoided, and the real alarm flooding fragment is extracted according to the ISA-18.2 standard and the timestamp information of the alarm event.
Finally, the resulting library of industrial alarm sequences can be represented as: f = { F 1 ,F 2 ,…,F n For any one of them alarm flooding sequence F i ,i∈[1,n]Consisting of several successive alarms, i.e. F i ＝[a i 1 ，a i 2 ，…，a i m ，1≤m≤M]. Wherein, a m Indicating the mth alarm in the alarm flood sequence F and M indicating the length of the alarm flood sequence.
2) Slicing and coding an alarm sequence;
by carrying out iterative slicing on an alarm flooding sequence, capturing a predicted mapping relation between front and rear alarms based on a long-short time neural network, coding, keeping alarm flooding with different sequence lengths in a unified dimension, obtaining a data set with a label, dividing the data set with the label into a training set and a test set, establishing an alarm prediction model and training the alarm prediction model to obtain a trained alarm prediction model, wherein the front and rear alarms in the real alarm flooding sequence are respectively used as the input and the output of the alarm prediction model; the specific steps of converting the historical alarm event log into an alarm prediction model training data set and an alarm event data structured code of a test data set are as follows:
for a sequence of alarm floods with M alarms F = [ a = 1 ，a 2 ，…，a M ]Starting from i =2 with a i As an output label of alarm prediction, a slice S consisting of i-1 alarms before the alarm flooding sequence i ＝[a 1 ，a 2 ，…，a (i-1) ]As input for alarm prediction; the slicing process is iterated for M-1 times to obtain the predicted slice S of the alarm flooding sequence F 1 ,S 2 ,…,S (M-1) }。
The above-mentioned treatment is made for every alarm flooding sequence of alarm flooding database F to obtain the correspondent relationship of input and output in the alarm prediction model, and the longest length of alarm sequence in F is set as L max Zero padding is performed on the input slices of the alarm prediction to align all the slice lengths, one-hot coding is adopted on the labels of the alarm output, and the coding length parameter is selected as the number of the class labels of the alarm variable.
Through the operation, training and testing data for the alarm prediction model are obtained, the alarm input is vectors with the same dimensionality, and the label is the vector subjected to unique hot coding.
3) An off-line modeling stage;
1) An embedding layer is added in front of the neural network and serves as a first layer of an alarm prediction model and serves as a word vector processing method, so that the sparse features of the one-hot coding are converted into dense features to be output in a vector mode, and the embedded vector dimension is set.
2) The second layer structure of the alarm prediction model selects a bidirectional long-time and short-time neural network layer, is used for capturing the time sequence relation between the front alarm and the rear alarm in an alarm flooding sequence, and sets a parameter Cell State to determine the length of the processed context; the third layer is a full connection layer, the number of nodes is the number of variables in the alarm sequence library, and the activation function selects softmax;
3) Respectively setting a series of parameters of the training process: a training process loss function; an optimization method; evaluating a standard; selecting a training set and a testing set; number of training rounds, etc.
Through the above, the training model is constructed.
4) An online prediction stage; the alarm rate is calculated in real time based on the online alarm data, alarm flooding occurs when the alarm rate exceeds 10 times/10 min for the first time, alarm event data of the alarm flooding is collected so as to generate an alarm sequence, and the alarm flooding is ended until the alarm rate is lower than 5 times/10 min, wherein the alarm prediction method in the period comprises the following steps:
and filling the alarm sequence F which is currently generated into the dimensionality of a training set vector, inputting an offline trained model to obtain probability distribution vectors of all alarms generated by an activation function softmax, traversing the vectors and outputting c alarm variable indexes with the maximum probability to serve as candidate alarm prediction results. The number set C of the alarm candidate sets needs to satisfy the following constraints: the sum of the alarm probabilities in the candidate set is greater than the confidence coefficient mu.
In order to ensure the real-time performance and accuracy of the alarm, whether a new alarm exists is detected and judged in real time, if yes, an alarm flooding sequence is updated and immediately predicted, and if not, a plurality of times are waited for periodic prediction; during prediction, according to a sliding window selection mechanism, a sliding window with the length of W is required to be set, and the selection mechanism is as follows: if a new alarm appears, directly inputting the updated alarm flooding sequence into the trained alarm prediction model; if no new alarm appears after waiting for a plurality of times, predicting a candidate alarm set A which occurs after the current alarm flooding sequence F, and then setting the alarm A corresponding to the maximum probability of A max Adding into F to obtain new alarm flooding sequence F 2 And circularly executing the process, thereby realizing the dynamic prediction of the alarm. The selection mechanism of the sliding window can effectively avoid causing the later prediction when the prediction error occursThe result is wrong again, the meaning of the window length W is that only W alarms closest to the current moment are considered during alarm, the model slides on a time axis along with the continuous arrival of data items, new data enter the window continuously, and old data items are eliminated and do not participate in analysis. The method for evaluating the accuracy of the prediction model is to calculate the number of alarms of the prediction pair/the number of prediction alarms.
In conclusion, the data processing in the alarm online prediction stage is completed.
The technical scheme provided by the invention has the beneficial effects that: the calculation speed is high, the model building time is short, and the real-time requirements of real-time monitoring and diagnosis of the actual industry can be met.
Drawings
The invention will be further described with reference to the accompanying drawings and examples, in which:
fig. 1 is a flow chart of an alarm online prediction method in the event of alarm flooding based on deep learning in the embodiment of the present invention.
Detailed Description
For a more clear understanding of the technical features, objects, and effects of the present invention, embodiments of the present invention will now be described in detail with reference to the accompanying drawings.
Referring to fig. 1, fig. 1 is a flowchart of an alarm online prediction method under the condition of alarm flooding based on deep learning in the embodiment of the present invention, and the embodiment of the present invention designs a simulation experiment based on a VAM alarm platform model to verify the effectiveness of the method.
Step 1, off-line training
The adopted data is from VAM platform simulation experiments, alarm event logs are generated by triggering faults, a plurality of faults including significant faults MAL15, 16, 17, 23, 24, 25 and the like are set in a simulation mode by configuring 1019 alarm tags in order to generate a certain alarm flooding sequence, and the alarm event logs are finally derived after monitoring for a period of time, wherein the table 1 shows a part of the alarm event logs obtained by utilizing VAM simulation:
TABLE 1
Step 1.1, alarm flooding sequence extraction: when the real-time alarm rate exceeds the alarm flooding threshold value, alarm flooding occurs, an alarm flooding sequence is obtained by collecting alarm event data in the period of time, and the preprocessing of the historical alarm event log is specifically as follows: a) Standardizing the format of the alarm log: modifying or deleting irregular data to ensure that the data formats are unified into important alarm data, and mainly comprising the following steps of 1, combining alarm types and alarm variables and mapping the alarm types and the alarm variables into real numbers to serve as alarm tags; 2. redundant attributes such as alarm description and alarm affiliated units are deleted to carry out dimension stipulations; 3. setting a time step to regard a plurality of alarms with close timestamps as simultaneous occurrence; b) Obtaining a real alarm flooding sequence: a delay timer is shown that is configured for 300 seconds to suppress false alarm floods such as buffeting alarms, greatly reducing nuisance alarms in the historical alarm event log.
Further, according to the specification of ISA-18.2 standard, F = for any alarm flooding sequence<a 1 ，a 2 ，…，a m >Its time stamp sequence is T i ＝＜t 1 ，t 2 ，…，t m M is more than or equal to 1 and less than or equal to M, and the following time constraint conditions are met:
ζ(t 1 ,t 1 +10)>10
ζ(t m ,t m +10)<5
ζ (a, b) refers to the number of alarms occurring in the time interval from the time t = a to the time t = a, and through the above timestamp detection of the alarms in the historical alarm library, 130 alarm flooding sequence libraries consisting of real alarm flooding sequences can be obtained, that is, F = { F = 1 ,F 2 ,…,F 130 }。
Step 1.2, slicing and coding of an alarm sequence: because the alarm event sequence is text information, cannot be directly processed and cannot quantitatively represent the causal relationship of alarm during prediction, the invention constructs a prediction mapping relationship before and after alarm event data based on a simple statistical thought, namely, the before and after alarm in the alarm flooding sequence are respectively used as the input and the output of alarm prediction.
For a sequence of alarm floods with M alarms F = [ a ] 1 ，a 2 ，…，a M ]Starting with i =2, with a i As output label of alarm prediction, slice S composed of i-1 alarms before alarm flooding sequence i ＝[a 1 ，a 2 ，…，a (i-1) ]As input for alarm prediction; the slicing process is iterated for M-1 times to obtain the predicted slice S of the alarm flooding sequence F 1 ,S 2 ,…,S (M-1) And (6) processing each alarm flooding sequence of the alarm flooding database F to obtain a hash structure H of the corresponding relation between input and output in the alarm prediction model and a key S of the hash structure H i For predicted input vectors, value a i For a predicted signature (i.e., the next most likely alarm) it can be expressed as:
H F ＝{(S i :a i )|S i ＝[a 1 ，a 2 ，…，a (i-1) ],a i ∈F,i∈[1,M-1]}
in order to enable the alarm flooding sequence to be processed, all the dimensions of the alarm flooding sequence need to be kept consistent, and the longest length of the alarm sequence in F is set as L max Zero padding is carried out on input slices of alarm prediction to align all the slice lengths, single-hot coding is adopted for labels of alarm output, and coding length parameters are selected as the label number of the types of alarm variables and are expressed in the form of sparse vectors.
Taking a certain alarm flooding sequence [426,429,483, \8230;, 483,916] as an example, it contains 38 alarms, so that processing the alarm flooding results in a hash structure containing 37 prediction input sequences and corresponding prediction labels, denoted as:
{[0,0,0,…,0,426]:(1019,[428],1),
[0,0,…,426,429]:(1019,[482],1),
…
[0,…,392,404,483]:(1019,[915],1)}
a hash structure is a data structure that consists of a pair of key-value pairs, where such a hash structure
[0, \ 8230;, 0,426]: 1019, [428], 1)
[0, \8230;, 0,426] is a bond,
(1019, [428], 1) are values, one for one;
the key of the hash structure is an input vector which is complemented to have the same dimension, the value is a sparse vector representation method (a, [ b ], c) after the label is subjected to one-hot coding, and the meanings of three parameters are as follows: the vector dimension is a, the value of the vector at b +1 is c, and the remaining values are 0. After the slicer encoding process, a slicing and encoding result of an alarm flooding sequence as shown in table 2 was obtained:
TABLE 2
Step 1.3, offline modeling: firstly, converting the sparse features of the one-hot coding into dense features by a word embedding method, and outputting the dense features in a vector form, wherein the embedded vector dimension is set to be 100. Then, considering that the long-time and short-time neural network has obvious advantages in the aspect of time sequence feature extraction and is suitable for a long alarm flooding sequence, a bidirectional long-time and short-time neural network layer is selected and used for extracting time sequence features between front and back alarms in the alarm flooding sequence, the parameter Cell State is set to be 10, and the length of the processed context is determined; since alarm prediction can be regarded as a multi-classification problem, softmax is selected as the activation function;
softmax assigns a probability value to the predicted outcome for each alarm tag, indicating the probability of the next alarm, where z i The dimension of the vector Z is the number of output nodes, i.e. the number of classified classes, for the output value of the ith node. By means of Softmax function, multiple classes can be classifiedThe output value is converted to a range of [0,1 ]]And a probability distribution of 1.
Appointing a loss function of the training process as a classification cross entropy; selecting an Adam optimizer by the optimization method; evaluating the accuracy of the standard selection prediction; randomly selecting a training set and a test set, taking 100 pieces as the training set of the alarm prediction model, and taking the rest 30 pieces as the test set of the prediction model; and finally setting the number of training rounds as 100.
Step 2, an online diagnosis stage:
in the online diagnosis, the input alarm flooding sequence is predicted, and the specific steps mainly comprise the following steps:
a. calculating the alarm rate in real time based on the online alarm data, wherein alarm flooding occurs when the alarm rate exceeds 10 times/10 min for the first time, acquiring alarm event data of the alarm flooding so as to generate an alarm sequence, and ending the alarm flooding until the alarm rate is lower than 5 times/10 min;
b. and (2) filling 0 in front of the vector to ensure that the alarm flooding sequence F currently occurring is consistent with the dimension of the vector of the training set, inputting the trained alarm prediction model to obtain a probability distribution vector of each alarm occurrence derived by an activation function softmax, traversing the vector and outputting C alarm variables with the maximum probability as candidate alarm prediction results to obtain an alarm candidate set, wherein if the number set C of the alarm candidate set is = {0.66,0.2,0.1}, the set comprises three elements, and C =3. The number set C of the alarm candidate sets needs to satisfy the following constraints: the sum of the alarm probabilities in the candidate set is greater than the confidence mu.
Wherein
Represents the activation function softmax to alarm a i As a result of the action, i.e. a i Probability of occurrence, m is the probability of occurrence of each alarm in the candidate alarm set a,
representing a decreasing sequence, i.e.
Are always provided with
Wherein j and k both satisfy j, k belongs to [1, n ]]；
c. In order to ensure the real-time performance and accuracy of the alarm, whether a new alarm exists is detected and judged in real time, if yes, an alarm flooding sequence is updated and immediately predicted, and if not, a plurality of times are waited for periodic prediction; during prediction, according to a sliding window selection mechanism, a sliding window with the length of W is required to be set, and the selection mechanism is as follows: if a new alarm appears, the updated alarm is directly input into the alarm prediction model in an overflowing manner; if no new alarm appears after waiting for a certain time, predicting an alarm candidate set A which occurs after the alarm is predicted through a trained alarm prediction model according to a current alarm flooding sequence F, wherein the alarm candidate set A comprises all alarms which possibly occur next, the probability of each alarm forms a set C, and then, the alarm A corresponding to the maximum probability in the alarm A forms a set C max Adding the obtained sequence into F to obtain a new alarm sequence F 2 Alarm A max That is, the alarm variable with the highest probability, for example, a candidate set a = {564,256,536} and a number set C = {0.66,0.2,0.1}, then the set includes three elements, m1=0.66, m2=0.2, m3=0.1, and then a is the set of the maximum probability corresponding alarm variables, for example, m1=0.66, m2=0.2, and m3=0.1 max =564, dynamic prediction of alarm is achieved by looping through the process described above. The selection mechanism of the sliding window can avoid that a later prediction result is wrong and wrong when the prediction error occurs, the meaning of the window length W is that only W alarms closest to the current moment are considered during the alarm, the model slides on a time axis along with the continuous arrival of data items, new data continuously enter the window, and old data items are eliminated and do not participate in the analysis. Finally, partial results for the online prediction of the industrial alarm are obtained as shown in the table 3;
TABLE 3
Since alarm prediction is essentially a multi-classification problem, a Micro-average Micro-F may be used 1 And Macro-average Macro-F 1 And judging the effect of the prediction model. It should be noted that the number of each category is considered by the Micro-average Micro-F1, and the influence of the categories with larger numbers on the Micro-average Micro-F1 is larger; and the Macro-average Macro-F1 averages Precision and Recall of each class, so that the classes with higher Precision and Recall average Macro-F 1 The effect of (c) will be large. Micro-average Micro-F 1 The calculation method is as follows:
micro-average Micro-F 1 Is calculated by the formula
Wherein the Recall rate Recall mi And Precision mi Are respectively calculated by the following formulas
Macro-average Macro-F 1 Is calculated by the formula
Calculating TP i The ith alarm tag is correctly predicted and is of a positive type; FP i The wrong prediction of the ith alarm tag is positive; TN (twisted nematic) i The ith alarm tag is correctly predicted and is in a negative class; FN (FN) i The prediction of the ith alarm tag is wrong, and the prediction is negative.
The above table shows that the alarm online prediction model established by the proposed method has higher performance. Therefore, the proposed prediction method based on deep learning and sliding window can be considered to be effective in alarm online prediction in the event of alarm flooding.
The beneficial effects of the invention are: the calculation speed is high, the model building time is short, and the real-time requirements of real-time monitoring and diagnosis of the actual industry can be met.
The above description is only for the purpose of illustrating the preferred embodiments of the present invention and should not be taken as limiting the scope of the present invention, which is intended to cover any modifications, equivalents, improvements, etc. within the spirit and scope of the present invention.
Claims (5)
1. An alarm online prediction method under the condition of alarm flooding based on deep learning is characterized in that: the method comprises the following steps:
an off-line training part:
generating an alarm event log by triggering a fault, acquiring alarm log data, preprocessing the alarm log data, comparing an alarm rate with an ISA standard to obtain an alarm flooding sequence, iteratively slicing the alarm flooding sequence, capturing a predicted mapping relation between front and rear alarms based on a long-time and short-time neural network, coding, keeping the alarm flooding with different sequence lengths in a uniform dimension, obtaining a data set with a label, dividing the data set with the label into a training set and a testing set, establishing an alarm prediction model, training the alarm prediction model to obtain the trained alarm prediction model, and respectively inputting and outputting the front and rear alarms in the real alarm flooding sequence;
and an online alarm prediction part:
when the real-time alarm rate exceeds the alarm flooding threshold value, alarm flooding occurs, an alarm flooding sequence is obtained by collecting alarm event data in the period of time, whether a new alarm exists is detected in real time, if yes, the alarm flooding sequence is updated and predicted immediately, and if not, a plurality of times are waited for periodic prediction; during prediction, according to a sliding window selection mechanism, an alarm flooding sequence is input to a trained alarm prediction model to obtain an alarm candidate set and probability distribution, an alarm corresponding to the maximum probability is added to an updated alarm sequence, and the alarm is dynamically predicted by circulating operation until the real-time alarm rate is lower than an alarm flooding threshold value.
2. A method for alarm on-line prediction in the event of alarm flooding based on deep learning according to claim 1, characterized in that: the process of preprocessing the alarm data is as follows:
a) Standardizing the data format of the alarm event information;
b) Redundant alarms in the alarm log are removed by setting a delayer, a filter and a dead zone so as to avoid the interference on the identification of the real alarm flooding fragment, and the real alarm flooding fragment is extracted according to the ISA-18.2 standard and the timestamp information of the alarm event.
3. A method for on-line prediction of alarms in the event of alarm flooding based on deep learning according to claim 2, characterized in that: the process of normalizing the data format of the alarm event information is as follows:
(1) Combining the alarm type and the alarm variable and mapping the alarm type and the alarm variable into a real number as an alarm tag;
(2) Redundant attributes such as alarm description and alarm belonging units are deleted to carry out dimension stipulation;
(3) Setting the time step considers several alarms with close timestamps to occur simultaneously.
4. A method for alarm on-line prediction in the event of alarm flooding based on deep learning according to claim 1, characterized in that: the slicing and encoding process of the alarm sequence is as follows:
the method comprises the following steps of building a structured code of an alarm prediction model, converting an alarm event log into an alarm event data structured code of an alarm prediction model training data set and a test data set, and specifically comprises the following steps:
for a sequence of alarm floods with M alarms F = [ a = 1 ，a 2 ，…，a M ]Starting from i =2 with a i Slice S composed of i-1 alarms before alarm flooding sequence as output label of alarm prediction i ＝[a 1 ，a 2 ，…，a (i-1) ]As input to an alarm prediction model; iterating the slicing process for M-1 times to obtain the predicted slice of the alarm flooding sequence F into S 1 ,S 2 ,…,S (M-1) }；
The above-mentioned treatment is made for every alarm flooding sequence of alarm flooding database F to obtain the correspondent relationship of input and output in the alarm prediction model, and the longest length of alarm sequence in F is set as L max Zero padding is carried out on the input slices of the alarm prediction model to align the lengths of all the slices, one-hot coding is adopted for labels output by the alarm, and the coding length parameter is selected as the number of the type labels of the alarm variable;
through the operation, a training set and a testing set for training the alarm prediction model are obtained.
5. A method for alarm on-line prediction in the event of alarm flooding based on deep learning according to claim 1, characterized in that: after filling the acquired alarm flooding sequence F which currently occurs to the dimensionality of a training set vector, inputting an alarm prediction model which is trained offline to obtain probability distribution vectors of each alarm occurrence derived by an activation function softmax, traversing the vectors and outputting C alarm variable indexes with the maximum probability to serve as candidate alarm prediction results, wherein the number set C of the alarm candidate sets needs to meet the following constraints: the alarm probability sum in the candidate set is greater than the confidence coefficient mu, namely:
wherein
Indicating the activation function softmax to the ith alarm a i As a result of the action, i.e. a i The probability of occurrence, m is the probability of occurrence of each alarm in the candidate alarm set a,
representing a decreasing sequence, i.e.
Always have
Wherein j and k satisfy j, k is equal to [1, n ]]。
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202211509467.XA CN115758908A (en) | 2022-11-29 | 2022-11-29 | Alarm online prediction method under alarm flooding condition based on deep learning |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202211509467.XA CN115758908A (en) | 2022-11-29 | 2022-11-29 | Alarm online prediction method under alarm flooding condition based on deep learning |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN115758908A true CN115758908A (en) | 2023-03-07 |
Family
ID=85340015
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202211509467.XA Pending CN115758908A (en) | 2022-11-29 | 2022-11-29 | Alarm online prediction method under alarm flooding condition based on deep learning |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN115758908A (en) |
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN116701610A (en) * | 2023-08-03 | 2023-09-05 | 成都大成均图科技有限公司 | Effective alarm condition identification method and device based on emergency multisource alarm |
| CN117118811A (en) * | 2023-10-25 | 2023-11-24 | 南京邮电大学 | Alarm analysis method for industrial alarm flooding |
-
2022
- 2022-11-29 CN CN202211509467.XA patent/CN115758908A/en active Pending
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN116701610A (en) * | 2023-08-03 | 2023-09-05 | 成都大成均图科技有限公司 | Effective alarm condition identification method and device based on emergency multisource alarm |
| CN117118811A (en) * | 2023-10-25 | 2023-11-24 | 南京邮电大学 | Alarm analysis method for industrial alarm flooding |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN111914873B (en) | Two-stage cloud server unsupervised anomaly prediction method | |
| CN108038049B (en) | Real-time log control system and control method, cloud computing system and server | |
| CN108197845B (en) | Transaction index abnormity monitoring method based on deep learning model LSTM | |
| CN109492193B (en) | Abnormal network data generation and prediction method based on deep machine learning model | |
| CN115758908A (en) | Alarm online prediction method under alarm flooding condition based on deep learning | |
| CN104091070B (en) | Rail transit fault diagnosis method and system based on time series analysis | |
| CN111858526B (en) | Failure time space prediction method and system based on information system log | |
| CN113378990B (en) | Flow data anomaly detection method based on deep learning | |
| CN113568774B (en) | Multi-dimensional time sequence data real-time abnormality detection method using unsupervised deep neural network | |
| CN109145114B (en) | Social network event detection method based on Kleinberg online state machine | |
| CN114254716B (en) | High-risk operation identification method and system based on user behavior analysis | |
| CN111275136B (en) | Fault prediction system based on small sample and early warning method thereof | |
| CN115858794B (en) | Abnormal log data identification method for network operation safety monitoring | |
| CN117131110B (en) | Method and system for monitoring dielectric loss of capacitive equipment based on correlation analysis | |
| Alinezhad et al. | Early classification of industrial alarm floods based on semisupervised learning | |
| CN115204536A (en) | Building equipment fault prediction method, device, equipment and storage medium | |
| CN112132321A (en) | Method for predicting and analyzing forest fire based on machine learning | |
| CN112488142A (en) | Radar fault prediction method and device and storage medium | |
| CN116668083A (en) | Network traffic anomaly detection method and system | |
| CN112905671A (en) | Time series exception handling method and device, electronic equipment and storage medium | |
| CN113722140B (en) | Industrial alarm flooding source diagnosis method based on small sample learning and storage medium | |
| CN113780432B (en) | Intelligent detection method for operation and maintenance abnormity of network information system based on reinforcement learning | |
| CN114610613A (en) | Online real-time micro-service call chain abnormity detection method | |
| CN115858606A (en) | Method, device and equipment for detecting abnormity of time series data and storage medium | |
| CN115964470B (en) | Method and system for predicting service life of motorcycle accessories |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination |