WO2024119806A1 - 策略编排方法、报文处理方法、装置、设备及*** - Google Patents

策略编排方法、报文处理方法、装置、设备及*** Download PDF

Info

Publication number
WO2024119806A1
WO2024119806A1 PCT/CN2023/105086 CN2023105086W WO2024119806A1 WO 2024119806 A1 WO2024119806 A1 WO 2024119806A1 CN 2023105086 W CN2023105086 W CN 2023105086W WO 2024119806 A1 WO2024119806 A1 WO 2024119806A1
Authority
WO
WIPO (PCT)
Prior art keywords
event
target
processing
policy
component
Prior art date
Application number
PCT/CN2023/105086
Other languages
English (en)
French (fr)
Inventor
邵益兰
冯以浩
李帅
曹秋丹
曹云飞
Original Assignee
杭州海康威视***技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 杭州海康威视***技术有限公司 filed Critical 杭州海康威视***技术有限公司
Publication of WO2024119806A1 publication Critical patent/WO2024119806A1/zh

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06V—IMAGE OR VIDEO RECOGNITION OR UNDERSTANDING
    • G06V10/00—Arrangements for image or video recognition or understanding
    • G06V10/94—Hardware or software architectures specially adapted for image or video understanding
    • G06V10/945—User interactive design; Environments; Toolboxes
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F8/00—Arrangements for software engineering
    • G06F8/30—Creation or generation of source code
    • G06F8/34—Graphical or visual programming
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06V—IMAGE OR VIDEO RECOGNITION OR UNDERSTANDING
    • G06V10/00—Arrangements for image or video recognition or understanding
    • G06V10/70—Arrangements for image or video recognition or understanding using pattern recognition or machine learning
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06V—IMAGE OR VIDEO RECOGNITION OR UNDERSTANDING
    • G06V20/00—Scenes; Scene-specific elements
    • G06V20/40—Scenes; Scene-specific elements in video content
    • G06V20/44—Event detection
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06V—IMAGE OR VIDEO RECOGNITION OR UNDERSTANDING
    • G06V20/00—Scenes; Scene-specific elements
    • G06V20/50—Context or environment of the image
    • G06V20/52—Surveillance or monitoring of activities, e.g. for recognising suspicious objects
    • G—PHYSICS
    • G08—SIGNALLING
    • G08B—SIGNALLING OR CALLING SYSTEMS; ORDER TELEGRAPHS; ALARM SYSTEMS
    • G08B29/00—Checking or monitoring of signalling or alarm systems; Prevention or correction of operating errors, e.g. preventing unauthorised operation
    • G08B29/18—Prevention or correction of operating errors
    • G—PHYSICS
    • G08—SIGNALLING
    • G08B—SIGNALLING OR CALLING SYSTEMS; ORDER TELEGRAPHS; ALARM SYSTEMS
    • G08B29/00—Checking or monitoring of signalling or alarm systems; Prevention or correction of operating errors, e.g. preventing unauthorised operation
    • G08B29/18—Prevention or correction of operating errors
    • G08B29/185—Signal analysis techniques for reducing or preventing false alarms or for enhancing the reliability of the system
    • G—PHYSICS
    • G08—SIGNALLING
    • G08B—SIGNALLING OR CALLING SYSTEMS; ORDER TELEGRAPHS; ALARM SYSTEMS
    • G08B29/00—Checking or monitoring of signalling or alarm systems; Prevention or correction of operating errors, e.g. preventing unauthorised operation
    • G08B29/18—Prevention or correction of operating errors
    • G08B29/185—Signal analysis techniques for reducing or preventing false alarms or for enhancing the reliability of the system
    • G08B29/188—Data fusion; cooperative systems, e.g. voting among different detectors
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
    • H04L69/22—Parsing or analysis of headers
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
    • H04N7/00—Television systems
    • H04N7/18—Closed-circuit television [CCTV] systems, i.e. systems in which the video signal is not broadcast
    • H04N7/181—Closed-circuit television [CCTV] systems, i.e. systems in which the video signal is not broadcast for receiving images from a plurality of remote sources

Definitions

  • the present application relates to the field of AI intelligent algorithm technology, and in particular to a policy orchestration method, message processing method, device, equipment and system.
  • AI products With the continuous development of artificial intelligence (AI) technology, AI products have gradually become an important part of various industry systems. AI products use deep learning algorithms to intelligently analyze the monitoring data of monitoring points deployed in the city. They can detect whether there are abnormal events in the monitoring area and automatically provide alarm data.
  • AI products use deep learning algorithms to intelligently analyze the monitoring data of monitoring points deployed in the city. They can detect whether there are abnormal events in the monitoring area and automatically provide alarm data.
  • the present application provides a policy orchestration method, a message processing method, an apparatus, a device and a system.
  • a policy orchestration method including:
  • the target component pointed to by the component adding instruction is added to the strategy visual arrangement interface; wherein the target component includes a processing component; the processing component includes one or more of a function component, an algorithm component and an execution component; wherein the function component is used to perform logical operation processing on the data to be processed; the algorithm component is used to perform algorithm processing on the data to be processed using a preset algorithm; and the execution component is used to control the designated device to perform a corresponding action;
  • a policy of the target event is generated and saved according to the processing elements, the connection relationship between the processing elements, and the parameters of the processing elements.
  • a message processing method including:
  • the operation order of the processing elements is determined, and the processing elements are operated according to the operation order, and the processing elements to be operated process the event message to be processed using corresponding parameters.
  • a policy orchestration device including:
  • a first determining unit is configured to determine a target event that needs to be orchestrated by a policy
  • the arrangement unit is configured to add the target element pointed to by the element adding instruction to the strategy visualization arrangement interface according to the detected element adding instruction; wherein the target element includes a processing element; the processing element includes one or more of a function element, an algorithm element and an execution element; wherein the function element is used to The data to be processed is subjected to logical operation processing; the algorithm element is used to perform algorithm processing on the data to be processed using a preset algorithm; the execution element is used to control the designated device to perform corresponding actions;
  • a second determining unit is configured to determine the connection relationship between the processing elements according to the detected connection operation instructions for the processing elements in the policy visualization orchestration interface; and determine the parameters of the processing elements according to the detected parameter editing instructions for the processing elements in the policy visualization orchestration interface;
  • the generating unit is configured to generate and save the policy of the target event according to the processing element, the connection relationship between the processing elements, and the parameters of the processing elements when a policy saving instruction is detected.
  • a policy orchestration device including a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other via the communication bus;
  • a memory for storing a strategy visualization arrangement software program
  • the processor is used to execute the policy visualization orchestration software program stored in the memory to implement the policy orchestration method provided in the first aspect.
  • a message processing device including:
  • An acquisition unit is configured to acquire a target element included in the target strategy when an operation instruction for the target strategy is detected; wherein the target strategy is generated according to the method provided in the first aspect;
  • the processing unit is configured to determine the operation order of each processing element according to the connection relationship between the processing elements in the target element, and operate the processing elements according to the operation order, and the operating processing elements use corresponding parameters to process the event message to be processed.
  • a message processing device including a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus;
  • a memory for storing a software program for running the programmed strategy
  • the processor is used to execute the software program stored in the memory and running the arranged strategy to implement the message processing method provided in the second aspect.
  • a message processing system comprising the policy orchestration device provided by the fourth aspect and the message processing device provided by the sixth aspect.
  • the policy orchestration method of the embodiment of the present application determines the target event that needs to be policy orchestrated, and adds the target element pointed to by the element adding instruction to the policy visualization orchestration interface based on the detected element adding instruction, determines the connection relationship between the processing elements based on the detected connection operation instruction for the processing elements included in the target element in the policy visualization orchestration interface; and determines the parameters of the processing elements based on the detected parameter editing instruction for the processing elements in the policy visualization orchestration interface. Then, when the policy saving instruction is detected, the policy of the target event is generated and saved based on the processing elements, the connection relationship between the processing elements, and the parameters of the processing elements, thereby realizing policy visualization orchestration for specific events and improving the targeted nature of policy orchestration. In addition, the visual policy orchestration method improves the intuitiveness of the policy orchestration process.
  • FIG1 is a flow chart of a strategy arrangement method provided in an embodiment of the present application.
  • FIG2 is a flow chart of a message processing method provided in an embodiment of the present application.
  • FIG3A is a schematic diagram of strategy effectiveness statistics provided by an embodiment of the present application.
  • FIG3B is a schematic diagram of a strategy output event ratio provided in an embodiment of the present application.
  • FIG4 is a schematic diagram of a strategy arrangement and execution process provided by an embodiment of the present application.
  • FIG5 is a schematic diagram of a visualized strategy arrangement provided by an embodiment of the present application.
  • FIG6 is a schematic diagram of the structure of a policy orchestration device provided in an embodiment of the present application.
  • FIG. 7 is a schematic diagram of the hardware structure of a policy orchestration device provided in an embodiment of the present application.
  • FIG8 is a schematic diagram of the structure of a message processing device provided in an embodiment of the present application.
  • FIG. 9 is a schematic diagram of the hardware structure of a message processing device provided in an embodiment of the present application.
  • FIG. 10 is a schematic diagram of the structure of a message processing system provided in an embodiment of the present application.
  • serial numbers of the steps in the embodiments of the present application do not mean the order of execution.
  • the execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.
  • AI products can use deep learning algorithms to intelligently analyze the monitoring data of monitoring points deployed in the city. They can find out whether there are abnormal events in the monitoring area, and report alarm data to the background system in the case of abnormal events.
  • the alarm data can be sent in the form of messages. Due to the diversity and complexity of alarm events (i.e., the above-mentioned abnormal events), there may be cases of false reporting or repeated reporting. Therefore, it is necessary to filter the alarm events according to certain strategies. Based on this, an embodiment of the present application provides a policy orchestration method.
  • the policy orchestration method shown in this embodiment can be executed by an electronic device such as a terminal device or a server.
  • the terminal device can be a fixed terminal or a mobile terminal, such as a mobile phone, a tablet computer, a desktop computer, an all-in-one computer, etc.
  • the server includes a local server or a cloud server, etc., which is not limited in this embodiment.
  • FIG1 is a flow chart of a policy arrangement method provided in an embodiment of the present application.
  • the policy arrangement method may include the following steps:
  • Step S100 Determine a target event that needs to be policy orchestrated.
  • a policy arrangement method for a specific event may be provided to obtain a policy for filtering the specific event.
  • the user may determine an event that needs to be policy-programmed (referred to as a target event herein) according to actual needs, and trigger policy programming for the target event by inputting a policy programming instruction for the target event.
  • a target event an event that needs to be policy-programmed
  • the target event may include one type of event, or multiple types of events.
  • an event selection interface may be provided in the policy visualization orchestration interface.
  • an event list may be displayed in a designated area in the policy visualization orchestration interface. Users may select the target event from the event list as needed and enter the policy orchestration instructions (such as clicking on the target event and selecting policy orchestration in the pop-up function menu) to trigger the policy orchestration for the target event.
  • a policy orchestration function button may be provided in the policy visualization orchestration interface, and the user may trigger the display of the policy orchestration window by clicking the function button, and enter the identification information of the target event in the window, such as the event code of the target event, and trigger the policy orchestration for the target event by clicking the OK function button in the policy orchestration window.
  • a policy orchestration step description may be displayed in the policy visualization orchestration interface so that the user can understand the policy orchestration steps.
  • Step S110 based on the detected component adding instruction, add the target component pointed to by the component adding instruction to the strategy visualization orchestration interface; wherein the target component includes a processing component; the processing component includes one or more of a function component, an algorithm component and an execution component; wherein the function component is used to perform logical operations on the processed data; the algorithm component is used to perform algorithmic processing on the processed data using a preset algorithm; the execution component is used to control the specified device to perform a corresponding action.
  • the target element required for filtering the target event can be added to the policy visualization orchestration interface.
  • the user may select one or more target components in the display page, and add the selected target components to the policy visualization orchestration interface by dragging and dropping.
  • the target component pointed to by the component adding instruction (such as the above selected target component) can be added to the strategy visual arrangement interface.
  • the policy visualization orchestration interface supports centering operations (i.e., displaying the target elements added to the policy visualization orchestration interface in the middle area of the interface), zooming in and out (proportionally zooming in or out on the interface and the target elements displayed in the interface), undo operations (such as undoing the last operation on the target element, such as adding an operation), and clearing operations (deleting all added target elements), etc.
  • the target element may include but is not limited to a processing element.
  • the processing element may include one or more of a function element, an algorithm element, and an execution element.
  • Function elements can be used to perform logical operations on the data to be processed, that is, by running the function elements, logical operations can be performed on the data to be processed, for example, logical determination processing, function operation processing, etc.; wherein, the data to be processed, such as the message reported by the monitoring point after the abnormal event is identified, can also be called the event message to be processed.
  • the function element can include but is not limited to a filter element, a diversion element or a single-point deduplication element (e.g., deduplication of messages reported by the same monitoring point with an interval less than a preset time threshold), etc.
  • the event message to be processed can be output to different elements according to the input data and the determination rules in the diversion element.
  • Forklift recognition can be performed on the image data collected by the monitoring front end of the forklift working scene.
  • a forklift recognition event can be triggered (the event may carry the address information of the captured image of the forklift recognition event); the input data of the shunt element may include the address information of the captured image of the forklift recognition event, the position and size of the forklift detection frame in the image; when the shunt element is running, it can be determined based on the size of the forklift detection frame whether the size is greater than a preset size threshold.
  • the captured image can be output to the human body detection element so that human body detection can be performed based on the original captured image by running the human body detection element. Otherwise, the captured image is output to the enlarged capture component, and the captured image of the forklift identification event is enlarged by running the enlarged capture component, so as to more accurately detect whether there are people around the forklift later.
  • the algorithm component can be used to perform algorithmic processing on the data to be processed using a preset algorithm, that is, the algorithm component can be run to perform algorithmic processing on the data to be processed using a preset algorithm.
  • the algorithm component can include but is not limited to a similarity comparison component or a secondary image analysis component, such as an image quality scoring component (used to perform quality scoring on the acquired image using a preset image quality scoring algorithm), etc.
  • the actuator is used to control the designated device to perform a corresponding action, that is, the designated device can be controlled to perform a corresponding action by running the actuator.
  • the actuator may include but is not limited to a preset point rotation control element (used to control the designated monitoring front end to rotate to a designated preset point), a capture element or an enlarged capture element, etc.
  • Step S120 determining the connection relationship between the processing elements according to the detected connection operation instructions for the processing elements in the policy visualization orchestration interface; and determining the parameters of the processing elements according to the detected parameter editing instructions for the processing elements in the policy visualization orchestration interface.
  • the user after adding the required target elements to the policy visualization orchestration interface, the user can orchestrate the target elements in the policy visualization orchestration interface, which may include but is not limited to associating processing elements and editing parameters of processing elements.
  • the connection relationship between the processing elements can be determined according to the detected connection operation instructions for the processing elements in the policy visualization orchestration interface.
  • the parameters of the processing element may be determined according to the detected parameter editing instruction for the processing element in the policy visual orchestration interface.
  • its parameters may include parameters for processing input data.
  • its parameters may include a filtering time period or a spatial range;
  • an algorithm element for performing human body detection on an acquired image its parameters may include a confidence threshold, etc.
  • the processing element may be obtained by importing a program package, encapsulating the processing element, and defining parameters such as input and output of the processing element.
  • the processing element may also be obtained by importing a component package.
  • Step S130 When a policy saving instruction is detected, a policy for a target event is generated and saved according to processing elements, connection relationships between processing elements, and parameters of processing elements.
  • the user can save the arranged strategy.
  • a user can trigger a policy save instruction by clicking a save function button in the policy visual orchestration interface.
  • the policy of the target event can be generated and saved according to the processing elements added to the policy visualization orchestration interface, the connection relationship between the processing elements, and the parameters of the processing elements.
  • the target component pointed to by the component adding instruction is added to the policy visualization orchestration interface, and according to the detected connection operation instruction for the processing element included in the target element in the policy visualization orchestration interface, the connection relationship between the processing elements is determined; and, according to the detected parameter editing instruction for the processing element in the policy visualization orchestration interface, the parameters of the processing element are determined, and then, when the policy saving instruction is detected, according to the processing element, the connection relationship between the processing elements, and the parameters of the processing elements, a policy visualization orchestration interface is generated and saved.
  • the strategy for the target event realizes the visual arrangement of strategies for specific events, which improves the pertinence of strategy arrangement.
  • the visual strategy arrangement method improves the intuitiveness of the strategy arrangement process.
  • the target element may also include an event input element.
  • the policy arrangement method may also include: creating an event input element for the target event when a policy arrangement instruction for the target event is detected; or creating an initial event input element when an event input element creation instruction is detected; determining the event input element for the target event based on the detected event identification configuration instruction for the initial event input element.
  • the strategy orchestration for the target event may be triggered by creating an event input element for the target event.
  • the target event may be determined first, for example, by selecting the target event in an event list, or by inputting an event identifier of the target event in a designated input area. Then, in response to detecting a policy orchestration instruction for the target event, an event input element for the target event is created, thereby triggering policy orchestration for the target event.
  • the event code may be a string used to uniquely identify a type of event.
  • an event input component may be created first, and then an event identifier of a target event may be configured in the event input component to implement creation of the event input component of the target event.
  • an initial event input element can be created, and when an event identifier configuration instruction for the initial event input element is detected, the event identifier of the target event is obtained according to the event identifier configuration instruction.
  • the event identifier of the target event is configured in the initial event input element to obtain the event input element of the target event.
  • buttons corresponding to various instructions may be pre-set in the policy visualization orchestration interface, and instructions may be detected by detecting clicks on the virtual buttons.
  • instructions may be detected by analyzing command lines input by the user.
  • the event input component is provided with event source information, which is used to obtain the event message to be processed according to the event source information when the event input component is run. Based on this, creating the event input component of the target event may also include obtaining the event source information of the target event.
  • event source type information may also be provided in the event input component to indicate the source type of the event message to be processed obtained by the event input component, for example, central-end analysis (events triggered by analysis of a central-end device, such as a central platform) or edge-end analysis (events triggered by analysis of an edge-end device, such as a capture machine).
  • central-end analysis events triggered by analysis of a central-end device, such as a central platform
  • edge-end analysis events triggered by analysis of an edge-end device, such as a capture machine.
  • the central-end analysis usually analyzes the data of multiple monitoring points to determine whether a specified event exists; and the edge-end analysis usually involves a single monitoring point analyzing the data of the monitoring point to determine whether a specified event exists, therefore, when using the same algorithm for analysis, the accuracy of the central-end analysis will usually be lower than the accuracy of the edge-end analysis. Therefore, when performing event reporting accuracy statistics, the event source type information in the event input element can be distinguished, and statistics can be performed on the central-end analysis and the edge-end analysis separately.
  • the event source information may include an event input address
  • the event message to be processed may be obtained according to the event input address
  • connection relationship between the event input element and the processing element can also be determined based on the detected connection operation instruction for the event input element.
  • the target element may further include an event output element, in which an output address is set for outputting data according to the output address when the event output element is running.
  • the component adding instruction after adding the target component pointed to by the component adding instruction to the strategy visualization arrangement interface, may also include: determining the connection relationship between the event output component and the processing component according to the detected connection operation instruction for the event output component.
  • an event output element may be set, and an output address may be set in the event output element so that when the event output element is run, the output data obtained by executing the strategy may be output to a specified address.
  • connection relationship between the event output element and the processing element can also be determined based on the detected connection operation instruction for the event output element.
  • the connection relationship between the target elements can be headed by the event input element and ended by the event output element, and the connection order between the processing elements can be set as needed.
  • the strategy arrangement and execution process can be seen in Figure 4.
  • the component library stores components for strategy arrangement (which can be called strategy components).
  • the strategy components can include event input components, event output components, and processing components; the processing components can include but are not limited to function components, algorithm components, and execution components.
  • the function element may include but is not limited to a single-point deduplication element, a multi-point deduplication element, a function operation element, etc.
  • the algorithm element may include but is not limited to a similarity comparison element and an error library comparison element, etc.
  • the execution element may include but is not limited to a preset point rotation control element and a capture element, etc.
  • the target component in the component library pointed to by the component adding instruction can be added to the strategy visualization orchestration interface (which can be called a canvas in this example) according to the detected component adding instruction, and the connection relationship between the target components can be determined according to the detected connection operation instructions for each target component in the canvas; and the parameters of the target component can be determined according to the detected parameter editing instructions for the target component in the canvas.
  • the strategy visualization orchestration interface which can be called a canvas in this example
  • the target element may include an event input element, an event output element, and at least one processing element.
  • a corresponding strategy may be generated according to the target element, the connection relationship between the target elements, and the parameters of the target elements, and saved in the strategy library.
  • the policies stored in the policy library may include, but are not limited to, traffic incident pedestrian intrusion application policies, traffic incident congestion application policies, bank reception detection policies, workplace mobile phone use detection policies, etc.
  • the corresponding target element can be obtained from the element library based on the target element involved in the policy, and the operating order of each target element can be determined based on the connection relationship between the target elements included in the policy, and each target element can be operated according to the operating order, and the operated target element uses the corresponding parameters to process the event message to be processed.
  • the policy orchestration method provided in the embodiment of the present application can perform visual policy orchestration around event messages, and can not only provide general processing elements, such as single-point periodic deduplication elements, single-point time period deduplication elements, diversion elements, conditional filtering elements, conditional deletion elements, single-point aggregation elements, target frame filtering elements, similarity comparison elements, image secondary analysis elements, and timing calculation elements, etc.; it can also provide processing elements for use in specific scenarios, such as indoor human body detection elements, etc., which can meet the usage requirements of various scenarios and improve the applicability of the policy orchestration solution.
  • general processing elements such as single-point periodic deduplication elements, single-point time period deduplication elements, diversion elements, conditional filtering elements, conditional deletion elements, single-point aggregation elements, target frame filtering elements, similarity comparison elements, image secondary analysis elements, and timing calculation elements, etc.
  • the event input component has an event data model conversion function, which is used to parse the acquired event message and add descriptive information to each specified field in the event message.
  • the descriptive information is used to facilitate the processing component to determine the meaning of the corresponding field.
  • the processing element may not be able to recognize the meaning of the fields in the messages with different formats, which may cause the processing of the processing element to be abnormal.
  • the alarm message of the event is referred to as the event message or the event message to be processed.
  • the event input component can have an event data model conversion function.
  • the event input component can parse it and add description information for each specified field in the event message (for example, a field whose field value will be used in the subsequent processing flow, a pre-specified field, etc.), and the description information is used to explain the meaning of each specified field, so that the processing component can determine the meaning of the specified field based on the description information of the specified field.
  • the event message to be processed when the event input component is running, can be parsed to determine the meaning of each specified field in the event message to be processed and generate corresponding description information.
  • the correspondence between the field path (used to identify the position of the field in the event message to be processed) and the corresponding description information can be determined, and the correspondence can be transmitted to the processing component so that the processing component can obtain the description information corresponding to the field path based on the correspondence, and determine the meaning of the specified field in the event message to be processed based on the description information.
  • the above-mentioned determination of the parameters of the processing element based on the detected parameter editing instructions for the processing element in the policy visualization orchestration interface may include: when an operation instruction to paste the event message of the target event into a designated area of the event message parsing interface is detected, parsing the event message of the target event to determine the field information included in the event message of the target event; determining the parameters of the processing element based on the detected parameter editing instructions for the target field in the event message of the target event.
  • an event message parsing interface may be pre-set.
  • relevant personnel may enter the event message parsing interface and input a parsing instruction for the event message of the target event or perform a preset parsing operation, such as pasting the event message of the target event into a designated area of the event message parsing interface.
  • the event message of the target event is parsed to determine the field information included in the event message of the target event.
  • the field information obtained by parsing may include but is not limited to: field identifier, field type, field name, and parsed value.
  • the field information included in the event message of the target event can be displayed. Based on the displayed field information, relevant personnel can select the field that needs to be edited for the processing element (referred to as the target field in this article) and enter the parameter editing instructions for the target field.
  • the parameters of the processing element may be determined according to the detected parameter editing instruction for the target field in the event message of the target event.
  • the strategy visualization layout interface includes a component list, which includes Various strategy elements can be selected, which may include but are not limited to event input elements, event output elements, and processing elements.
  • the target components can include: event input components (forklift identification input components in the figure), event output components (forklift identification output components in the figure), and processing components.
  • the processing elements may include function elements (such as filtering elements and shunt elements in the figure), algorithm elements (such as human body detection elements and secondary analysis elements in the figure) and execution elements (such as zoom-in and capture elements in the figure).
  • function elements such as filtering elements and shunt elements in the figure
  • algorithm elements such as human body detection elements and secondary analysis elements in the figure
  • execution elements such as zoom-in and capture elements in the figure.
  • the visual editing interface supports operation instructions such as “center”, “zoom ratio”, “undo”, “redo”, and “clear”, and in response to detecting the "zoom ratio” operation instruction, it can support adjusting the interface display ratio.
  • connection relationship and parameters between the target components can be determined according to the requirements.
  • operation order of the target components can be determined according to the connection relationship between the target components.
  • the forklift identification element can be connected to a filtering element to filter forklift identification events with a forklift target frame that is too small (such as the target frame area is less than the first area threshold), and forklift identification events with a forklift target frame greater than or equal to the first area threshold can enter the diversion element for processing.
  • the shunt element can be used to determine whether the area of the forklift target frame corresponding to the forklift recognition event is greater than the second area threshold (the second area threshold is greater than the first area threshold).
  • the flow is transferred to the human body detection element to determine whether there is a human body in the forklift target frame.
  • the forklift recognition events in which there is no human body in the forklift target frame are filtered through the filtering element, and the forklift recognition events in which there is a human body in the forklift target frame are output through the forklift recognition output element.
  • the forklift identification event is filtered out through the filtering element.
  • the forklift identification event for which there is no forklift target frame or the confidence level of the forklift target frame is too low is filtered out through the filtering element.
  • human body detection can be performed to determine whether there is a human body in the forklift target frame, and the forklift recognition events in which there is no human body in the forklift target frame are filtered, and the forklift recognition events in which there is a human body in the forklift target frame are output through the forklift recognition output component.
  • An embodiment of the present application also provides a message processing method, which can be executed by an electronic device such as a terminal device or a server.
  • the terminal device can be a fixed terminal or a mobile terminal, such as a mobile phone, a tablet computer, a desktop computer, an all-in-one computer, etc.
  • the server includes a local server or a cloud server, etc., which is not limited in this embodiment.
  • FIG. 2 is a flow chart of a message processing method provided in an embodiment of the present application. As shown in FIG. 2, the message processing method may include the following steps:
  • Step S200 When an operation instruction for a target strategy is detected, a target element included in the target strategy is obtained.
  • the target strategy may be generated by arranging the method described in the method flow shown in FIG. 1 .
  • the user can execute the strategy generated by the method arrangement described in the method flow shown in FIG. 1 according to actual needs.
  • the target strategy included in the target strategy can be obtained. Label components.
  • components can be generated by importing program packages, encapsulating components, and defining inputs and outputs of computing components to obtain target components included in the target strategy.
  • Corresponding components can also be obtained by importing component packages.
  • the operation scope of the strategy can also be configured, such as the time range and/or spatial range of operation, that is, the time periods and/or event locations in which the strategy needs to be executed can be configured.
  • the strategy when there is a running time range configuration, the strategy can be automatically run within the configured running time range; when there is an running space range, when running the strategy, the strategy can be used to process related events within the running space range.
  • Step S210 Determine the running order of each processing element according to the connection relationship between each processing element in the target element, and run the processing element according to the running order, and the running processing element processes the event message to be processed using corresponding parameters.
  • the operation order of each processing element can be determined based on the connection relationship between each processing element in the target element, and the processing elements can be operated according to the operation order.
  • the processing element when the processing element is running, the processing element can use the corresponding parameters to process the event message to be processed, and the message includes time, location (or point of the monitoring front end), picture (or picture address), picture detection result (such as license plate recognition result), etc.
  • a filter element it can be determined whether the event message to be processed needs to be filtered according to the values of fields such as time and point in the event message to be processed.
  • the corresponding image can be obtained according to the image address carried in the event message to be processed, and the quality of the obtained image can be scored using a preset image quality scoring algorithm to obtain a quality score of the image.
  • the target element also includes an event input element;
  • the above-mentioned operation of the processing element according to the operation order, before the processing element uses the corresponding parameters to process the event message to be processed can also include: running the event input element in the target element, and obtaining the event message to be processed according to the event source information set in the event input element.
  • the event source information may include an event input address.
  • the event input element when the strategy is executed, the event input element may be executed first, and the event message to be processed may be obtained according to the event input address set in the event input element.
  • the source of the event message to be processed may include, but is not limited to, a front-end device, a central device, or a trusted third-party platform.
  • the above-mentioned event input address can be the address of the message queue (such as a Kafka queue) that stores the event message (i.e., alarm message) of the target event.
  • the event messages generated by the target event can all be saved in the message queue.
  • the event message can be obtained from the message queue according to the event input address set in the event input component as the event message to be processed.
  • the event message when obtaining event messages to be processed based on the event input address, it is necessary to parse the event code of each event message in the message queue corresponding to the event input address (in order to facilitate the distinction between event messages of different types of events, the event message may also include an event code, and one message queue may store event messages with multiple different event codes), and pull the event message in the message queue whose event code is consistent with the event code set in the event input element as the event message to be processed.
  • the event input component obtains the event message to be processed, it is necessary to parse the event occurrence time (such as the reporting time of the event message) and/or the point identifier (or scene identifier) of each event message in the message queue corresponding to the event input address to determine whether the event occurrence time corresponding to the event message is within the preset operation time range, and/or whether the event occurrence location is within the preset operation space range. If the event occurrence time corresponding to the event message is not within the preset operation time range, or the event occurrence location is not within the preset operation space range, the event message will not be pulled.
  • the event occurrence time such as the reporting time of the event message
  • the point identifier or scene identifier
  • the event input component pulls the event message from the message queue corresponding to the event input address
  • the event occurrence time and/or point identifier (or scene identifier) of the pulled event message is analyzed to determine whether the event occurrence time corresponding to the event message is within the preset operating time range, and/or whether the event occurrence location is within the preset operating space range. If the event occurrence time corresponding to the event message is not within the preset operating time range, or the event occurrence location is not within the preset operating space range, the event message is filtered and no longer output to the next component.
  • the event input component may not pull, or, after pulling, filter out the event message.
  • the event input component may not pull it, or, after pulling it, filter out the event message.
  • the target element also includes an event output element;
  • the above-mentioned operation of the processing element according to the operation order, after the processing element uses the corresponding parameters to process the event message to be processed, can also include: when the event output element in the target element is run, data is output according to the output address set in the event output element.
  • data output may be performed according to an output address set in the event output component.
  • the output address may be a storage path for output data.
  • the output data may be saved to a designated storage path, for example, to a valid alarm message queue, according to the output address set in the event output element.
  • the parameters of the event output component may further include output format information, so that when the event output component is run, the output data may be saved to a designated storage path according to the set output format information.
  • an event code may also be set in the event output element, and the event code set in the event output element may be different from the event code set in the event input element, that is, the event code in the event message output by the event output element may be different from the event code in the event message pulled by the event input element.
  • the forklift identification scenario in the monitoring front end of the forklift operation scenario, it can be configured to capture a picture when a forklift is detected, and generate a corresponding event message (assuming the event code is event code 1, which is used to identify the event type as the identification of a forklift).
  • event code in the actual forklift identification scenario, an alarm will only be issued when a person is identified around the forklift. Therefore, for the forklift identification event, the event code in its event input component can be event code 1.
  • event code 1 the event code of the output event message is adjusted from event code 1 to event code 2 (used to identify the event type as the presence of personnel around the forklift).
  • any strategy compiled according to the method shown in FIG1 can be verified, for example, whether the strategy includes an event input element, an event output element, and at least one processing element; whether the connection is complete, such as whether there is an element that is not connected to other elements; whether the required parameters of each element are configured, for example, for the event input element, whether the event source information is configured; for the event output element, whether the output address is configured; for the filter element, whether the filter condition is configured, etc.
  • the integrity and executability of the strategy can be verified.
  • the effect of the policy can be verified by using test data (which can be simulated events), for example, to verify whether the policy can achieve the expected effect. After the policy is verified in the above manner and the verification passes, the policy status can be set to verified; otherwise, the policy status can be set to unverified.
  • policies that are in the verified state they can be run directly without re-verification.
  • verified policies when it is determined that the policy parameters need to be adjusted based on the policy's operating effect, the policy after parameter adjustment can be verified based on historical event messages within a preset time. When it is determined that the policy after parameter adjustment meets the conditions, the message is processed based on the policy after parameter adjustment.
  • the parameters used for fishing detection such as the threshold of the overlap between people and fishing rods, the confidence of fishing rods, etc.
  • the parameters of the configured strategy can be adjusted, and the operating effect of the strategy after the parameter adjustment can be verified based on the historical event messages within a certain period of time.
  • the message processing is performed according to the strategy after the parameter adjustment.
  • the above-mentioned operation of the processing elements according to the operation order may include: for any processing element being operated, when it is determined that the event message to be processed does not meet the condition for the processing element to output to the next element, stopping the operation of the processing element and outputting the event message to be processed to the specified address.
  • any processing element when the processing element is running, it can be determined whether the event message to be processed satisfies the condition for the processing element to output to the next element.
  • a filtering element it can be determined whether a specified field in the event message to be processed matches a preset filtering condition. If so, it is determined that the event message to be processed does not meet the condition for the processing element to output to the next element; otherwise, it is determined that the event message to be processed meets the condition for the processing element to output to the next element.
  • the shunt element may be configured with a preset judgment rule, and may jump to a different next element according to the judgment result of running the shunt element.
  • the judgment results "yes” and “no" of the shunt element may correspond to different branches.
  • different processing elements may be connected to different branches of the shunt element according to the processing logic under different judgment results of the shunt element. Then, when running the shunt element, the corresponding next element may be determined according to the judgment result of "yes" or "no".
  • the judgment logic in the diversion element can be whether the size of the forklift detection frame is larger than the preset size threshold. If not, the captured image needs to be enlarged. Accordingly, when configuring the strategy, the judgment result of the diversion element is yes (the size of the forklift detection frame is larger than the preset size threshold), and the corresponding following One element may be a human detection element, which is used to perform human detection based on the original captured image to determine whether there are people around the forklift; otherwise, the corresponding next element may be an enlarged capture element, so that the captured image of the forklift identification event can be enlarged by running the enlarged capture element. In the case of running the diversion element, the next element can be determined based on the determination result.
  • the event message to be processed when it is determined that the event message to be processed does not satisfy the conditions for the processing element to output to the next element, that is, it is determined that the event message to be processed needs to be intercepted, the event message to be processed can be refused to be output to the next element, and the event message to be processed can be output to the specified address.
  • messages that are determined to be intercepted during the operation of any processing element may be uniformly output to a designated address, for example, the intercepted messages may be output to the designated address via a bus.
  • the pending event message output to the specified address may also carry the output reason, that is, the reason why the pending event message was intercepted, so that subsequent relevant personnel can determine the reason why the pending event message was intercepted based on the output reason.
  • the message processing method provided in an embodiment of the present application also includes: persistently storing event messages output when the target policy is running or the output event messages and the output reasons of the event messages; when a search instruction for the persistently stored event messages is detected, searching the persistently stored event messages for event messages and their corresponding output reasons that match the search conditions indicated by the search instruction.
  • the event messages output when running the target strategy may include event messages output when running the event output element, and also include event messages output when running the processing element. For example, when running a certain processing element, it is determined that the event message output to the next element is not satisfied.
  • the reason for the output of the event message can be output, and the output reason may include identification information of the processing element that outputs the event message, and the reason why the processing element outputs the event message, so that relevant personnel can perform policy execution backtracking, such as querying the policy execution link of each event message (such as which elements have processed the event message) and the processing result (such as whether it is a message intercepted by the policy (such as whether the message is a false alarm or duplicate alarm data)).
  • the search conditions may include but are not limited to a time range and/or a spatial range, etc.
  • the storage medium may be switched according to the amount of stored data.
  • the output event message and the output reason of the event message can be stored in the database; when the data volume is greater than or equal to the preset data volume threshold, ES (an index-based distributed storage method) storage method is used for storage.
  • the event message intercepted by the policy can be converted into a valid output after manual verification, such as being output to a valid alarm message queue.
  • the solution provided in the embodiments of the present application also supports strategy effectiveness statistics, for example, counting the total number of strategies and the operating status of each strategy (such as running, not running, abnormal or unverified, etc.); counting the number of original event messages (i.e., the number of originally reported event messages), the number of intercepted event messages (or the number of filtered event messages), and the number of strategy output event messages (i.e., the number of event messages output by the strategy's event output element, also referred to as the number of valid event messages).
  • strategy effectiveness statistics for example, counting the total number of strategies and the operating status of each strategy (such as running, not running, abnormal or unverified, etc.); counting the number of original event messages (i.e., the number of originally reported event messages), the number of intercepted event messages (or the number of filtered event messages), and the number of strategy output event messages (i.e., the number of event messages output by the strategy's event output element, also referred to as the number of valid event messages).
  • the statistical results can be displayed in the form of a list according to the event type.
  • the displayed content may include but is not limited to the number of original event messages, the number of intercepted event messages, the number of policy output event messages, and the proportion of filtered event messages (i.e., the ratio of the number of filtered event messages to the number of original event messages), and its schematic diagram may be shown in FIG3A.
  • data trend prediction can also be performed based on statistical data, for example, the number of reports of this type of event increases or decreases.
  • the number of policy output event messages for each different type of event, as well as the proportion of policy output event messages for each different type of event can also be determined, and displayed in a manner of sorting by quantity or sorting by proportion, and a schematic diagram can be shown in Figure 3B.
  • FIG6 is a schematic diagram of the structure of a policy arrangement device provided in an embodiment of the present application.
  • the policy arrangement device may include:
  • a first determining unit 610 is configured to determine a target event that needs to be orchestrated by a policy
  • the orchestration unit 620 is configured to add the target element pointed to by the element adding instruction to the strategy visualization orchestration interface according to the detected element adding instruction; wherein the target element includes a processing element; the processing element includes one or more of a function element, an algorithm element and an execution element; wherein the function element is used to perform logical operation processing on the data to be processed; the algorithm element is used to perform algorithm processing on the data to be processed using a preset algorithm; and the execution element is used to control the designated device to perform a corresponding action;
  • the second determining unit 630 is configured to determine the connection relationship between the processing elements according to the detected connection operation instruction for the processing elements in the policy visualization orchestration interface; and determine the parameters of the processing elements according to the detected parameter editing instruction for the processing elements in the policy visualization orchestration interface;
  • the generating unit 640 is configured to generate and save the policy of the target event according to the processing elements, the connection relationship between the processing elements, and the parameters of the processing elements when a policy saving instruction is detected.
  • the target element further comprises an event input element
  • the first determination unit 610 is specifically configured to create an event input element for the target event when a policy arrangement instruction for the target event is detected, wherein the event input element is provided with event source information, and is used to obtain the event message of the target event according to the event source information when the event input element is run; or, when an event input element creation instruction is detected, create an initial event input element; determine the event input element of the target event according to the detected event identification configuration instruction for the initial event input element;
  • the arrangement unit 620 is further configured to determine the connection relationship between the event input component and the processing component according to the detected connection operation instruction for the event input component.
  • the target element further includes an event output element; an output address is set in the event output element, and is used to output data according to the output address when the event output element is running;
  • the arrangement unit 620 is further configured to determine the connection relationship between the event output element and the processing element according to the detected connection operation instruction for the event output element.
  • the second determination unit 630 is specifically configured to parse the event message of the target event, determine the field information included in the event message of the target event, and display the field information when an operation instruction to paste the event message of the target event into a designated area of the event message parsing interface is detected; and determine the parameters of the processing element based on the detected parameter editing instruction for the target field in the event message of the target event.
  • the policy orchestration device may include a processor 701, a communication interface 702, a memory 703, and a communication bus 704.
  • the processor 701, the communication interface 702, and the memory 703 communicate with each other through the communication bus 704.
  • the memory 703 stores a policy visualization orchestration software program; the processor 701 can execute the policy orchestration method described above by executing the policy visualization orchestration software program stored in the memory 703.
  • the memory 703 mentioned in this article can be any electronic, magnetic, optical or other physical storage device. To contain or store information, such as executable instructions, data, etc.
  • the memory 703 can be: RAM (Radom Access Memory), volatile memory, non-volatile memory, flash memory, storage drive (such as hard disk drive), solid state drive, any type of storage disk (such as CD, DVD, etc.), or similar storage medium, or a combination thereof.
  • the embodiment of the present application also provides a computer-readable storage medium storing a policy visualization orchestration software program, such as the memory 703 in FIG. 7 .
  • the software program can be executed by the processor 701 in the policy orchestration device shown in FIG. 7 to implement the policy orchestration method described above.
  • FIG8 is a schematic diagram of the structure of a message processing device provided in an embodiment of the present application.
  • the message processing device may include:
  • the acquisition unit 810 is configured to acquire the target element included in the target policy when an operation instruction for the target policy is detected; wherein the target policy is generated by the policy arrangement method described in the above embodiment;
  • the processing unit 820 is configured to determine the operation order of each processing element according to the connection relationship between the processing elements in the target element, and operate the processing elements according to the operation order, and the operated processing elements process the event message to be processed using corresponding parameters.
  • the processing unit 820 is specifically configured to stop the operation of any processing element being run and output the event message to be processed to a specified address if it is determined that the event message to be processed does not meet the condition for the processing element to output it to the next element.
  • the message processing device may include a processor 901, a communication interface 902, a memory 903 and a communication bus 904.
  • the processor 901, the communication interface 902 and the memory 903 communicate with each other through the communication bus 904.
  • the memory 903 stores a software program for running the arranged strategy; the processor 901 can execute the message processing method described above by executing the software program for running the arranged strategy stored in the memory 903.
  • the memory 903 mentioned in this article can be any electronic, magnetic, optical or other physical storage device that can contain or store information, such as executable instructions, data, etc.
  • the memory 903 can be: RAM (Radom Access Memory), volatile memory, non-volatile memory, flash memory, storage drive (such as hard disk drive), solid state drive, any type of storage disk (such as CD, DVD, etc.), or similar storage medium, or a combination thereof.
  • the policy orchestration device can perform policy orchestration according to the policy orchestration method described in the above embodiment;
  • the message processing device can perform message processing according to the message processing method described in the above embodiment.

Landscapes

  • Engineering & Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Theoretical Computer Science (AREA)
  • Multimedia (AREA)
  • Software Systems (AREA)
  • Computer Security & Cryptography (AREA)
  • General Engineering & Computer Science (AREA)
  • Signal Processing (AREA)
  • Computer Vision & Pattern Recognition (AREA)
  • Artificial Intelligence (AREA)
  • Computing Systems (AREA)
  • Databases & Information Systems (AREA)
  • Evolutionary Computation (AREA)
  • General Health & Medical Sciences (AREA)
  • Medical Informatics (AREA)
  • Health & Medical Sciences (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • User Interface Of Digital Computer (AREA)
  • Stored Programmes (AREA)

Abstract

本申请提供一种策略编排方法、报文处理方法、装置、设备及***，策略编排方法包括：确定需要进行策略编排的目标事件(S100)；依据检测到的元件添加指令，将元件添加指令指向的目标元件添加至策略可视化编排界面；依据检测到的针对策略可视化编排界面中的处理元件的连接操作指令，确定处理元件之间的连接关系；以及，依据检测到的针对策略可视化编排界面中的处理元件的参数编辑指令，确定处理元件的参数(S120)；在检测到策略保存指令的情况下，依据处理元件、处理元件之间的连接关系，以及，处理元件的参数，生成并保存目标事件的策略(S130)。本方法可以提高策略编排的针对性以及策略编排过程的直观性。

Description

策略编排方法、报文处理方法、装置、设备及***
相关公开的交叉引用
本公开要求于2022年12月8日提交的、申请号为202211574967.1的中国专利公开的优先权，该中国专利公开的全部内容以引用的方式并入本文中。
技术领域
本申请涉及AI智能算法技术领域，尤其涉及一种策略编排方法、报文处理方法、装置、设备及***。
背景技术
随着人工智能(Artificial Intelligence，简称AI)技术的不断发展，AI产品逐渐成为各个行业***的重要组成，AI产品通过使用深度学习算法对城市中部署的监控点位的监控数据进行智能分析，可以发现监控区域中是否存在异常事件，并自动提供告警数据。
由于事件的多样性和复杂性，针对智能识别的事件的报文中可能会存在误报或重复上报的情况，需要进行过滤处理。
发明内容
有鉴于此，本申请提供一种策略编排方法、报文处理方法、装置、设备及***。
根据本申请实施例的第一方面，提供一种策略编排方法，包括：
确定需要进行策略编排的目标事件；
依据检测到的元件添加指令，将所述元件添加指令指向的目标元件添加至策略可视化编排界面；其中，所述目标元件包括处理元件；所述处理元件包括函数元件、算法元件以及执行元件中的一种或多种；其中，所述函数元件用于对待处理数据进行逻辑运算处理；所述算法元件用于利用预设算法对待处理数据进行算法处理；所述执行元件用于控制指定设备执行相应动作；
依据检测到的针对所述策略可视化编排界面中的所述处理元件的连接操作指令，确定所述处理元件之间的连接关系；以及，依据检测到的针对所述策略可视化编排界面中的所述处理元件的参数编辑指令，确定所述处理元件的参数；
在检测到策略保存指令的情况下，依据所述处理元件、所述处理元件之间的连接关系，以及，所述处理元件的参数，生成并保存所述目标事件的策略。
根据本申请实施例的第二方面，提供一种报文处理方法，包括：
在检测到针对目标策略的运行指令的情况下，获取所述目标策略包括的目标元件；其中，所述目标策略按照第一方面提供的方法编排生成；
依据所述目标元件中各处理元件之间的连接关系，确定各处理元件的运行顺序，并依据所述运行顺序进行处理元件的运行，由所运行的处理元件利用对应的参数对待处理事件报文进行处理。
根据本申请实施例的第三方面，提供一种策略编排装置，包括：
第一确定单元，被配置为确定需要进行策略编排的目标事件；
编排单元，被配置为依据检测到的元件添加指令，将所述元件添加指令指向的目标元件添加至策略可视化编排界面；其中，所述目标元件包括处理元件；所述处理元件包括函数元件、算法元件以及执行元件中的一种或多种；其中，所述函数元件用于对 待处理数据进行逻辑运算处理；所述算法元件用于利用预设算法对待处理数据进行算法处理；所述执行元件用于控制指定设备执行相应动作；
第二确定单元，被配置为依据检测到的针对所述策略可视化编排界面中的所述处理元件的连接操作指令，确定所述处理元件之间的连接关系；以及，依据检测到的针对所述策略可视化编排界面中的所述处理元件的参数编辑指令，确定所述处理元件的参数；
生成单元，被配置为在检测到策略保存指令的情况下，依据所述处理元件、所述处理元件之间的连接关系，以及，所述处理元件的参数，生成并保存所述目标事件的策略。
根据本申请实施例的第四方面，提供一种策略编排设备，包括处理器、通信接口、存储器和通信总线，其中，处理器，通信接口，存储器通过通信总线完成相互间的通信；
存储器，用于存放策略可视化编排软件程序；
处理器，用于执行存储器上所存放的策略可视化编排软件程序，实现第一方面提供的策略编排方法。
根据本申请实施例的第五方面，提供一种报文处理装置，包括：
获取单元，被配置为在检测到针对目标策略的运行指令的情况下，获取所述目标策略包括的目标元件；其中，所述目标策略按照第一方面提供的方法编排生成；
处理单元，被配置为依据所述目标元件中各处理元件之间的连接关系，确定各处理元件的运行顺序，并依据所述运行顺序进行处理元件的运行，由所运行的处理元件利用对应的参数对所述待处理事件报文进行处理。
根据本申请实施例的第六方面，提供一种报文处理设备，包括处理器、通信接口、存储器和通信总线，其中，处理器，通信接口，存储器通过通信总线完成相互间的通信；
存储器，用于存放运行编排后的策略的软件程序；
处理器，用于执行存储器上所存放的运行编排后的策略的软件程序，实现第二方面提供的报文处理方法。
根据本申请实施例的第七方面，提供一种报文处理***，包括第四方面提供的策略编排设备以及第六方面提供的报文处理设备。
本申请实施例的策略编排方法，通过确定需要进行策略编排的目标事件，并依据检测到的元件添加指令，将元件添加指令指向的目标元件添加至策略可视化编排界面，依据检测到针对策略可视化编排界面中的目标元件中包括的处理元件的连接操作指令，确定处理元件之间的连接关系；以及，依据检测到的针对策略可视化编排界面中的处理元件的参数编辑指令，确定处理元件的参数，进而，在检测到策略保存指令的情况下，依据处理元件、处理元件之间的连接关系，以及，处理元件的参数，生成并保存目标事件的策略，实现了针对具体事件的策略可视化编排，提高了策略编排的针对性，此外，通过可视化的策略编排方式，提高了策略编排过程的直观性。
附图说明
图1是本申请实施例提供的一种策略编排方法的流程示意图；
图2是本申请实施例提供的一种报文处理方法的流程示意图；
图3A是本申请实施例提供的一种策略成效统计示意图；
图3B是本申请实施例提供的一种策略输出事件占比示意图；
图4是本申请实施例提供的一种策略编排与执行流程示意图；
图5是本申请实施例提供的一种可视化策略编排的示意图；
图6是本申请实施例提供的一种策略编排装置的结构示意图；
图7是本申请实施例提供的一种策略编排设备的硬件结构示意图；
图8是本申请实施例提供的一种报文处理装置的结构示意图；
图9是本申请实施例提供的一种报文处理设备的硬件结构示意图；
图10是本申请实施例提供的一种报文处理***的结构示意图。
具体实施方式
这里将详细地对示例性实施例进行说明，其示例表示在附图中。下面的描述涉及附图时，除非另有表示，不同附图中的相同数字表示相同或相似的要素。以下示例性实施例中所描述的实施方式并不代表与本申请相一致的所有实施方式。相反，它们仅是与如所附权利要求书中所详述的、本申请的一些方面相一致的装置和方法的例子。
在本申请使用的术语是仅仅出于描述特定实施例的目的，而非旨在限制本申请。在本申请和所附权利要求书中所使用的单数形式的“一种”、“所述”和“该”也旨在包括多数形式，除非上下文清楚地表示其他含义。
为了使本领域技术人员更好地理解本申请实施例提供的技术方案，并使本申请实施例的上述目的、特征和优点能够更加明显易懂，下面结合附图对本申请实施例中技术方案作进一步详细的说明。
需要说明的是，本申请实施例中各步骤的序号大小并不意味着执行顺序的先后，各过程的执行顺序应以其功能和内在逻辑确定，而不应对本申请实施例的实施过程构成任何限定。
AI产品可以通过使用深度学习算法对城市中部署的监控点位的监控数据进行智能分析，可以发现监控区域中是否存在异常事件，并在存在异常事件的情况下向后台***上报告警数据，告警数据可以以报文的形式发送。由于告警事件(即上述异常事件)的多样性和复杂性，可能存在误上报或重复上报的情况，因此，需要按照一定的策略对告警事件进行过滤。基于此，本申请实施例提供了一种策略编排方法。
本实施例所示的策略编排方法可以由终端设备或服务器等电子设备执行，终端设备可以是固定终端或移动终端，例如手机、平板电脑、台式机、一体机等等，服务器包括本地服务器或云端服务器等，在本实施例中并不做限制。
请参见图1，为本申请实施例提供的一种策略编排方法的流程示意图，如图1所示，该策略编排方法可以包括以下步骤：
步骤S100、确定需要进行策略编排的目标事件。
本申请实施例中，考虑到对不同类型的告警事件进行过滤所适用的过滤条件会存在差异，若直接针对所有告警事件进行统一的过滤设置，则过滤效果会比较差，无法精确筛选出不同类型的精准告警事件，告警数据的噪音仍然很大。
基于此，在本申请实施例中，为了优化告警事件过滤效果，可以提供针对具体事件的策略编排方法，以得到用于对该具体事件进行过滤处理的策略。
示例性的，用户可以根据实际需求确定需要进行策略编排的事件(本文中称为目标事件)，并通过输入针对目标事件的策略编排指令的方式，触发针对目标事件的策略编排。
示例性的，目标事件可以包括一个类型的事件，或，多个类型的事件。
关于针对目标事件的策略编排指令，举例来说，策略可视化编排界面中可以提供事件选择界面，如策略可视化编排界面中可以在指定区域中展示事件列表，用户可以根据需求从事件列表中选择目标事件并输入策略编排指令(如点击目标事件，在弹出的功能菜单中选择策略编排)，以触发针对目标事件的策略编排。
关于针对目标事件的策略编排指令，又举例来说，策略可视化编排界面中可以提供策略编排功能按钮，用户可以通过点击该功能按钮，触发策略编排窗口的展示，并在该窗口中输入目标事件的标识信息，例如，目标事件的事件码，并通过点击策略编排窗口中的确定功能按钮，触发针对目标事件的策略编排。
示例性的，可以响应于检测到的提示说明指令，在策略可视化编排界面中显示策略编排步骤说明，以便用户了解策略编排的步骤。
步骤S110、依据检测到的元件添加指令，将元件添加指令指向的目标元件添加至策略可视化编排界面；其中，目标元件包括处理元件；处理元件包括函数元件、算法元件以及执行元件中的一种或多种；其中，函数元件用于对待处理数据进行逻辑运算处理；算法元件用于利用预设算法对待处理数据进行算法处理；执行元件用于控制指定设备执行相应动作。
本申请实施例中，在按照上述方式确定了需要进行策略编排的目标事件的情况下，可以将对目标事件进行过滤所需的目标元件添加到策略可视化编排界面中。
例如，用户可以选中显示页面中的一个或多个目标元件，并通过拖拽的操作方式，将所选中的目标元件添加到策略可视化编排界面中。
相应地，可以依据检测到的元件添加指令，如上述拖拽操作触发的指令，将该元件添加指令指向的目标元件(如上述选中的目标元件)添加至策略可视化编排界面。
示例性的，策略可视化编排界面支持居中操作(即：使添加至策略可视化编排界面的目标元件展示在界面中间区域)、放大缩小(对界面及界面中展示的目标元件按比例放大或缩小)、撤销操作(如撤销上一次针对目标元件的操作，如添加操作)以及清空操作(删除添加的全部目标元件)等。
示例性的，目标元件可以包括但不限于处理元件。示例性的，处理元件可以包括函数元件、算法元件以及执行元件中的一种或多种。
函数元件可以用于对待处理数据进行逻辑运算处理，即可以通过运行函数元件，对待处理数据进行逻辑运算处理，例如，进行逻辑判定处理、函数运算处理等；其中，待处理数据例如监控点位在识别到异常事件后上报的报文，也可以称为待处理事件报文。示例性的，函数元件可以包括但不限于过滤元件、分流元件或单点去重元件(如，对同一监控点位上报的间隔小于预设时间阈值的报文进行去重)等。
示例性的，运行分流元件的情况下，可以依据输入数据以及分流元件中的判定规则，将待处理事件报文输出至不同的元件。
举例来说，以铲车识别场景为例，在安全生产环境下，铲车在工作的过程中，铲车周围不能有人员。对于铲车工作场景的监控前端采集到的图像数据，可以进行铲车识别，在识别到铲车的情况下，可以触发铲车识别事件(该事件可以携带有包含铲车识别事件的抓拍图像的地址信息)；分流元件的输入数据可以包括铲车识别事件的抓拍图像的地址信息、铲车检出框在图像中的位置和尺寸；运行分流元件的情况下，可以依据铲车检出框的尺寸，判定该尺寸是否大于预设尺寸阈值，若是，则可以将抓拍图像输出至人体检测元件，以便通过运行人体检测元件，依据原始抓拍图像进行人体检 测，以确定铲车周围是否存在人员；否则，将抓拍图像输出至放大抓图元件，并通过运行放大抓图元件，对铲车识别事件的抓拍图像进行放大，以便后续更准确地检测出铲车周围是否存在人员。
算法元件可以用于利用预设算法对待处理数据进行算法处理，即可以通过运行算法元件，利用预设算法对待处理数据进行算法处理。示例性的，算法元件可以包括但不限于相似度比较元件或图片二次分析元件，例如图像质量评分元件(用于利用预设图像质量评分算法对获取到的图像进行质量评分)等。
所述执行元件用于控制指定设备执行相应动作，即可以通过运行执行元件，控制指定设备执行相应动作。示例性的，执行元件可以包括但不限于预置点转动控制元件(用于控制指定监控前端转动至指定预置点)、抓图元件或放大抓图元件等。
步骤S120、依据检测到的针对策略可视化编排界面中的处理元件的连接操作指令，确定处理元件之间的连接关系；以及，依据检测到的针对策略可视化编排界面中的处理元件的参数编辑指令，确定处理元件的参数。
本申请实施例中，将所需目标元件添加至策略可视化编排界面中之后，用户可以在该策略可视化编排界面中对目标元件进行编排，其可以包括但不限于对处理元件进行关联，以及，对处理元件进行参数编辑等。
相应地，在将所述元件添加指令指向的目标元件添加至策略可视化编排界面之后，一方面，可以依据检测到的针对策略可视化编排界面中的处理元件的连接操作指令，确定处理元件之间的连接关系。
另一方面，可以依据检测到的针对策略可视化编排界面中的处理元件的参数编辑指令，确定处理元件的参数。
示例性的，对于处理元件，其参数可以包括用于对输入数据进行处理的参数。例如，对于用于对特定时间或空间生成的数据进行过滤的过滤元件，其参数可以包括过滤时间段或空间范围；对于用于对获取到的图像进行人体检测的算法元件，其参数可以包括置信度阈值等。
示例性的，可以通过导入程序包获取处理元件，并进行处理元件的封装以及定义处理元件的输入和输出等参数，也可通过导入元件包的方式获取处理元件。
步骤S130、在检测到策略保存指令的情况下，依据处理元件、处理元件之间的连接关系，以及，处理元件的参数，生成并保存目标事件的策略。
本申请实施例中，在按照上述方式添加了所需处理元件，并对处理元件之间的连接关系以及处理元件的参数进行了编排的情况下，用户可以对所编排的策略进行保存。
例如，用户可以通过点击策略可视化编排界面中的保存功能按钮，触发策略保存指令。
相应地，在检测到策略保存指令的情况下，可以依据上述添加至策略可视化编排界面中的处理元件、处理元件之间的连接关系，以及，处理元件的参数，生成并保存目标事件的策略。
可见，在图1所示方法流程中，通过确定需要进行策略编排的目标事件，并依据检测到的元件添加指令，将元件添加指令指向的目标元件添加至策略可视化编排界面，依据检测到针对策略可视化编排界面中的目标元件中包括的处理元件的连接操作指令，确定处理元件之间的连接关系；以及，依据检测到的针对策略可视化编排界面中的处理元件的参数编辑指令，确定处理元件的参数，进而，在检测到策略保存指令的情况下，依据处理元件、处理元件之间的连接关系，以及，处理元件的参数，生成并保存 目标事件的策略，实现了针对具体事件的策略可视化编排，提高了策略编排的针对性，此外，通过可视化的策略编排方式，提高了策略编排过程的直观性。
在一些实施例中，上述目标元件还可以包括事件输入元件。上述策略编排方法还可以包括：在检测到针对目标事件的策略编排指令的情况下，创建针对目标事件的事件输入元件；或，在检测到事件输入元件创建指令的情况下，创建初始事件输入元件；依据检测到的针对初始事件输入元件的事件标识配置指令，确定目标事件的事件输入元件。
示例性的，可以通过创建针对目标事件的事件输入元件的方式，触发针对目标事件的策略编排。
在一个示例中，可以先确定目标事件，例如，在事件列表中选择目标事件，或，在指定输入区域输入目标事件的事件标识，然后，响应于检测到针对目标事件的策略编排指令，创建目标事件的事件输入元件，从而触发针对目标事件的策略编排。
示例性的，以事件标识为事件码为例，事件码可以为一个字符串，用于唯一标识一类事件。
在另一个示例中，可以先创建事件输入元件，然后在事件输入元件中配置目标事件的事件标识，实现目标事件的事件输入元件的创建。
示例性的，可以在检测到事件输入元件创建指令的情况下，创建初始事件输入元件，并在检测到针对初始事件输入元件的事件标识配置指令的情况下，依据事件标识配置指令获取目标事件的事件标识。在初始事件输入元件中配置目标事件的事件标识，得到目标事件的事件输入元件。
本申请实施例中，检测到指令的方式可以是多种多样的，在一种可行的实现方式中，策略可视化编排界面中可以预先设置有与各指令相对应的虚拟按钮，可以通过检测对虚拟按钮的点击检测指令；在另一种可行的实现方式中，可以通过对用户输入的命令行进行分析检测指令。
示例性的，事件输入元件中设置有事件源信息，用于运行事件输入元件时依据事件源信息获取待处理事件报文。基于此，创建目标事件的事件输入元件还可以包括获取目标事件的事件源信息。
示例性的，事件输入元件中还可以设置有事件源类型信息，用于指示事件输入元件获取的待处理事件报文的来源类型，例如，中心端分析(由中心端设备，如中心平台，分析触发的事件)或边缘端分析(由边缘端设备，如抓拍机，分析触发的事件)。
示例性的，考虑到中心端分析通常是对多个监控点位的数据进行分析，以确定是否存在指定事件；边缘端分析通常是单个监控点位对本监控点位的数据进行分析，以确定是否存在指定事件，因而，在使用相同算法进行分析的情况下，中心端分析的准确率通常会低于边缘端分析的准确率，因而，在进行事件上报准确率统计时，可以区分事件输入元件中的事件源类型信息，分别对中心端分析和边缘端分析进行统计。
示例性的，事件源信息可以包括事件输入地址，可以根据事件输入地址获取待处理事件报文。
相应地，在按照上述方式将目标元件添加至策略可视化编排界面之后，除了可以按照上述方式确定各处理元件之间的连接关系之外，还可以依据检测到的针对事件输入元件的连接操作指令，确定事件输入元件与处理元件之间的连接关系。
在一些实施例中，上述目标元件还可以包括事件输出元件，事件输出元件中设置有输出地址，用于运行事件输出元件时依据输出地址进行数据输出。上述依据检测到的 元件添加指令，将元件添加指令指向的目标元件添加至策略可视化编排界面之后，还可以包括：依据检测到的针对事件输出元件的连接操作指令，确定事件输出元件与处理元件之间的连接关系。
示例性的，在针对目标事件进行策略编排时，除了可以按照上述方式进行处理元件的编排之外，还可以设置事件输出元件，该事件输出元件中可以设置有输出地址，以便运行事件输出元件时，可以将执行策略得到的输出数据输出至指定地址。
相应地，在按照上述方式将目标元件添加至策略可视化编排界面之后，除了可以按照上述方式确定各处理元件之间的连接关系之外，还可以依据检测到的针对事件输出元件的连接操作指令，确定事件输出元件与处理元件之间的连接关系。
示例性的，在目标元件包括事件输入元件和事件输出元件的情况下，目标元件之间的连接关系，可以以事件输入元件为首，以事件输出元件为尾，各处理元件之间的连接顺序可以按需设定。
举例来说，策略编排与执行流程可以参见图4。如图4所示，元件库中存储有用于策略编排的元件(可以称为策略元件)。其中，策略元件可以包括事件输入元件、事件输出元件，以及处理元件；处理元件可以包括但不限于函数元件、算法元件以及执行元件。
示例性的，函数元件可以包括但不限于单点去重元件、多点去重元件、函数运算元件等。算法元件可以包括但不限于相似度比较元件以及错误库比较元件等。执行元件可以包括但不限于预置点转动控制元件以及抓图元件等。
在进行策略编排的过程中，可以依据检测到的元件添加指令，将元件添加指令指向的元件库中的目标元件添加至策略可视化编排界面(在该示例中可以称为画布)，并依据检测到的针对画布中的各目标元件的连接操作指令，确定目标元件之间的连接关系；以及，依据检测到的针对画布中的目标元件的参数编辑指令，确定目标元件的参数。
示例性的，目标元件可以包括事件输入元件、事件输出元件，以及至少一个处理元件。
在检测到策略保存指令的情况下，可以依据目标元件、目标元件之间的连接关系，以及目标元件的参数，生成对应的策略，并保存至策略库中。
示例性的，策略库中保存的策略可以包括但不限于交通事件行人闯入应用策略、交通事件拥堵应用策略、银行招迎检测策略、岗位玩手机检测策略等。
在策略执行过程中，对于策略库中的任一策略，在确定需要执行该策略的情况下，可以依据该策略涉及的目标元件，从元件库中获取对应的目标元件，并依据该策略中包括的目标元件之间的连接关系，确定各目标元件的运行顺序，并依据运行顺序进行各目标元件的运行，由所运行的目标元件利用对应的参数对待处理事件报文进行处理。
可见，本申请实施例提供的策略编排方法可以围绕事件报文进行可视化的策略编排，不仅可以提供通用的处理元件，如单点周期性去重元件、单点时间段去重元件、分流元件、条件过滤元件、条件删除元件、单点聚合元件、目标框过滤元件、相似度比较元件、图片二次分析元件以及时序计算元件等；还可以提供针对特定场景使用的处理元件，如室内人体检测元件等，可以满足各种不同的场景使用需求，提高了策略编排方案的适用性。
在策略编排过程中，可以根据实际使用场景，对需要进行策略编排的事件，选择所需的目标元件加入到策略可视化编排界面，并设置目标元件之间的连接关系以及参 数，完成针对一个事件的策略编排，实现了针对具体事件的策略可视化编排，提高了策略编排的针对性，并提高了策略编排过程的直观性。
在一些实施例中，事件输入元件具有事件数据模型转换功能，事件数据模型转换功能用于对获取到的事件报文进行解析，并为事件报文中各指定字段增加描述信息，描述信息用于便于处理元件确定对应字段的含义。
示例性的，考虑到实际应用中，不同事件的告警报文的格式上可能会存在差异，处理元件可能无法识别具有不同格式的报文中字段的含义，进而，可能会导致处理元件的处理异常。为便于描述，下文中将事件的告警报文简称为事件报文或待处理事件报文。
基于此，在本申请实施例中，事件输入元件可以具有事件数据模型转换功能。对于获取到的事件报文，事件输入元件可以对其进行解析，并为事件报文中各指定字段(例如后续处理流程中会使用到字段值的字段、预先指定的字段等)增加描述信息，该描述信息用于解释各指定字段的含义，以便处理元件可以依据指定字段的描述信息确定指定字段的含义。
示例性的，对于任一待处理事件报文，在运行事件输入元件的情况下，可以对该待处理事件报文进行解析，确定该待处理事件报文中各指定字段的含义并生成对应的描述信息。对于待处理事件报文中的各指定字段，可以确定字段路径(用于标识字段在待处理事件报文中的位置)与对应的描述信息的对应关系，将该对应关系传输至处理元件，以便处理元件可以依据该对应关系获取与字段路径对应的描述信息，并依据描述信息确定待处理事件报文中指定字段的含义。
在一些实施例中，上述依据检测到的针对策略可视化编排界面中的处理元件的参数编辑指令，确定处理元件的参数，可以包括：在检测到将目标事件的事件报文粘贴至事件报文解析界面的指定区域的操作指令的情况下，对目标事件的事件报文进行解析，确定目标事件的事件报文包括的字段信息；依据检测到的针对目标事件的事件报文中的目标字段的参数编辑指令，确定该处理元件的参数。
示例性的，除了策略可视化编排界面，还可以预先设置有事件报文解析界面。在需要对处理元件进行参数编辑的情况下，相关人员可以进入事件报文解析界面，并输入针对目标事件的事件报文的解析指令或执行预设解析操作，预设解析操作例如将目标事件的事件报文粘贴至事件报文解析界面的指定区域。
相应地，在检测到将目标事件的事件报文粘贴至事件报文解析界面的指定区域的操作指令的情况下，对目标事件的事件报文进行解析，确定目标事件的事件报文包括的字段信息。
示例性的，对于任一字段，其解析得到的字段信息可以包括但不限于：字段标识、字段类型、字段名称以及解析值等。
示例性的，可以展示目标事件的事件报文包括的字段信息，基于所展示的字段信息，相关人员可以选择需要为处理元件进行参数编辑的字段(本文中称为目标字段)，并输入针对目标字段的参数编辑指令。
相应地，对于任一处理元件，可以依据检测到的针对所述目标事件的事件报文中的目标字段的参数编辑指令，确定该处理元件的参数。
为了使本领域技术人员更好地理解本申请实施例中的可视化策略编排方案，下面结合实例进行说明。
如图5所示，策略可视化编排界面中包括元件列表，该元件列表中包括供用户选 择的各种策略元件，其可以包括但不限于事件输入元件、事件输出元件，以及处理元件。
在进行策略编排的过程中，可以依据需求选择目标元件加入策略可视化编排界面。以铲车识别场景为例，目标元件可以包括：事件输入元件(图中铲车识别输入元件)、事件输出元件(图中的铲车识别输出元件)，以及处理元件。
处理元件可以包括函数元件(如图中的过滤元件、分流元件)、算法元件(如图中的人体检测元件、二次分析元件)以及执行元件(如图中的放大抓图元件)。
其中，可视化编排界面支持“居中”、“缩放比例”、“撤销”、“重做”、“清空”等操作指令，且响应于检测到“缩放比例”的操作指令，可以支持对界面显示比例进行调整。
对于加入策略可视化编排界面中的目标元件，可以根据需求确定各目标元件之间的连接关系以及参数，在策略运行过程中，可以依据目标元件之间的连接关系确定各目标元件的运行顺序。
以图5所示场景为例，考虑到上报的铲车识别事件中，可能会存在铲车目标框过小，无法确定铲车目标框内是否存在人体(不包括铲车驾驶室内的人)的问题，因此，铲车识别元件可以连接过滤元件，用于对铲车目标框过小(如目标框面积小于第一面积阈值)的铲车识别事件进行过滤，并且铲车目标框大于等于第一面积阈值的铲车识别事件可以进入分流元件处理。
分流元件可以用于判定铲车识别事件对应的铲车目标框面积是否大于第二面积阈值(第二面积阈值大于第一面积阈值)，在铲车识别事件对应的铲车目标框大于第二面积阈值的情况下，转至人体检测元件，以确定铲车目标框内是否存在人体，通过过滤元件对铲车目标框内不存在人体的铲车识别事件进行过滤，通过铲车识别输出元件输出铲车目标框内存在人体的铲车识别事件。
在铲车识别事件对应的铲车目标框小于等于第二面积阈值的情况下，转至放大抓图元件，控制对应的监控点位进行放大抓图，并通过二次分析元件对放大抓图得到的图片进行铲车检测，得到铲车目标框，通过过滤元件过滤掉不存在铲车目标框或铲车目标框置信度过低的铲车识别事件。
对于过滤元件输出给人体检测元件的铲车识别事件，可以进行人体检测，确定铲车目标框内是否存在人体，对铲车目标框内不存在人体的铲车识别事件进行过滤，通过铲车识别输出元件输出铲车目标框内存在人体的铲车识别事件。
本申请实施例还提供了一种报文处理方法，该方法可以由终端设备或服务器等电子设备执行，终端设备可以是固定终端或移动终端，例如手机、平板电脑、台式机、一体机等等，服务器包括本地服务器或云端服务器等，在本实施例中并不做限制。
请参见图2，为本申请实施例提供的一种报文处理方法的流程示意图，如图2所示，该报文处理方法可以包括以下步骤：
步骤S200、在检测到针对目标策略的运行指令的情况下，获取目标策略包括的目标元件。
示例性的，目标策略可以按照图1所示方法流程中所描述的方法编排生成。
本申请实施例中，用户可以根据实际需求对按照图1所示方法流程中描述的方法编排生成的策略进行运行。
对于任一按照图1所示方法流程中所描述的方法编排生成的策略(本文中称为目标策略)，在检测到针对目标策略的运行指令的情况下，可以获取目标策略包括的目 标元件。
示例性的，对于事件输入元件之外的其它元件，可以通过导入程序包，进行元件封装的方式生成元件，并定义计算元件的输入和输出，从而得到目标策略包括的目标元件，也可通过导入元件包的方式得到相应元件。
需要说明的是，对于任一策略，还可以配置该策略的运行范围，如运行的时间范围和/或空间范围等，即配置在哪些时间段和/或哪些事件发生地点需要运行该策略。
相应地，在存在运行时间范围配置的情况下，可以在所配置的运行时间范围内自动运行该策略；在存在运行空间范围的情况下，在运行该策略的情况下，可以利用该策略对该运行空间范围内的相关事件进行处理。
步骤S210、依据目标元件中各处理元件之间的连接关系，确定各处理元件的运行顺序，并依据运行顺序进行处理元件的运行，由所运行的处理元件利用对应的参数对待处理事件报文进行处理。
本申请实施例中，在利用策略对任一待处理事件报文进行处理的情况下，可以依据目标元件中各处理元件之间的连接关系，确定各处理元件的运行顺序，并依据该运行顺序进行处理元件的运行。
对于任一处理元件，在运行该处理元件的情况下，该处理元件可以利用对应的参数对待处理事件报文进行处理，报文中包括时间、地点(或监控前端的点位)、图片(或图片地址)、图片检测结果(如车牌识别结果)等。
例如，对于过滤元件，可以依据待处理事件报文中的时间、点位等字段的值，确定是否需要对待处理事件报文进行过滤。
又例如，对于图像质量评分元件，可以依据待处理事件报文中携带的图片地址，获取对应的图片，并利用预设图像质量评分算法对获取到的图片进行质量评分，得到图片的质量分数。
在一些实施例中，目标元件还包括事件输入元件；上述依据运行顺序进行处理元件的运行，由所运行的处理元件利用对应的参数对待处理事件报文进行处理之前，还可以包括：运行目标元件中的事件输入元件，依据事件输入元件中设置的事件源信息，获取待处理事件报文。
示例性的，事件源信息可以包括事件输入地址。在目标元件包括事件输入元件的情况下，在对策略进行运行时，可以先运行事件输入元件，依据事件输入元件中设置的事件输入地址，获取待处理事件报文。
示例性的，待处理事件报文的来源可以包括但不限于前端设备、中心端设备或可信第三方平台等。
示例性的，以目标策略为目标事件对应的策略为例，上述事件输入地址可以为存储目标事件的事件报文(即告警报文)的消息队列(如Kafka队列)的地址，目标事件产生的事件报文均可以保存在该消息队列中，在运行目标策略的事件输入元件时，可以依据事件输入元件中设置的事件输入地址，从该消息队列中获取事件报文，作为待处理事件报文。
示例性的，在依据事件输入地址获取待处理事件报文时，需要对事件输入地址对应的消息队列中各事件报文的事件码进行解析(为了便于区分不同类型的事件的事件报文，事件报文还可以包含事件码，一个消息队列中可以存储多种不同事件码的事件报文)，并对消息队列中事件码与事件输入元件中设置的事件码一致的事件报文进行拉取，作为待处理事件报文。
示例性的，在策略中配置有运行时间范围和/或运行空间范围的情况下，事件输入元件在进行待处理事件报文获取时，需要对事件输入地址对应的消息队列中各事件报文的事件发生时间(如事件报文的上报时间)和/或点位标识(或称为场景标识)进行解析，以确定该事件报文对应的事件发生时间是否在预设运行时间范围，和/或，事件发生地点是否处于预设运行空间范围内。在该事件报文对应的事件发生时间未处于预设运行时间范围，或，事件发生地点未处于预设运行空间范围内的情况下，不对该事件报文进行拉取。
或者，事件输入元件在从事件输入地址对应的消息队列中拉取到事件报文之后，对拉取到的事件报文的事件发生时间和/或点位标识(或称为场景标识)进行解析，以确定该事件报文对应的事件发生时间是否在预设运行时间范围，和/或，事件发生地点是否处于预设运行空间范围内，在该事件报文对应的事件发生时间未在预设运行时间范围，或，事件发生地点未处于预设运行空间范围内的情况下，对该事件报文进行过滤，不再输出给下一元件。
举例来说，假设策略中预设的运行时间范围为9：00---17：00，运行空间范围为：点位ABCDEF。则对于事件输入地址对应的消息队列中事件发生时间为8:00，事件发生地点为点位A的事件报文(即事件发生时间未处于预设运行时间范围，但是事件发生地点在预设运行空间范围)，事件输入元件可以不进行拉取，或者，在拉取之后，将该事件报文过滤掉。
对于事件输入地址对应的消息队列中事件发生时间为10:00，事件发生地点为点位T的事件报文(即事件发生时间处于预设运行时间范围，但是事件发生地点未处于预设运行空间范围)，事件输入元件可以不进行拉取，或者，在拉取之后，将该事件报文过滤掉。
在一些实施例中，目标元件还包括事件输出元件；上述依据运行顺序进行处理元件的运行，由所运行的处理元件利用对应的参数对待处理事件报文进行处理之后，还可以包括：在运行到目标元件中的事件输出元件的情况下，依据事件输出元件中设置的输出地址进行数据输出。
示例性的，在目标元件中还包括事件输出元件，且运行到目标元件中的事件输出元件的情况下，可以依据事件输出元件中设置的输出地址进行数据输出。
示例性的，上述输出地址可以为输出的数据的存储路径，在运行事件输出元件的情况下，可以依据事件输出元件中设置的输出地址，将输出数据保存至指定存储路径，例如，存储到有效告警报文队列。
示例性的，事件输出元件的参数还可以包括输出格式信息，以便运行事件输出元件时，可以依据所设置的输出格式信息将输出数据保存至指定存储路径。
需要说明的是，在本申请实施例中，事件输出元件中也可以设置事件码，且事件输出元件中设置的事件码可以与事件输入元件中设置的事件码不同，即事件输出元件输出的事件报文中的事件码可以与事件输入元件拉取的事件报文中的事件码不同。
仍以铲车识别场景为例，在铲车作业场景的监控前端中，可以配置为在检测到铲车的情况下，就进行抓图，并生成对应的事件报文(假设事件码为事件码1，用于标识事件类型为识别到铲车)。但是，实际铲车识别场景中，在铲车周围识别到人员的情况下才会进行告警，因而，针对铲车识别事件，其事件输入元件中的事件码可以为事件码1，从而，可以将识别到铲车的情况下触发的事件(事件码为事件码1的事件)均拉取过来，并依据所配置策略中的处理元件，确定铲车周围(如以铲车中心为中心， 预设距离范围内)是否检测到人员，若检测到人员，则通过事件输出元件输出事件报文，输出的事件报文的事件码由事件码1调整为事件码2(用于标识事件类型为铲车周围存在人员)。
此外，对于任一按照图1所示方法编排得到的策略，可以对其进行校验，例如，校验策略是否包括事件输入元件、事件输出元件以及至少一个处理元件；校验连接是否完整，如是否存在元件与其它元件均未连接；校验各元件必填的参数是否配置，例如，对于事件输入元件，是否配置了事件源信息；对于事件输出元件，是否配置了输出地址；对于过滤元件，是否配置了过滤条件等。由此，可以实现对策略的完整性、可执行性进行校验。
此外，还可以利用测试数据(可以为模拟事件)对策略的效果进行验证，例如，验证策略是否能够达到预期效果。在按照上述方式完成对策略的验证，且验证通过的情况下，可以将策略的状态设置为已验证；否则，策略的状态可以设置为未验证。
对于状态为已验证的策略，可以直接运行，不需要再次验证。再者，对于已验证的策略，在依据策略的运行效果确定需要对策略进行参数调整时，可以依据预设时间内的历史事件报文对参数调整后的策略进行运行效果验证，在确定参数调整后的策略的运行效果满足条件的情况下，依据参数调整后的策略进行报文处理。
例如，对于用于钓鱼事件检测的策略，若由于初始配置策略时，用于进行钓鱼检测的参数，如人与鱼竿的重叠程度阈值、鱼竿置信度等参数设置不合理，则可能会存在较多的误报，在该情况下，可以对所配置的策略进行参数调整，并依据一定时间内的历史事件报文对参数调整后的策略进行运行效果验证，在确定参数调整后的策略的运行效果满足条件的情况下，依据参数调整后的策略进行报文处理。
在一些实施例中，上述依据运行顺序进行处理元件的运行，可以包括：对于所运行的任一处理元件，在确定待处理事件报文不满足该处理元件向下一元件进行输出的条件的情况下，停止处理元件的运行，并将待处理事件报文输出到指定地址。
示例性的，在处理元件的运行过程中，对于任一处理元件，在运行该处理元件时，可以确定待处理事件报文是否满足该处理元件向下一元件进行输出的条件。
示例性的，对于过滤元件，可以判断待处理事件报文中的指定字段是否与预设过滤条件匹配，若匹配，则确定该待处理事件报文不满足该处理元件向下一元件进行输出的条件；否则，确定该待处理事件报文满足该处理元件向下一元件进行输出的条件。
示例性的，对于非过滤元件，可以默认待处理事件报文满足该处理元件向下一元件进行输出的条件。
需要说明的是，在实际应用中，对于一个处理元件，其下一元件可以存在多个，即存在多个输出分支，在该情况下，需要依据待处理事件报文以及预设判断逻辑确定输出至哪一个元件。
以分流元件为例，该分流元件中可以配置有预设的判定规则，并且依据运行分流元件的判定结果可以跳转至不同的下一元件。例如，分流元件的判定结果“是”和“否”可以对应不同的分支，在进行策略配置时，可以依据分流元件的不同判定结果下的处理逻辑，为分流元件的不同分支连接不同的处理元件，进而，在运行分流元件时，可以依据判定结果为“是”或“否”，确定对应的下一元件。
仍以上述铲车识别场景为例，分流元件中的判定逻辑可以为铲车检出框的尺寸是否大于预设尺寸阈值，若否，则需要对抓拍图像进行放大。相应地，在进行策略配置时，分流元件的判定结果为是(铲车检出框的尺寸大于预设尺寸阈值)，其对应的下 一元件可以为人体检测元件，用于依据原始抓拍图像进行人体检测，以确定铲车周围是否存在人员；否则，其对应的下一元件可以为放大抓图元件，以便通过运行放大抓图元件，对铲车识别事件的抓拍图像进行放大。在运行分流元件的情况下，可以依据判定结果确定下一元件。
示例性的，对于所运行的任一处理元件，在确定待处理事件报文不满足该处理元件向下一元件进行输出的条件的情况下，即确定需要对该待处理事件报文进行拦截，可以拒绝将该待处理事件报文输出给下一元件，并将待处理事件报文输出到指定地址。
示例性的，对于运行任一处理元件过程中确定需要进行拦截的报文，可以统一输出至指定地址，例如，通过总线将被拦截的报文输出到指定地址。
示例性的，对于输出至指定地址的待处理事件报文，还可以携带输出原因，即由于何种原因对待处理事件报文进行拦截，以便后续相关人员可以依据输出原因确定待处理事件报文被拦截的原因。
在一些实施例中，在检测到针对目标策略的运行指令的情况下，本申请实施例提供的报文处理方法还包括：对运行目标策略的情况下输出的事件报文或者输出的事件报文以及事件报文的输出原因进行持久化存储；在检测到针对持久化存储的事件报文的搜索指令时，从持久化存储的事件报文中搜索与搜索指令指示的搜索条件匹配的事件报文及其对应的输出原因。
示例性的，运行目标策略的情况下输出的事件报文可以包括运行事件输出元件的情况下输出的事件报文，也包括运行处理元件时输出的事件报文，例如，在运行某一处理元件时，被确定为不满足向下一元件输出的事件报文。
示例性的，对于运行处理元件时输出的事件报文，可以输出事件报文的输出原因，该输出原因可以包括输出该事件报文的处理元件的标识信息，以及，该处理元件输出该事件报文的原因，以便相关人员可以进行策略执行回溯，如查询各事件报文的策略执行链路(如事件报文经过了哪些元件的处理)以及处理结果(如是否属于被策略拦截的报文(如，该报文是否为误报或重复告警数据))。
示例性的，搜索条件可以包括但不限于时间范围和/或空间范围等。
示例性的，在对运行目标策略的情况下输出的事件报文以及事件报文的输出原因进行持久化存储的过程中，可以依据存储的数据量切换存储介质。
例如，在数据量小于预设数据量阈值的情况下，可以将输出的事件报文以及事件报文的输出原因存储在数据库中；在数据量大于等于预设数据量阈值的情况下，采用ES(一种基于索引的分布式存储方式)存储方式进行存储。
需要说明的是，在本申请实施例中，对于被策略拦截的事件报文，可以在人工核查之后转为有效输出，如输出至有效告警报文队列。
示例性的，本申请实施例提供的方案还支持策略成效统计，例如，统计策略总数，以及各策略的运行状态(如运行中、未运行、异常或未验证等)；统计原始事件报文数量(即原始上报的事件报文的数量)、拦截事件报文数量(或称为过滤事件报文数量)、策略输出事件报文数量(即策略的事件输出元件输出的事件报文的数量，也可以称为有效事件报文数量)。
示例性的，对于统计结果，可以依据事件类型，利用列表的形式进行展示。其中，对于任一类型的事件，其展示内容可以包括但不限于原始事件报文数量、拦截事件报文数量、策略输出事件报文数量，以及，过滤事件报文占比(即过滤事件报文数量与原始事件报文数量的比值)，其示意图可以如图3A所示。
其中，对于任一类型的事件，还可以依据统计数据进行数据趋势预测，例如，该类型事件上报的次数增加或减少。
此外，依据上述统计数据，还可以确定各不同类型事件的策略输出事件报文数量，以及，各不同类型事件的策略输出事件报文占比(如一类型事件的策略输出事件报文数量占所有类型事件的策略输出事件报文数量之和的比值)，并依据数量排序或占比排序的方式进行展示，其示意图可以如图3B所示。
以上对本申请提供的方法进行了描述。下面对本申请提供的装置进行描述：
请参见图6，为本申请实施例提供的一种策略编排装置的结构示意图，如图6所示，该策略编排装置可以包括：
第一确定单元610，被配置为确定需要进行策略编排的目标事件；
编排单元620，被配置为依据检测到的元件添加指令，将元件添加指令指向的目标元件添加至策略可视化编排界面；其中，目标元件包括处理元件；处理元件包括函数元件、算法元件以及执行元件中的一种或多种；其中，函数元件用于对待处理数据进行逻辑运算处理；算法元件用于利用预设算法对待处理数据进行算法处理；执行元件用于控制指定设备执行相应动作；
第二确定单元630，被配置为依据检测到的针对策略可视化编排界面中的处理元件的连接操作指令，确定处理元件之间的连接关系；以及，依据检测到的针对策略可视化编排界面中的处理元件的参数编辑指令，确定处理元件的参数；
生成单元640，被配置为在检测到策略保存指令的情况下，依据处理元件、处理元件之间的连接关系，以及，处理元件的参数，生成并保存目标事件的策略。
在一些实施例中，目标元件还包括事件输入元件；
第一确定单元610，具体被配置为在检测到针对目标事件的策略编排指令的情况下，创建针对目标事件的事件输入元件，其中，事件输入元件中设置有事件源信息，用于运行事件输入元件时依据事件源信息获取目标事件的事件报文；或，在检测到事件输入元件创建指令的情况下，创建初始事件输入元件；依据检测到的针对初始事件输入元件的事件标识配置指令，确定目标事件的事件输入元件；
编排单元620，还被配置为依据检测到的针对事件输入元件的连接操作指令，确定事件输入元件与处理元件之间的连接关系。
在一些实施例中，目标元件还包括事件输出元件；事件输出元件中设置有输出地址，用于运行事件输出元件时依据输出地址进行数据输出；
编排单元620，还被配置为依据检测到的针对事件输出元件的连接操作指令，确定事件输出元件与处理元件之间的连接关系。
在一些实施例中，第二确定单元630，具体被配置为在检测到将目标事件的事件报文粘贴至事件报文解析界面的指定区域的操作指令的情况下，对目标事件的事件报文进行解析，确定目标事件的事件报文包括的字段信息，并显示字段信息；依据检测到的针对目标事件的事件报文中的目标字段的参数编辑指令，确定该处理元件的参数。
请参见图7，为本申请实施例提供的一种策略编排设备的硬件结构示意图。该策略编排设备可以包括处理器701、通信接口702、存储器703和通信总线704。处理器701、通信接口702以及存储器703通过通信总线704完成相互间的通信。其中，存储器703上存放有策略可视化编排软件程序；处理器701可以通过执行存储器703上所存放的策略可视化编排软件程序，执行上文描述的策略编排方法。
本文中提到的存储器703可以是任何电子、磁性、光学或其它物理存储装置，可 以包含或存储信息，如可执行指令、数据，等等。例如，存储器703可以是：RAM(Radom Access Memory，随机存取存储器)、易失存储器、非易失性存储器、闪存、存储驱动器(如硬盘驱动器)、固态硬盘、任何类型的存储盘(如光盘、dvd等)，或者类似的存储介质，或者它们的组合。
本申请实施例还提供了一种存储有策略可视化编排软件程序的计算机可读存储介质，例如图7中的存储器703，该软件程序可由图7所示策略编排设备中的处理器701执行以实现上文中描述的策略编排方法。
本申请实施例还提供了一种策略可视化编排软件程序，存储于计算机可读存储介质，例如图7中的存储器703，并且当处理器执行该策略可视化编排软件程序时，促使处理器701执行上文中描述的策略编排方法。
请参见图8，为本申请实施例提供的一种报文处理装置的结构示意图，如图8所示，该报文处理装置可以包括：
获取单元810，被配置为在检测到针对目标策略的运行指令的情况下，获取目标策略包括的目标元件；其中，目标策略按照上述实施例中描述的策略编排方法编排生成；
处理单元820，被配置为依据目标元件中各处理元件之间的连接关系，确定各处理元件的运行顺序，并依据运行顺序进行处理元件的运行，由所运行的处理元件利用对应的参数对待处理事件报文进行处理。
在一些实施例中，目标元件还包括事件输入元件；
处理单元820，还被配置为运行目标元件中的事件输入元件，依据事件输入元件中设置的事件源信息，获取待处理事件报文。
在一些实施例中，目标元件还包括事件输出元件；
处理单元820，还被配置为在运行到目标元件中的事件输出元件的情况下，依据事件输出元件中设置的输出地址进行数据输出。
在一些实施例中，处理单元820，具体被配置为对于所运行的任一处理元件，在确定待处理事件报文不满足该处理元件向下一元件进行输出的条件的情况下，停止该处理元件的运行，并将待处理事件报文输出到指定地址。
请参见图9，为本申请实施例提供的一种报文处理设备的硬件结构示意图。该报文处理设备可以包括处理器901、通信接口902、存储器903和通信总线904。处理器901、通信接口902以及存储器903通过通信总线904完成相互间的通信。其中，存储器903上存放有运行编排后的策略的软件程序；处理器901可以通过执行存储器903上所存放的运行编排后的策略的软件程序，执行上文描述的报文处理方法。
本文中提到的存储器903可以是任何电子、磁性、光学或其它物理存储装置，可以包含或存储信息，如可执行指令、数据，等等。例如，存储器903可以是：RAM(Radom Access Memory，随机存取存储器)、易失存储器、非易失性存储器、闪存、存储驱动器(如硬盘驱动器)、固态硬盘、任何类型的存储盘(如光盘、dvd等)，或者类似的存储介质，或者它们的组合。
本申请实施例还提供了一种存储有运行编排后的策略的软件程序的计算机可读存储介质，例如图9中的存储器903，该软件程序可由图9所示电子设备中的处理器901执行以实现上文中描述的报文处理方法。
本申请实施例还提供了一种运行编排后的策略的软件程序，存储于计算机可读存储介质，例如图9中的存储器903，并且当处理器执行该运行编排后的策略的软件程序 时，促使处理器901执行上文中描述的报文处理方法。
请参见图10，为本申请实施例提供的一种报文处理***的结构示意图，如图10所示，该报文处理***可以包括：策略编排设备以及报文处理设备。
其中，策略编排设备可以按照上述实施例中描述的策略编排方法进行策略编排；报文处理设备可以按照上述实施例中描述的报文处理方法进行报文处理。
示例性的，策略编排设备的结构可以如图7所示。
示例性的，报文处理设备的结构可以如图9所示。
需要说明的是，在本文中，诸如第一和第二等之类的关系术语仅仅用来将一个实体或者操作与另一个实体或操作区分开来，而不一定要求或者暗示这些实体或操作之间存在任何这种实际的关系或者顺序。而且，术语“包括”、“包含”或者其任何其他变体意在涵盖非排他性的包含，从而使得包括一系列要素的过程、方法、物品或者设备不仅包括那些要素，而且还包括没有明确列出的其他要素，或者是还包括为这种过程、方法、物品或者设备所固有的要素。在没有更多限制的情况下，由语句“包括一个……”限定的要素，并不排除在包括所述要素的过程、方法、物品或者设备中还存在另外的相同要素。
以上所述仅为本申请的较佳实施例而已，并不用以限制本申请，凡在本申请的精神和原则之内，所做的任何修改、等同替换、改进等，均应包含在本申请保护的范围之内。

Claims (15)

  1. 一种策略编排方法，其特征在于，包括：
    确定需要进行策略编排的目标事件；
    依据检测到的元件添加指令，将所述元件添加指令指向的目标元件添加至策略可视化编排界面；其中，所述目标元件包括处理元件；所述处理元件包括函数元件、算法元件以及执行元件中的一种或多种；其中，所述函数元件用于对待处理数据进行逻辑运算处理；所述算法元件用于利用预设算法对待处理数据进行算法处理；所述执行元件用于控制指定设备执行相应动作；
    依据检测到的针对所述策略可视化编排界面中的所述处理元件的连接操作指令，确定所述处理元件之间的连接关系；以及，依据检测到的针对所述策略可视化编排界面中的所述处理元件的参数编辑指令，确定所述处理元件的参数；
    在检测到策略保存指令的情况下，依据所述处理元件、所述处理元件之间的连接关系，以及，所述处理元件的参数，生成并保存所述目标事件的策略。
  2. 根据权利要求1所述的策略编排方法，其特征在于，所述目标元件还包括事件输入元件；所述方法还包括：
    在检测到针对所述目标事件的策略编排指令的情况下，创建针对所述目标事件的事件输入元件，其中，所述事件输入元件中设置有事件源信息，用于运行所述事件输入元件时依据所述事件源信息获取所述目标事件的事件报文；
    或，
    在检测到事件输入元件创建指令的情况下，创建初始事件输入元件；依据检测到的针对所述初始事件输入元件的事件标识配置指令，确定所述目标事件的事件输入元件；
    所述依据检测到的元件添加指令，将所述元件添加指令指向的目标元件添加至策略可视化编排界面之后，还包括：
    依据检测到的针对所述事件输入元件的连接操作指令，确定所述事件输入元件与所述处理元件之间的连接关系。
  3. 根据权利要求1所述的策略编排方法，其特征在于，所述目标元件还包括事件输出元件；所述事件输出元件中设置有输出地址，用于运行所述事件输出元件时依据所述输出地址进行数据输出；
    所述依据检测到的元件添加指令，将所述元件添加指令指向的目标元件添加至策略可视化编排界面之后，还包括：
    依据检测到的针对所述事件输出元件的连接操作指令，确定所述事件输出元件与所述处理元件之间的连接关系。
  4. 根据权利要求1至3任一项所述的方法，其特征在于，所述依据检测到的针对所述策略可视化编排界面中的所述处理元件的参数编辑指令，确定所述处理元件的参数，包括：
    在检测到将所述目标事件的事件报文粘贴至事件报文解析界面的指定区域的操作指令的情况下，对所述目标事件的事件报文进行解析，确定所述目标事件的事件报文包括的字段信息，并显示所述字段信息；
    依据检测到的针对所述目标事件的事件报文中的目标字段的参数编辑指令，确定该处理元件的参数。
  5. 一种报文处理方法，其特征在于，包括：
    在检测到针对目标策略的运行指令的情况下，获取所述目标策略包括的目标元件；其中，所述目标策略按照权利要求1至4任一项所述的方法编排生成；
    依据所述目标元件中各处理元件之间的连接关系，确定各所述处理元件的运行顺序，并依据所述运行顺序进行所述处理元件的运行，由所运行的所述处理元件利用对应的参数对待处理事件报文进行处理。
  6. 根据权利要求5所述的方法，其特征在于，所述目标元件还包括事件输入元件；
    所述依据所述运行顺序进行所述处理元件的运行，由所运行的所述处理元件利用对应的参数对待处理事件报文进行处理之前，还包括：
    运行所述目标元件中的所述事件输入元件，依据所述事件输入元件中设置的事件源信息，获取所述待处理事件报文。
  7. 根据权利要求5所述的方法，其特征在于，所述目标元件还包括事件输出元件；
    所述依据所述运行顺序进行所述处理元件的运行，由所运行的所述处理元件利用对应的参数对待处理事件报文进行处理之后，还包括：
    在运行到所述目标元件中的所述事件输出元件的情况下，依据所述事件输出元件中设置的输出地址进行数据输出。
  8. 根据权利要求5至7任一项所述的方法，其特征在于，所述依据所述运行顺序进行所述处理元件的运行，由所运行的所述处理元件利用对应的参数对待处理事件报文进行处理包括：
    对于所运行的任一处理元件，在确定所述待处理事件报文不满足该处理元件向下一元件进行输出的条件的情况下，停止该处理元件的运行，并将所述待处理事件报文输出到指定地址。
  9. 一种策略编排装置，其特征在于，包括：
    第一确定单元，被配置为确定需要进行策略编排的目标事件；
    编排单元，被配置为依据检测到的元件添加指令，将所述元件添加指令指向的目标元件添加至策略可视化编排界面；其中，所述目标元件包括处理元件；所述处理元件包括函数元件、算法元件以及执行元件中的一种或多种；其中，所述函数元件用于对待处理数据进行逻辑运算处理；所述算法元件用于利用预设算法对待处理数据进行算法处理；所述执行元件用于控制指定设备执行相应动作；
    第二确定单元，被配置为依据检测到的针对所述策略可视化编排界面中的所述处理元件的连接操作指令，确定所述处理元件之间的连接关系；以及，依据检测到的针对所述策略可视化编排界面中的所述处理元件的参数编辑指令，确定所述处理元件的参数；
    生成单元，被配置为在检测到策略保存指令的情况下，依据所述处理元件、所述处理元件之间的连接关系，以及，所述处理元件的参数，生成并保存所述目标事件的策略。
  10. 根据权利要求9所述的装置，其特征在于，所述目标元件还包括事件输入元件；
    所述第一确定单元，具体被配置为在检测到针对所述目标事件的策略编排指令的情况下，创建针对所述目标事件的事件输入元件，其中，所述事件输入元件中设置有事件源信息，用于运行所述事件输入元件时依据所述事件源信息获取所述目标事件的 事件报文；或，在检测到事件输入元件创建指令的情况下，创建初始事件输入元件；依据检测到的针对所述初始事件输入元件的事件标识配置指令，确定所述目标事件的事件输入元件；
    所述编排单元，还被配置为依据检测到的针对所述事件输入元件的连接操作指令，确定所述事件输入元件与所述处理元件之间的连接关系；
    其中，所述目标元件还包括事件输出元件；所述事件输出元件中设置有输出地址，用于运行所述事件输出元件时依据所述输出地址进行数据输出；
    所述编排单元，还被配置为依据检测到的针对所述事件输出元件的连接操作指令，确定所述事件输出元件与所述处理元件之间的连接关系；
    其中，所述第二确定单元，具体被配置为在检测到将所述目标事件的事件报文粘贴至事件报文解析界面的指定区域的操作指令的情况下，对所述目标事件的事件报文进行解析，确定所述目标事件的事件报文包括的字段信息，并显示所述字段信息；依据检测到的针对所述目标事件的事件报文中的目标字段的参数编辑指令，确定该处理元件的参数。
  11. 一种策略编排设备，其特征在于，包括处理器、通信接口、存储器和通信总线，其中，所述处理器，所述通信接口，所述存储器通过所述通信总线完成相互间的通信；
    所述存储器，用于存放策略可视化编排软件程序；
    所述处理器，用于执行所述存储器上所存放的所述策略可视化编排软件程序，实现权利要求1至4任一项所述的策略编排方法。
  12. 一种报文处理装置，其特征在于，包括：
    获取单元，被配置为在检测到针对目标策略的运行指令的情况下，获取所述目标策略包括的目标元件；其中，所述目标策略按照权利要求1至4任一项所述的方法编排生成；
    处理单元，被配置为依据所述目标元件中各处理元件之间的连接关系，确定各所述处理元件的运行顺序，并依据所述运行顺序进行所述处理元件的运行，由所运行的所述处理元件利用对应的参数对待处理事件报文进行处理。
  13. 根据权利要求12所述的装置，其特征在于，所述目标元件还包括事件输入元件；
    所述处理单元，还被配置为运行所述目标元件中的所述事件输入元件，依据所述事件输入元件中设置的事件源信息，获取所述待处理事件报文；
    其中，所述目标元件还包括事件输出元件；
    所述处理单元，还被配置为在运行到所述目标元件中的所述事件输出元件的情况下，依据所述事件输出元件中设置的输出地址进行数据输出；
    其中，所述处理单元，具体被配置为对于所运行的任一处理元件，在确定所述待处理事件报文不满足该处理元件向下一元件进行输出的条件的情况下，停止该处理元件的运行，并将所述待处理事件报文输出到指定地址。
  14. 一种报文处理设备，其特征在于，包括处理器、通信接口、存储器和通信总线，其中，所述处理器，所述通信接口，所述存储器通过所述通信总线完成相互间的 通信；
    所述存储器，用于存放运行编排后的策略的软件程序；
    所述处理器，用于执行所述存储器上所存放的所述运行编排后的策略的软件程序，实现权利要求5至8任一项所述的报文处理方法。
  15. 一种报文处理***，其特征在于，包括权利要求11所述的策略编排设备以及权利要求14所述的报文处理设备。
PCT/CN2023/105086 2022-12-08 2023-06-30 策略编排方法、报文处理方法、装置、设备及*** WO2024119806A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202211574967.1 2022-12-08
CN202211574967.1A CN116109909A (zh) 2022-12-08 2022-12-08 策略编排方法、报文处理方法、装置、设备及***

Publications (1)

Publication Number Publication Date
WO2024119806A1 true WO2024119806A1 (zh) 2024-06-13

Family

ID=86257065

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2023/105086 WO2024119806A1 (zh) 2022-12-08 2023-06-30 策略编排方法、报文处理方法、装置、设备及***

Country Status (2)

Country Link
CN (1) CN116109909A (zh)
WO (1) WO2024119806A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN116109909A (zh) * 2022-12-08 2023-05-12 杭州海康威视***技术有限公司 策略编排方法、报文处理方法、装置、设备及***

Citations (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20160212166A1 (en) * 2015-01-20 2016-07-21 Cisco Technology, Inc. Management of security policies across multiple security products
CN110851228A (zh) * 2019-11-19 2020-02-28 亚信科技（中国）有限公司 复杂事件可视化编排处理***及方法
CN111967849A (zh) * 2020-08-19 2020-11-20 支付宝(杭州)信息技术有限公司 一种任务处理流程编排方法、装置及电子设备
CN112148260A (zh) * 2020-09-25 2020-12-29 京东数字科技控股股份有限公司 决策引擎实现方法、装置、设备及存储介质
CN114936019A (zh) * 2021-12-09 2022-08-23 腾讯科技（深圳）有限公司 一种组件及策略联动方法、装置、设备、***及存储介质
US11467868B1 (en) * 2017-05-03 2022-10-11 Amazon Technologies, Inc. Service relationship orchestration service
CN115984677A (zh) * 2022-12-08 2023-04-18 杭州海康威视数字技术股份有限公司 数据智能分析方法、装置和***
CN116109909A (zh) * 2022-12-08 2023-05-12 杭州海康威视***技术有限公司 策略编排方法、报文处理方法、装置、设备及***

Patent Citations (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20160212166A1 (en) * 2015-01-20 2016-07-21 Cisco Technology, Inc. Management of security policies across multiple security products
US11467868B1 (en) * 2017-05-03 2022-10-11 Amazon Technologies, Inc. Service relationship orchestration service
CN110851228A (zh) * 2019-11-19 2020-02-28 亚信科技（中国）有限公司 复杂事件可视化编排处理***及方法
CN111967849A (zh) * 2020-08-19 2020-11-20 支付宝(杭州)信息技术有限公司 一种任务处理流程编排方法、装置及电子设备
CN112148260A (zh) * 2020-09-25 2020-12-29 京东数字科技控股股份有限公司 决策引擎实现方法、装置、设备及存储介质
CN114936019A (zh) * 2021-12-09 2022-08-23 腾讯科技（深圳）有限公司 一种组件及策略联动方法、装置、设备、***及存储介质
CN115984677A (zh) * 2022-12-08 2023-04-18 杭州海康威视数字技术股份有限公司 数据智能分析方法、装置和***
CN116109909A (zh) * 2022-12-08 2023-05-12 杭州海康威视***技术有限公司 策略编排方法、报文处理方法、装置、设备及***

Also Published As

Publication number Publication date
CN116109909A (zh) 2023-05-12

Similar Documents

Publication Publication Date Title
EP3276913B1 (en) Network security analysis system using natural language processing techniques
EP3537325B1 (en) Interactive user interfaces
US20160261702A1 (en) Method And Apparatus For Processing Page Operation Data
US7801703B2 (en) Self-learning integrity management system and related methods
WO2024119806A1 (zh) 策略编排方法、报文处理方法、装置、设备及***
WO2020233251A1 (zh) 一种数据管理方法及装置
US11093837B2 (en) Event forecasting
US11372956B2 (en) Multiple input neural networks for detecting fraud
CN108170580A (zh) 一种基于规则的日志报警方法、装置及***
CN108874487B (zh) 基于工作流的数据分析处理方法、***、装置及存储介质
US11169896B2 (en) Information processing system
CN113792341B (zh) 应用程序的隐私合规自动化检测方法、装置、设备及介质
CN112131036A (zh) 一种过载保护方法、装置、设备及计算机可读存储介质
CN110764967A (zh) 高性能监控告警***、方法、装置及计算机可读存储介质
US10574552B2 (en) Operation of data network
CN111259212B (zh) 一种遥测数据判读方法、装置、设备及存储介质
US20220198331A1 (en) Machine model update method and apparatus, medium, and device
CN117596078B (zh) 一种基于规则引擎实现的模型驱动用户风险行为判别方法
CN109873980A (zh) 视频监控方法、装置及终端设备
KR102346885B1 (ko) 기업정보시스템에 대한 이상행위 탐지 결과를 개화 줄기 형상으로 시각화하는 방법 및 시스템
US20180276376A1 (en) System and method for high frequency heuristic data acquisition and analytics of information security events
US10909242B2 (en) System and method for detecting security risks in a computer system
KR102370858B1 (ko) 기업정보시스템에 대한 이상행위 탐지 결과를 우주 궤도 형상으로 시각화하는 방법 및 시스템
CN113672910B (zh) 安全事件处理方法及装置
CN113158185B (zh) 安全检测方法与装置