基于DBSCAN算法的告警数据聚类研究

Research on Alarm Log Clustering Based on DBSCAN Algorithm

提出了基于DBSCAN(density-based spatial clustering of application with noise)和多约束活动窗口算法的告警时间序列预处理方法。根据原始告警数据的特点,利用DBSCAN聚类算法以时间维度将原流水告警数据划分为多个告警事件,并通过约束条件选取DBSCAN最佳输入参数,在各个时间段利用滑动时间窗口提取告警事务。实验结果表明,该方法能有效滤除单一告警事务(噪声告警)对实际事务分析的影响,提升告警事务分析的总体质量,同时可根据实际需要利用多约束条件选择最佳参数,有效提升告警事务总体分析能力。

A method of alarm time series preprocessing using DBSCAN and muti-constrained algorithm was proposed.According to the characteristics of original alarm data,the DBSCAN density clustering algorithm is used to divide the original alarm data into multiple alarm events in time dimension and multi-constrain method is used to optimize the parameters of the inputs of DBSCAN.By using the optimal input parameters of DBSCAN and the sliding time window in each time period,the alarm event is extracted from alarm time series.The experimental results show that this method can effectively filter out the noise impact in order to improve the overall quality of actual alarm practice analysis,and use multi-constrain method to effectively improve the overall alarm log analysis.