Alert Clustering Method Based on Graph Representation Learning for Online Service Systems
Author:
Affiliation:

Clc Number:

TP311

Fund Project:

  • Article
  • |
  • Figures
  • |
  • Metrics
  • |
  • Reference
  • |
  • Related
  • |
  • Cited by
  • |
  • Materials
  • |
  • Comments
    Abstract:

    In large-scale online service systems, intricate dependencies among components often cause a single fault to trigger a massive number of correlated alerts, resulting in alert storms. Alert storms not only increase the workload of on-call engineers but also make fault diagnosis and root cause analysis more challenging. To address this issue, this study proposes Alert-CM, a graph representation learning-based alert clustering method that effectively groups alerts caused by the same fault, thereby alleviating engineers’ workloads. In alert management, an alert is typically generated by aggregating various types of underlying system data at the time of a fault, including related applications, metrics, logs, alert rules, and emergency scenarios. Alert-CM assumes that multiple alerts triggered by the same fault usually exhibit tight correlations at the underlying system data level, and that the core underlying system data better represents the abnormal system state associated with the alerts. Based on this assumption, Alert-CM constructs a fine-grained system data dependency graph using alert-related configuration data, abstracting and mapping the dependency relationships between alerts and graph nodes to further expand the alert feature space. On top of the system data dependency graph, a graph neural network model is built to perform graph representation learning, in which the contributions of core underlying system data to alerts are automatically learned, producing accurate alert vector representations. Finally, the DBSCAN algorithm is applied to cluster alerts based on the learned representations. Alert-CM is evaluated on a real-world industrial dataset, with a focus on clustering effectiveness and real-time efficiency. The experimental results demonstrate that Alert-CM significantly outperforms traditional alert aggregation methods in alert clustering tasks. Specifically, Alert-CM achieves an NMI of 0.901 and an ARI of 0.645, corresponding to average improvements of 31.7% and 153.9% over existing methods, respectively. In addition, Alert-CM exhibits strong performance in online real-time clustering tasks.

    Reference
    Related
    Cited by
Get Citation

陈淼,张弼铖,张晨曦,彭鑫,杨定裕,李伟,钱泽林,吴哲顺,欧嘉煜,钟坚锐.基于图表示学习的在线服务系统告警聚类方法.软件学报,,():1-21

Copy
Share
Article Metrics
  • Abstract:
  • PDF:
  • HTML:
  • Cited by:
History
  • Received:December 10,2024
  • Revised:June 05,2025
  • Adopted:
  • Online: April 01,2026
  • Published:
You are the firstVisitors
Copyright: Institute of Software, Chinese Academy of Sciences Beijing ICP No. 05046678-4
Address:4# South Fourth Street, Zhong Guan Cun, Beijing 100190,Postal Code:100190
Phone:010-62562563 Fax:010-62562533 Email:jos@iscas.ac.cn
Technical Support:Beijing Qinyun Technology Development Co., Ltd.

Beijing Public Network Security No. 11040202500063