## 5 Multi-Source Alarm Screening and Feature Extraction  
Providing various professional alarms presents the characteristics of multi-source heterogeneity. The financial industry represented by large banks has realized the aggregation of various professional alarms through centralized monitoring. Centralized monitoring uses complex redundant fields to accommodate various professional alarm information. Taking the centralized monitoring of a bank as an example, there are more than 50 field types, which bring redundant information. In addition, in daily operation, the average daily alarm volume reaches thousands of levels. After an abnormal business, there are still alarms unrelated to the business during the fault period, which brings interference. To address the above issues, the methods in this section aim to screen and extract features [20,21] for multi-source alarms. 1. Filtering refers to the process of identifying and selecting alerts that are relevant to a particular anomalous business event within a fault period, utilizing a sliding window approach, in order to mitigate interference from irrelevant alerts. Sliding window technology [22] is a widely used technique in spatio-temporal sequence data processing. It can slide a fixed-length window in the data stream and perform uninterrupted real-time processing. Generally speaking, by using sliding windows, we can avoid computing or storing the entire data stream, thereby achieving efficient and useful results. It includes the following two steps:  
1. Window sliding: based on a sliding window W (W = 15 min), scanning centralized monitoring alarm information \((x_{1},x_{2},...,x_{n})\) at fixed intervals (every minute), mainly selecting abnormal application-related alarms and infrastructure-level alarms related to the application. 2. Data aggregation calculation: For selected alarms, we obtain the IP address cluster where the alarm is located and perform deduplication processing on it. 3. Feature structure  
The goal is to construct key alarm features, which can not only avoid the interference caused by redundant information, improve the performance of subsequent alarm analysis, but also reflect various types of associated information of alarms, and improve the coverage of fault types. Considering that fault localization is mainly used to find the IP information of the faulty component that caused the problem, based on the high availability characteristics of distributed architecture, through isolation, expansion, restart, and other emergency operations, the stable operation of the business can be restored on the first attempt. This scenario essentially defines a fault range (IP set), rather than finding the detailed root cause of a certain operation and maintenance object. Based on this, the most critical thing is the IP information of the alarm object. For the alarm description information of the object itself, due to the vast differences in fault root causes, it is difficult to effectively analyze in a short time, so this semantic information is excluded from the alarm features. At the same time, in order to better express the correlation between alarm objects and ensure the coverage of fault types, the methods in this section expand various related operation and maintenance object IPs based on read-write I/O streams, database streams, and basic component inter-access streams as features. For read/write I/O streams, first, we deploy a relationship to investigate whether the application side abnormal container is located on the same host machine. Second, we investigate the connection relationship between the virtual machine and the centralized storage to identify whether the virtual machine failure is caused by a storage node failure. Third, we investigate the connection relationship between the leaf switch and the storage to identify whether the network side switch failure is caused by storage node failure. For database access flow, firstly, we deploy a relationship to investigate whether the application side exception container is located on the same host machine.