Flow chart display method and device, electronic equipment and computer readable medium

Abstract

The embodiment of the invention discloses a flow chart display method and device, electronic equipment and a computer readable medium. A specific embodiment of the method comprises the following steps: obtaining a service path information group set and message field information corresponding to a log system, each service path information group in the service path information group set being initiated by the same service initiator, a service path information group in the service path information group set comprises path information corresponding to at least one piece of service information with different attributes; matching the historical service path information group with the aggregated service path information group to obtain a matched result group, the matched result in the matched result group representing a matching consistent result and a matching inconsistent result; and displaying the business path flow chart to a main page corresponding to the log system. According to the embodiment, the error of the business flow chart is reduced, the response speed of the system when the abnormality occurs is improved, and the situation that the flow chart cannot be normally displayed is avoided.

Description

Technical Field

[0001] Embodiments of the present disclosure relate to the field of computer technology, and in particular to a flowchart display method, device, electronic device, and computer-readable medium. Background Art

[0002] In the process of realizing business monitoring, due to the complex production environment, it is difficult to form an effective display of the entire business process. It is usually necessary to form a monitoring of the business link through the business serial number. Flowchart display is a technology for displaying flowcharts. Aggregating business path information groups with the same business attributes in the business path information group set, and matching historical business path information groups with aggregated business path information groups, can fully consider the correlation between the two, reduce the error of the business process diagram, analyze the matching results, and respond to abnormal situations in a timely manner, thereby increasing the probability of normal display of the flowchart. In addition, performing regional anomaly detection on the business path flowchart can shorten the cycle of anomaly detection of the business path flowchart and improve the stability of the system. At present, the flowchart display usually adopts the method of obtaining the business path flowchart through network traffic analysis, thereby realizing the display of the flowchart.

[0003] However, when the above method is adopted, the following technical problems often occur:

[0004] First, since the business path information sets are relatively complex and have poor correlations, the generated business process diagram has large errors and is prone to path anomalies between business information. In addition, since the system cannot respond in time when an anomaly occurs, the flowchart construction process is stopped, resulting in the inability to display the flowchart normally.

[0005] Second, since the business path flowchart may be complex, the cycle of business path flowchart anomaly detection is long, and it is easy to cause large errors in the detection results. In addition, since it is impossible to respond in time after detecting abnormal results, the stability of the system is poor.

[0006] The above information disclosed in this Background section is only for enhancement of understanding of the background of the inventive concept and therefore it may contain information that does not form the prior art that is already known in this country to a person of ordinary skill in the art. Summary of the invention

[0007] The content of this disclosure is used to introduce concepts in a brief form, which will be described in detail in the detailed implementation section below. The content of this disclosure is not intended to identify the key features or essential features of the technical solution claimed for protection, nor is it intended to limit the scope of the technical solution claimed for protection.

[0008] Some embodiments of the present disclosure propose a flowchart display method, an apparatus, an electronic device, and a computer-readable medium to solve one or more of the technical problems mentioned in the above background technology section.

[0009] In a first aspect, some embodiments of the present disclosure provide a flowchart display method, the method comprising: obtaining message field information corresponding to a business path information group set and a log system, wherein each business path information group in the business path information group set is initiated by the same business initiator, and the business path information group in the business path information group set comprises: path information corresponding to at least one business information with different attributes; in response to determining that at least one business path information group in the business path information group set has the same business attribute corresponding to the path information, aggregating at least one business path information group with the same business attribute to obtain an aggregated business path information group; according to the log system Corresponding message field information is used to generate a historical business path information group; the above historical business path information group is matched with the above aggregated business path information group to obtain a matched result group, wherein the matched results in the above matched result group represent consistent matching results and inconsistent matching results; in response to determining that there are matched results representing consistent matching results in the above matched result group, the above historical business path information group and the above aggregated business path information group are merged to obtain a merged business path information group; a flowchart is constructed for the above merged business path information group to obtain a business path flowchart; and the above business path flowchart is displayed on the main page corresponding to the above log system.

[0010] In a second aspect, some embodiments of the present disclosure provide a flowchart display device, the device comprising: an acquisition unit, configured to acquire message field information corresponding to a business path information group set and a log system, wherein each business path information group in the above-mentioned business path information group set is initiated by the same business initiator, and the business path information group in the business path information group set comprises: path information corresponding to at least one business information with different attributes; an aggregation unit, configured to, in response to determining that there is at least one business path information group in the above-mentioned business path information group set whose corresponding path information has the same business attribute, aggregate at least one business path information group with the same business attribute to obtain an aggregated business path information group; a generation unit, configured to generate a message field information corresponding to the above-mentioned log system according to the message field information, generating a historical business path information group; a matching unit, configured to match the above historical business path information group with the above aggregated business path information group to obtain a matched result group, wherein the matched results in the above matched result group represent consistent matching results and inconsistent matching results; a fusion unit, configured to, in response to determining that there is a matched result representing a consistent matching result in the above matched result group, fuse the above historical business path information group with the above aggregated business path information group to obtain a fused business path information group; a construction unit, configured to construct a flowchart for the above fused business path information group to obtain a business path flowchart; a display unit, configured to display the above business path flowchart to the main page corresponding to the above log system.

[0011] In a third aspect, some embodiments of the present disclosure provide an electronic device comprising: one or more processors; a storage device on which one or more programs are stored, and when the one or more programs are executed by the one or more processors, the one or more processors implement the method described in any implementation manner of the above-mentioned first aspect.

[0012] In a fourth aspect, some embodiments of the present disclosure provide a computer-readable medium having a computer program stored thereon, wherein when the program is executed by a processor, the method described in any implementation manner of the above-mentioned first aspect is implemented.

[0013] The above-mentioned various embodiments of the present disclosure have the following beneficial effects: through the flowchart display method of some embodiments of the present disclosure, the error of the business process diagram is reduced, the response speed of the system when an exception occurs is improved, and the inability to display the flowchart normally is avoided. Specifically, the reason for the large error of the business process diagram, the inability of the system to respond in time when an exception occurs, and the inability to display the flowchart normally is that: because the business path information set is relatively complex and the correlation between them is poor, the generated business process diagram has a large error, and it is easy to have path anomalies between business information, and because the system cannot respond in time when an exception occurs, the construction process of the flowchart is stopped, resulting in the inability to display the flowchart normally. Based on this, the flowchart display method of some embodiments of the present disclosure, first, obtains the message field information corresponding to the business path information set and the log system, wherein each business path information group in the above-mentioned business path information group set is initiated by the same business initiator, and the business path information group in the business path information group set includes: at least one business information corresponding to the path information of different attributes. Thus, it can provide convenience for subsequent processing. Then, in response to determining that at least one business path information group has the same business attribute corresponding to the path information in the business path information group set, at least one business path information group with the same business attribute is aggregated to obtain an aggregated business path information group. Thus, a complex business path information group set can be simplified. Next, a historical business path information group is generated according to the message field information corresponding to the log system. Thus, a historical business path information group can be obtained. Then, the historical business path information group is matched with the aggregated business path information group to obtain a matched result group, wherein the matched result in the matched result group represents a matching consistent result and a matching inconsistent result. Thus, the association relationship between the historical business path information group and the aggregated business path information group can be determined. Afterwards, in response to determining that there is a matched result representing a matching consistent result in the matched result group, the historical business path information group is merged with the aggregated business path information group to obtain a merged business path information group. Finally, a flow chart is constructed for the merged business path information group to obtain a business path flow chart. Thus, the error of the business flow chart can be reduced and the response speed of the system when an abnormality occurs can be improved. The business path flowchart is displayed on the main page corresponding to the log system. Thus, the flowchart cannot be displayed normally. Therefore, the error of the business flow chart is reduced, the response speed of the system is improved when an abnormality occurs, and the flowchart cannot be displayed normally. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] The above and other features, advantages and aspects of the embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the accompanying drawings, the same or similar reference numerals represent the same or similar elements. It should be understood that the drawings are schematic and that components and elements are not necessarily drawn to scale.

[0015] Figure 1 is a flowchart of some embodiments of the flowchart display method according to the present disclosure;

[0016] Figure 2 is a schematic diagram of the structure of some embodiments of the flowchart display device according to the present disclosure;

[0017] Figure 3 It is a schematic diagram of the structure of an electronic device suitable for implementing some embodiments of the present disclosure. DETAILED DESCRIPTION

[0018] Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be construed as being limited to the embodiments set forth herein. On the contrary, these embodiments are provided to provide a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are only for exemplary purposes and are not intended to limit the scope of protection of the present disclosure.

[0019] It should also be noted that, for ease of description, only the parts related to the invention are shown in the drawings. In the absence of conflict, the embodiments and features in the embodiments of the present disclosure can be combined with each other.

[0020] It should be noted that the concepts such as "first" and "second" mentioned in the present disclosure are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0021] It should be noted that the modifications of "one" and "plurality" mentioned in the present disclosure are illustrative rather than restrictive, and those skilled in the art should understand that unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0022] The names of the messages or information exchanged between multiple devices in the embodiments of the present disclosure are only used for illustrative purposes and are not used to limit the scope of these messages or information.

[0023] The present disclosure will be described in detail below with reference to the accompanying drawings and in conjunction with embodiments.

[0024] Figure 1The flowchart display method of the present disclosure is a process 100 of some embodiments. The flowchart display method comprises the following steps:

[0025] Step 101: Obtain the service path information set and the message field information corresponding to the log system.

[0026] In some embodiments, the execution subject of the flowchart display method (for example, a computing device) can obtain the message field information corresponding to the business path information group set and the log system through a wired connection or a wireless connection, wherein each business path information group in the above-mentioned business path information group set is initiated by the same business initiator, and the business path information group in the business path information group set includes: path information corresponding to at least one business information with different attributes.

[0027] Here, the above-mentioned service initiator may refer to a client. The above-mentioned at least one different attribute may refer to multiple different attributes. For example, the above-mentioned at least one different attribute may include but is not limited to at least one of the following: a response status attribute, a device information attribute. The above-mentioned response status attribute may represent a response success status attribute and a response failure status attribute. The above-mentioned device information attribute may refer to a device model information attribute. The path information corresponding to the above-mentioned service information may refer to the path information formed by the processing flow of the link connection service. The processing flow of the above-mentioned service may refer to opening the client first and then querying the service information. The above-mentioned message field information may refer to the port field information of the log system and the service type field information of the log system.

[0028] It should be noted that the above-mentioned wireless connection methods may include but are not limited to 3G / 4G connection, WiFi connection, Bluetooth connection, WiMAX connection, Zigbee connection, UWB (ultra wideband) connection, and other wireless connection methods currently known or to be developed in the future.

[0029] Step 102: In response to determining that at least one service path information group in the service path information group set has the same service attribute corresponding to the path information, at least one service path information group with the same service attribute is aggregated to obtain an aggregated service path information group.

[0030] In some embodiments, the execution entity may, in response to determining that at least one business path information group in the business path information group set has the same business attribute corresponding to the path information, aggregate at least one business path information group with the same business attribute to obtain an aggregated business path information group.

[0031] As an example, the above-mentioned execution entity can, in response to determining that there is at least one business path information group in the above-mentioned business path information group set whose corresponding path information has the same business attribute, merge at least one business path information group with the same business attribute to obtain a merged business path information group as the aggregated business path information group.

[0032] Optionally, the execution subject may, in response to determining that there is at least one service path information group in the service path information group set whose corresponding path information has the same service attribute, aggregate at least one service path information group with the same service attribute to obtain an aggregated service path information group through the following steps:

[0033] In the first step, data deduplication is performed on at least one business path information group with the same business attribute to obtain a deduplicated business path information group.

[0034] Here, the above-mentioned data deduplication may refer to removing duplication.

[0035] In the second step, data integration is performed on each deduplicated business path information in the deduplicated business path information group to obtain an integrated business path information group as an aggregated business path information group.

[0036] Step 103: Generate a historical service path information group according to the message field information corresponding to the above log system.

[0037] In some embodiments, the execution entity may generate a historical service path information group according to the message field information corresponding to the log system.

[0038] Here, the above-mentioned historical service path information group may refer to a service path information group generated in the past.

[0039] Optionally, the execution subject may generate a historical service path information group according to the message field information corresponding to the log system through the following steps:

[0040] The first step is to filter the message field information corresponding to the above-mentioned log system to obtain the filtered message field information, wherein the filtered message field information includes: port number information, address information, and timestamp information.

[0041] Here, the above-mentioned address information may refer to IP address information.

[0042] The second step is to classify the historical log data corresponding to the above log system into business types to obtain the divided business type groups.

[0043] Here, the business type may refer to the type of business operation in the log system. For example, the business type may refer to the business query type.

[0044] The third step is to call and store the service information corresponding to the divided service type groups according to the port number information and the address information to generate a called and stored information group.

[0045] As an example, the execution subject may determine the location information of the service information corresponding to the service type group after the division according to the port number information and the address information. Then, the location information is called, and the time information and location information of the call are stored to generate a stored information group after the call. The location information includes: port number information and address information.

[0046] The fourth step is to sort the above-mentioned post-call storage information group in time according to the above-mentioned timestamp information to obtain the post-call storage information time series.

[0047] As an example, the execution subject may sort the post-call storage information group from early to late according to the early and late order of the timestamp information to obtain a post-call storage information time series.

[0048] The fifth step is to create business path information for the business type groups after the above division according to the time sequence of the information stored after the above call, and obtain the business path information group corresponding to the business type.

[0049] In the sixth step, data is aggregated for the service path information corresponding to multiple service types that meet the preset aggregation condition in the service path information group corresponding to the service type to obtain an aggregated service path information group.

[0050] Here, the above-mentioned preset aggregation condition may refer to a pre-set condition of “aggregating service path information of the same service type”.

[0051] In the seventh step, the aggregated service path information group is deduplicated to obtain a deduplicated service path information group as a historical service path information group.

[0052] Here, the above-mentioned deduplication processing may refer to a removal of duplicate processing.

[0053] Step 104: Match the historical service path information group with the aggregated service path information group to obtain a matched result group.

[0054] In some embodiments, the execution entity may match the historical business path information group with the aggregated business path information group to obtain a matched result group, wherein the matched results in the matched result group represent consistent matching results and inconsistent matching results.

[0055] Here, the above-mentioned matching result group may refer to an association result group between the historical service path information in the above-mentioned historical service path information group and the aggregated service path information in the above-mentioned aggregated service path information group.

[0056] Optionally, the execution subject may match the historical service path information group with the aggregated service path information group through the following steps to obtain a matched result group:

[0057] The first step is to convert the data formats of the above-mentioned historical business path information group and the above-mentioned aggregated business path information group to obtain a converted historical business path information group and a converted business path information group, wherein the data formats of the above-mentioned converted historical business path information group and the above-mentioned converted business path information group are consistent.

[0058] As an example, the execution subject may perform data format conversion on the historical service path information group and the aggregated service path information group through a format conversion tool to obtain a converted historical service path information group and a converted service path information group. The format conversion tool may refer to a format converter.

[0059] In the second step, the above-mentioned converted historical business path information group is compared with the above-mentioned converted business path information group based on preset multiple matching conditions to obtain a matching result group, wherein the above-mentioned matching result group includes: business attribute matching results, timestamp matching results and path information matching results. The above-mentioned business attribute matching results can represent business attribute matching consistent results and business attribute matching inconsistent results. The above-mentioned timestamp matching results can represent timestamp matching consistent results and timestamp matching inconsistent results. The path information matching results can represent path information matching consistent results and path information matching inconsistent results.

[0060] Here, the above-mentioned preset multiple matching conditions may refer to the preset matching conditions of “service attributes, timestamp and path information”.

[0061] Step 105 , in response to determining that there is a matching result representing a consistent matching result in the matching result group, the historical service path information group and the aggregated service path information group are merged to obtain a merged service path information group.

[0062] In some embodiments, the execution entity may, in response to determining that there is a post-matching result representing a consistent matching result in the post-matching result group, fuse the historical business path information group with the aggregated business path information group to obtain a fused business path information group.

[0063] As an example, the execution entity may merge the historical service path information group with the aggregated service path information group to obtain a merged service path information group as the fused service path information group.

[0064] Optionally, after the above “step 105”, the above method further includes:

[0065] The first step, in response to determining that there are matching results representing inconsistent matching results in the above matching result group, at least one historical business path information and at least one aggregated business path information corresponding to the matching inconsistent results in the above matching result group are divided by business attributes to obtain a divided business path information group, wherein the divided business path information group can represent that the business attributes between each divided business path information are different.

[0066] As an example, the execution subject may determine the business attributes of at least one historical business path information corresponding to the inconsistent matching result and at least one aggregated business path information in the above-mentioned post-matching result group to obtain a business attribute result set, wherein the business attribute results in the above-mentioned business attribute result set represent the same business attribute result and the different business attribute result. Then, at least one business path information corresponding to the business attribute result in the above-mentioned business attribute result set representing the different business attribute result is determined to obtain a business path information group as the divided business path information group.

[0067] The second step is to merge the divided service path information group with the merged service path information group to obtain a target service path information group.

[0068] As an example, the execution entity may merge the divided service path information group with the merged service path information group to obtain a merged service path information group as the target service path information group.

[0069] The third step is to construct a flow chart for the target business path information group to obtain a target business path flow chart.

[0070] The fourth step is to display the target business path flowchart on the main page corresponding to the log system.

[0071] Step 106, constructing a flowchart for the above-mentioned merged service path information group to obtain a service path flowchart.

[0072] In some embodiments, the execution entity may construct a flowchart for the merged service path information group to obtain a service path flowchart.

[0073] Here, the above-mentioned business path flowchart can represent a flowchart formed by the paths between various businesses.

[0074] As an example, the execution entity may connect the individual pieces of post-fusion service path information in the post-fusion service path information group by process nodes to obtain a service path flow chart.

[0075] Step 107: Display the business path flow chart on the main page corresponding to the log system.

[0076] In some embodiments, the execution entity may display the business path flowchart on a main page corresponding to the log system.

[0077] Here, the above main page may refer to the home page.

[0078] Optionally, after the above “step 107”, the above method further includes:

[0079] Anomaly detection is performed on the above-mentioned business path flowchart to obtain anomaly detection results, and the above-mentioned business path flowchart is called according to the above-mentioned anomaly detection results.

[0080] Optionally, the execution subject may perform anomaly detection on the business path flowchart through the following steps to obtain anomaly detection results, and call the business path flowchart according to the anomaly detection results:

[0081] The first step is to divide the above business path flowchart into regions evenly to obtain a business path flowchart region set.

[0082] Here, the business path flowchart areas in the business path flowchart area set contain the same number of nodes.

[0083] As an example, the execution subject may divide the service path flowchart into regions evenly with a preset number of nodes as a group to obtain a service path flowchart region set. The preset number of nodes may refer to 3 nodes.

[0084] In the second step, for each business path flowchart area in the business path flowchart area set, the following processing steps are performed:

[0085] The first sub-step is to determine the number of nodes and the number of edges in the business path flow graph area to obtain the number of nodes and the number of edges corresponding to the graph.

[0086] In the second sub-step, the density corresponding to the graph is determined according to the number of nodes corresponding to the graph and the number of edges corresponding to the graph.

[0087] As an example, the execution entity may divide the number of edges corresponding to the graph by the number of nodes corresponding to the graph to obtain the density corresponding to the graph.

[0088] The third sub-step, in response to determining that the corresponding density of the above-mentioned graph is greater than the preset density, inputs the above-mentioned business path flowchart area into a pre-trained flowchart scoring model to obtain the corresponding score of the business path flowchart area.

[0089] Here, the preset density may refer to a pre-set density value. For example, the preset density may refer to 0.5. Here, the flowchart scoring model is a model for scoring the business path flowchart area. The input of the flowchart scoring model is the business path flowchart area. The output of the flowchart scoring model is the score corresponding to the business path flowchart area. The flowchart scoring model includes an input layer, a graph convolution layer, an edge feature extraction layer, a recurrent neural network layer, and an output layer. Among them, the graph convolution layer may refer to a graph convolutional network (Graph Convolutional Network, GCN). The graph convolution layer may be used to aggregate feature information of nodes in the business path flowchart area. The edge feature extraction layer may be used to extract information about the edges connected to the nodes. The recurrent neural network layer may refer to (Recurrent Neural Network, RNN). The input of the input layer may refer to the business path flowchart area. The output of the output layer may refer to the score corresponding to the business path flowchart area.

[0090] The third step is to sort the obtained business path flowchart area corresponding score sets to obtain the business path flowchart corresponding score sequence.

[0091] As an example, the execution subject may sort the obtained score sets corresponding to the business path flowchart regions from small to large to obtain a score sequence corresponding to the business path flowchart.

[0092] The fourth step is to perform a key node traversal on each business path flowchart area corresponding to at least one business path flowchart corresponding score greater than a preset score threshold in the business path flowchart corresponding score sequence to obtain a key node set.

[0093] Here, the preset score threshold may refer to a maximum value of a preset score. For example, the preset score threshold may refer to 0.8.

[0094] The fifth step is to establish a behavior baseline for each path information corresponding to the above key node set to obtain a behavior baseline set.

[0095] Here, the behavior baseline in the behavior baseline set may refer to a normal baseline of a key node in the corresponding key node set.

[0096] In the sixth step, the key nodes in the key node set are compared with the behavioral baselines in the behavioral baseline set to obtain a comparison result set.

[0097] Here, the comparison results in the comparison result set may represent comparison consistent results and comparison inconsistent results.

[0098] In the seventh step, in response to determining that there is a comparison result representing an abnormal comparison result in the comparison result set, anomaly detection is performed on the key nodes corresponding to the comparison result representing the abnormal comparison result to obtain an abnormal detection result, and an alarm is issued on the key nodes corresponding to the abnormal detection result.

[0099] Here, the above-mentioned abnormal comparison result may refer to an inconsistent comparison result.

[0100] In the eighth step, in response to determining that the alarm is triggered, the key nodes corresponding to the above-mentioned abnormal detection results are adjusted to obtain adjusted key nodes, so as to call the business path flow chart corresponding to the above-mentioned adjusted key nodes.

[0101] Here, the node adjustment may refer to removing abnormal edges connected to the nodes.

[0102] The relevant contents in the first step to the eighth step above serve as an inventive point of the present disclosure, and solve the technical problem 2 mentioned in the background technology: "Since the business path flowchart may be complex, the cycle of abnormal detection of the business path flowchart is long, and it is easy to cause large errors in the detection results. In addition, due to the inability to respond in time after the abnormal results are detected, the stability of the system is poor.". The factors that lead to a long cycle of abnormal detection of the business path flowchart and poor stability of the system are often as follows: Since the business path flowchart may be complex, the cycle of abnormal detection of the business path flowchart is long, and it is easy to cause large errors in the detection results. In addition, due to the inability to respond in time after the abnormal results are detected, the stability of the system is poor. If the above factors are solved, the cycle of abnormal detection of the business path flowchart can be shortened and the stability of the system can be improved. In order to achieve this effect, in the first step, the above business path flowchart is evenly divided into regions to obtain a set of business path flowchart regions. As a result, the complex business path flowchart can be divided into regions and decomposed into multiple small regions for subsequent processing, which can save a lot of time, thereby shortening the cycle of abnormal detection of the business path flowchart. In the second step, for each business path flowchart area in the above-mentioned business path flowchart area set, the following processing steps are performed: the first sub-step is to determine the number of nodes and the number of edges in the above-mentioned business path flowchart area to obtain the number of nodes corresponding to the graph and the number of edges corresponding to the graph. The second sub-step is to determine the corresponding density of the graph according to the number of nodes corresponding to the graph and the number of edges corresponding to the graph. The third sub-step is to input the above-mentioned business path flowchart area into a pre-trained flowchart scoring model in response to determining that the corresponding density of the graph is greater than the preset density, and obtain the corresponding score of the business path flowchart area. In this way, each small area can be scored, which improves the speed of identifying anomalies. The third step is to sort the obtained business path flowchart area corresponding score set to obtain a business path flowchart corresponding score sequence. The fourth step is to perform key node traversal on each business path flowchart area corresponding to at least one business path flowchart corresponding score greater than the preset score threshold in the above-mentioned business path flowchart corresponding score sequence to obtain a key node set. In this way, the node with an abnormality can be locked. The fifth step is to establish a behavioral baseline for each path information corresponding to the above-mentioned key node set to obtain a behavioral baseline set. In the sixth step, the key nodes in the key node set are compared with the behavioral baselines in the behavioral baseline set to obtain a comparison result set. In this way, the abnormal behavior of the key nodes can be known. In the seventh step, in response to determining that there is a comparison result representing the abnormal comparison result in the comparison result set, an abnormality detection is performed on the key nodes corresponding to the comparison result representing the abnormal comparison result to obtain an abnormality detection result, and an alarm is issued on the key nodes corresponding to the abnormality detection result. In this way, the abnormality detection result can be responded to in a timely manner, thereby improving the stability of the system.In the eighth step, in response to determining that the alarm is triggered, the key nodes corresponding to the above abnormal detection results are adjusted to obtain the adjusted key nodes, so as to call the business path flow chart corresponding to the adjusted key nodes. Therefore, the cycle of abnormal detection of the business path flow chart is shortened and the stability of the system is improved.

[0103] The above-mentioned various embodiments of the present disclosure have the following beneficial effects: through the flowchart display method of some embodiments of the present disclosure, the error of the business process diagram is reduced, the response speed of the system when an exception occurs is improved, and the inability to display the flowchart normally is avoided. Specifically, the reason for the large error of the business process diagram, the inability of the system to respond in time when an exception occurs, and the inability to display the flowchart normally is that: because the business path information set is relatively complex and the correlation between them is poor, the generated business process diagram has a large error, and it is easy to have path anomalies between business information, and because the system cannot respond in time when an exception occurs, the construction process of the flowchart is stopped, resulting in the inability to display the flowchart normally. Based on this, the flowchart display method of some embodiments of the present disclosure, first, obtains the message field information corresponding to the business path information set and the log system, wherein each business path information group in the above-mentioned business path information group set is initiated by the same business initiator, and the business path information group in the business path information group set includes: at least one business information corresponding to the path information of different attributes. Thus, it can provide convenience for subsequent processing. Then, in response to determining that at least one business path information group has the same business attribute corresponding to the path information in the business path information group set, at least one business path information group with the same business attribute is aggregated to obtain an aggregated business path information group. Thus, a complex business path information group set can be simplified. Next, a historical business path information group is generated according to the message field information corresponding to the log system. Thus, a historical business path information group can be obtained. Then, the historical business path information group is matched with the aggregated business path information group to obtain a matched result group, wherein the matched result in the matched result group represents a matching consistent result and a matching inconsistent result. Thus, the association relationship between the historical business path information group and the aggregated business path information group can be determined. Afterwards, in response to determining that there is a matched result representing a matching consistent result in the matched result group, the historical business path information group is merged with the aggregated business path information group to obtain a merged business path information group. Finally, a flow chart is constructed for the merged business path information group to obtain a business path flow chart. Thus, the error of the business flow chart can be reduced and the response speed of the system when an abnormality occurs can be improved. The business path flowchart is displayed on the main page corresponding to the log system. Thus, the flowchart cannot be displayed normally. Therefore, the error of the business flow chart is reduced, the response speed of the system is improved when an abnormality occurs, and the flowchart cannot be displayed normally.

[0104] Further references Figure 2 As an implementation of the methods shown in the above figures, the present disclosure provides some embodiments of a flow chart display method. These device embodiments are similar to Figure 1 Corresponding to the method embodiments shown, the device can be specifically applied to various electronic devices.

[0105] like Figure 2 As shown, the flowchart display device 200 of some embodiments includes: an acquisition unit 201, an aggregation unit 202, a generation unit 203, a matching unit 204, a fusion unit 205, a construction unit 206 and a display unit 207. The acquisition unit 201 is configured to acquire the message field information corresponding to the service path information group set and the log system, wherein each service path information group in the above service path information group set is initiated by the same service initiator, and the service path information group in the service path information group set includes: path information corresponding to at least one service information with different attributes; the aggregation unit 202 is configured to, in response to determining that there is at least one service path information group in the above service path information group set whose corresponding path information has the same service attribute, aggregate at least one service path information group with the same service attribute to obtain an aggregated service path information group; the generation unit 203 is configured to generate a historical service path information group according to the message field information corresponding to the above log system. ; The matching unit 204 is configured to match the above-mentioned historical business path information group with the above-mentioned aggregated business path information group to obtain a matched result group, wherein the matched results in the above-mentioned matched result group represent the matched consistent results and the matched inconsistent results; the fusion unit 205 is configured to, in response to determining that there is a matched result representing the matched consistent result in the above-mentioned matched result group, fuse the above-mentioned historical business path information group with the above-mentioned aggregated business path information group to obtain a fused business path information group; the construction unit 206 is configured to construct a flowchart for the above-mentioned fused business path information group to obtain a business path flowchart; the display unit 207 is configured to display the above-mentioned business path flowchart to the main page corresponding to the above-mentioned log system.

[0106] It is understood that the units described in the device 200 are similar to those described in the reference Figure 1 Therefore, the operations, features and beneficial effects described above for the method are also applicable to the device 200 and the units included therein, and will not be described in detail here.

[0107] Reference below Figure 3 , which shows a schematic structural diagram of an electronic device (such as a computing device) 300 suitable for implementing some embodiments of the present disclosure. Figure 3The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0108] like Figure 3 As shown, the electronic device 300 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 301, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 302 or a program loaded from a storage device 308 into a random access memory (RAM) 304. In RAM 303, various programs and data required for the operation of the electronic device 300 are also stored. The processing device 301, ROM 302, and RAM 304 are connected to each other via a bus 304. An input / output (I / O) interface 305 is also connected to the bus 304.

[0109] Typically, the following devices may be connected to the I / O interface 305: input devices 306 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; output devices 307 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; storage devices 308 including, for example, a magnetic tape, a hard disk, etc.; and communication devices 309. The communication devices 309 may allow the electronic device 300 to communicate with other devices wirelessly or by wire to exchange data. Although Figure 3 The electronic device 300 is shown with various devices, but it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed instead. Figure 3 Each block shown in the figure may represent one device, or may represent multiple devices as required.

[0110] In particular, according to some embodiments of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, some embodiments of the present disclosure include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In some such embodiments, the computer program can be downloaded and installed from the network through the communication device 309, or installed from the storage device 308, or installed from the ROM 302. When the computer program is executed by the processing device 301, the functions defined in the method of some embodiments of the present disclosure are executed.

[0111] It should be noted that the computer-readable medium recorded in some embodiments of the present disclosure may be a computer-readable signal medium or a computer-readable storage medium or any combination of the two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In some embodiments of the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that may be used by or in conjunction with an instruction execution system, device or device. In some embodiments of the present disclosure, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, in which a computer-readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. The computer readable signal medium may also be any computer readable medium other than a computer readable storage medium, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer readable medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (radio frequency), etc., or any suitable combination thereof.

[0112] In some embodiments, the client and the server may communicate using any currently known or future developed network protocol such as HTTP (Hyper Text Transfer Protocol), and may be interconnected with any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), an internet (e.g., the Internet), and a peer-to-peer network (e.g., an ad hoc peer-to-peer network), as well as any currently known or future developed network.

[0113] The above-mentioned computer-readable medium may be included in the above-mentioned electronic device; or it may exist independently without being assembled into the electronic device. The above-mentioned computer-readable medium carries one or more programs. When the above-mentioned one or more programs are executed by the electronic device, the electronic device: obtains the message field information corresponding to the service path information group set and the log system, wherein each service path information group in the above-mentioned service path information group set is initiated by the same service initiator, and the service path information group in the service path information group set includes: at least one service information corresponding to a path information with different attributes; in response to determining that there is at least one service path information group in the above-mentioned service path information group set whose corresponding path information has the same service attribute, aggregate at least one service path information group with the same service attribute to obtain an aggregated service path information group; Generate a historical business path information group according to the message field information corresponding to the above-mentioned log system; match the above-mentioned historical business path information group with the above-mentioned aggregated business path information group to obtain a matched result group, wherein the matched results in the above-mentioned matched result group represent the matched consistent results and the matched inconsistent results; in response to determining that there is a matched result representing the matched consistent result in the above-mentioned matched result group, merge the above-mentioned historical business path information group and the above-mentioned aggregated business path information group to obtain a merged business path information group; construct a flowchart for the above-mentioned merged business path information group to obtain a business path flowchart; display the above-mentioned business path flowchart on the main page corresponding to the above-mentioned log system.

[0114] Computer program code for performing the operations of some embodiments of the present disclosure may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0115] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present disclosure. In this regard, each box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flow chart, and the combination of the boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0116] The units described in some embodiments of the present disclosure may be implemented by software or by hardware. The described units may also be provided in a processor, for example, may be described as: a processor comprising: an acquisition unit, an aggregation unit, a generation unit, a matching unit, a fusion unit, a construction unit and a display unit. Among them, the names of these units do not constitute a limitation on the unit itself in certain cases, for example, the generation unit may also be described as "a unit for generating a historical business path information group according to the message field information corresponding to the above-mentioned log system".

[0117] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and the like.

[0118] The above descriptions are only some preferred embodiments of the present disclosure and the explanation of the technical principles used above. Those skilled in the art should understand that the scope of the invention involved in the embodiments of the present disclosure is not limited to the technical solutions formed by the specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the above invention concept. For example, the above features are replaced with the technical features with similar functions disclosed in the embodiments of the present disclosure (but not limited to) and the technical solutions formed.

Claims

1. A flow chart display method, comprising: Acquire message field information corresponding to a service path information group set and a log system, wherein each service path information group in the service path information group set is initiated by the same service initiator, and the service path information group in the service path information group set includes: path information corresponding to at least one service information with different attributes; In response to determining that there is at least one service path information group in the service path information group set whose corresponding path information has the same service attribute, aggregating at least one service path information group with the same service attribute to obtain an aggregated service path information group; Generate a historical service path information group according to the message field information corresponding to the log system; Matching the historical service path information group with the aggregated service path information group to obtain a matched result group, wherein the matched results in the matched result group represent a matched consistent result and a matched inconsistent result; In response to determining that there is a post-matching result representing a consistent matching result in the post-matching result group, fusing the historical service path information group with the post-aggregation service path information group to obtain a fusing service path information group; Constructing a flow chart for the merged service path information group to obtain a service path flow chart; The business path flowchart is displayed on the main page corresponding to the log system.

2. The method according to claim 1, wherein: After, in response to determining that there is a post-matching result representing a consistent matching result in the post-matching result group, fusing the historical service path information group with the post-aggregation service path information group to obtain a fused service path information group, the method further includes: In response to determining that there is a post-matching result representing an inconsistent matching result in the post-matching result group, dividing the at least one historical business path information and the at least one aggregated business path information corresponding to the inconsistent matching result in the post-matching result group by business attributes to obtain a divided business path information group, wherein the divided business path information group can represent that the business attributes between each divided business path information are different; Merging the divided service path information group with the merged service path information group to obtain a target service path information group; Constructing a flow chart for the target service path information group to obtain a target service path flow chart; The target business path flowchart is displayed on the main page corresponding to the log system.

3. The method according to claim 1, wherein: In response to determining that at least one service path information group in the service path information group set has the same service attribute corresponding to the path information, aggregating at least one service path information group with the same service attribute to obtain an aggregated service path information group, comprising: Deduplication of data for at least one service path information group with the same service attribute to obtain a deduplicated service path information group; Data integration is performed on each deduplicated business path information in the deduplicated business path information group to obtain an integrated business path information group as an aggregated business path information group.

4. The method according to claim 1, wherein: After displaying the business path flowchart on a main page corresponding to the log system, the method further includes: Anomaly detection is performed on the business path flowchart to obtain anomaly detection results, and the business path flowchart is called according to the anomaly detection results.

5. The method according to claim 1, wherein: The generating a historical service path information group according to the message field information corresponding to the log system includes: Filtering the message field information corresponding to the log system to obtain filtered message field information, wherein the filtered message field information includes: port number information, address information, and timestamp information; Classifying the historical log data corresponding to the log system into business types to obtain business type groups after classification; According to the port number information and the address information, calling information storage is performed on the service information corresponding to the divided service type group to generate a called stored information group; According to the timestamp information, the post-call storage information group is time-sorted to obtain a post-call storage information time sequence; According to the time sequence of the stored information after the call, the business path information is created for the divided business type groups to obtain business path information groups corresponding to the business types; Aggregating data on multiple service path information corresponding to service types that meet preset aggregation conditions in the service path information group corresponding to the service type to obtain an aggregated service path information group; The aggregated service path information group is deduplicated to obtain a deduplicated service path information group as a historical service path information group.

6. The method according to claim 1, wherein: The matching of the historical service path information group with the aggregated service path information group to obtain a matched result group includes: Performing data format conversion on the historical service path information group and the aggregated service path information group to obtain a converted historical service path information group and a converted service path information group, wherein the data format of the converted historical service path information group and the converted service path information group are consistent; The converted historical business path information group is compared with the converted business path information group under preset multiple matching conditions to obtain a matching result group, wherein the matching result group includes: a business attribute matching result, a timestamp matching result and a path information matching result, the business attribute matching result can represent a business attribute matching consistent result and a business attribute matching inconsistent result, the timestamp matching result can represent a timestamp matching consistent result and a timestamp matching inconsistent result, and the path information matching result can represent a path information matching consistent result and a path information matching inconsistent result.

7. A flow chart display device, comprising: an acquisition unit, configured to acquire a service path information group set and message field information corresponding to a log system, wherein each service path information group in the service path information group set is initiated by the same service initiator, and the service path information group in the service path information group set includes: path information corresponding to at least one service information with different attributes; An aggregation unit is configured to, in response to determining that there is at least one service path information group in the service path information group set whose corresponding path information has the same service attribute, aggregate at least one service path information group with the same service attribute to obtain an aggregated service path information group; A generating unit, configured to generate a historical service path information group according to the message field information corresponding to the log system; A matching unit, configured to match the historical service path information group with the aggregated service path information group to obtain a matched result group, wherein the matched results in the matched result group represent a matched consistent result and a matched inconsistent result; a fusion unit configured to, in response to determining that there is a post-matching result representing a consistent matching result in the post-matching result group, fuse the historical service path information group with the post-aggregation service path information group to obtain a post-fusion service path information group; A construction unit, configured to construct a flow chart for the merged service path information group to obtain a service path flow chart; The display unit is configured to display the business path flowchart on a main page corresponding to the log system.

8. An electronic device comprising: one or more processors; a storage device having one or more programs stored thereon; When the one or more programs are executed by the one or more processors, the one or more processors implement the method according to any one of claims 1 to 6.

9. A computer readable medium having a computer program stored thereon, wherein: When the program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

Images