Fault prediction method, fault prediction model training method, computing device, storage medium, and computer program product

Abstract

The present disclosure provides a fault prediction method, a fault prediction model training method, a computing device, a storage medium, and a computer program product. The fault prediction method comprises: obtaining abnormal log data and unit attribute information of a service processing unit; determining an abnormal event sequence on the basis of the abnormal log data; and inputting the unit attribute information and the abnormal event sequence into a fault prediction model to obtain a fault prediction result of the service processing unit, wherein the fault prediction model is obtained by performing training on the basis of a positive sample, a first sample label corresponding to the positive sample, a negative sample, and a second sample label corresponding to the negative sample, the positive sample comprises a positive sample abnormal event sequence and sample unit attribute information, and the negative sample comprises a negative sample abnormal event sequence and sample unit attribute information. The training data of the fault prediction model is richer, so that the accuracy of prediction results of the fault prediction model during applications is improved.

Description

[0001] Fault Prediction Method, Fault Prediction Model Training Method, Computing Device, Storage Medium, and Computer Program Product TECHNICAL FIELD The present disclosure relates to the field of computer technology, and more particularly to a fault prediction method, a fault prediction model training method, a computing device, a storage medium, and a computer program product. Background: Cloud computing systems enable centralized management and utilization of servers, improving the efficiency of computing resource utilization. For servers managed by cloud computing systems, Node Controller (NC) downtime is a significant factor affecting the stability of cloud computing systems. Unexpected and sudden downtime can cause significant losses to users. To maintain the stability of cloud computing systems, it is generally necessary to predict server failures in cloud computing systems in advance and promptly address them through operational maintenance. Currently, system logs are an important basis for predicting server failures in cloud computing systems. However, server failure prediction based on system logs lacks sufficiency and completeness, resulting in low prediction accuracy. Therefore, an effective technical solution is urgently needed to address the aforementioned issues. SUMMARY OF THE INVENTION In view of this, the present disclosure provides a fault prediction method. One or more embodiments of this specification relate to a fault prediction device, a fault prediction model training method, a fault prediction model training apparatus, a computing device, a computer-readable storage medium, and a computer program product to address technical deficiencies in the prior art. According to a first aspect of this disclosure, a fault prediction method is provided for use in a cloud computing system, the cloud computing system including a service processing unit. The method comprises: obtaining abnormality log data and unit attribute information of the service processing unit; determining an abnormal event sequence based on the abnormality log data; and inputting the unit attribute information and the abnormal event sequence into a fault prediction model to obtain a fault prediction result for the service processing unit. The fault prediction model is trained using positive samples, first sample labels corresponding to the positive samples, and negative samples, second sample labels corresponding to the negative samples. The positive samples include the positive sample abnormal event sequence and the sample unit attribute information, and the negative samples include the negative sample abnormal event sequence and the sample unit attribute information.According to a second aspect of the present disclosure, a fault prediction apparatus is provided, which is applied to a cloud computing system, the cloud computing system including a service processing unit. The method includes: an acquisition module configured to acquire abnormal log data and unit attribute information of the service processing unit; a determination module configured to determine an abnormal event sequence based on the abnormal log data; and an input module configured to input the unit attribute information and the abnormal event sequence into a fault prediction model to obtain a fault prediction result for the service processing unit. The fault prediction model is obtained by training with positive samples, first sample labels corresponding to the positive samples, negative samples, and second sample labels corresponding to the negative samples. The positive samples include positive sample abnormal event sequences and sample unit attribute information, and the negative samples include negative sample abnormal event sequences and the sample unit attribute information. According to a third aspect of the present disclosure, a fault prediction model training method is provided, comprising: obtaining sample abnormality log data and sample unit attribute information of a service processing unit; determining a sample abnormality event sequence based on the sample abnormality log data; determining positive samples and negative samples based on the sample abnormality event sequence and the sample unit attribute information; and training the fault prediction model based on the positive samples, first sample labels corresponding to the positive samples, the negative samples, and second sample labels corresponding to the negative samples until a fault prediction model that satisfies a training stop condition is obtained; wherein the positive samples include the positive sample abnormality event sequence and the sample unit attribute information, and the negative samples include the negative sample abnormality event sequence and the sample unit attribute information. According to a fourth aspect of the present disclosure, a fault prediction model training device is provided, comprising: an acquisition module configured to acquire sample abnormality log data and sample unit attribute information of a service processing unit; a first determination module configured to determine a sample abnormality event sequence based on the sample abnormality log data; a second determination module configured to determine positive samples and negative samples based on the sample abnormality event sequence and the sample unit attribute information; and a training module configured to train the fault prediction model based on the positive samples, the first sample labels corresponding to the positive samples, the negative samples, and the second sample labels corresponding to the negative samples until a fault prediction model that meets a training stop condition is obtained; wherein the positive samples include the positive sample abnormality event sequence and the sample unit attribute information, and the negative samples include the negative sample abnormality event sequence and the sample unit attribute information.According to a fifth aspect of the present disclosure, a computing device is provided, comprising: a memory and a processor; the memory is configured to store a computer program / instructions, and the processor is configured to execute the computer program / instructions. When executed by the processor, the computer program / instructions implement the steps of the aforementioned fault prediction method or fault prediction model training method. According to a sixth aspect of the present disclosure, a computer-readable storage medium is provided, storing a computer program / instructions. When executed by the processor, the computer program / instructions implement the steps of the aforementioned fault prediction method or fault prediction model training method. According to a seventh aspect of the present disclosure, a computer program product is provided, comprising a computer program / instructions. When executed by the processor, the computer program / instructions implement the steps of the aforementioned fault prediction method or fault prediction model training method. One embodiment of this specification provides a fault prediction method, applied to a cloud computing system including a service processing unit. The method comprises: obtaining abnormal log data and unit attribute information of the service processing unit; determining an abnormal event sequence based on the abnormal log data; and inputting the unit attribute information and the abnormal event sequence into a fault prediction model to obtain a fault prediction result for the service processing unit. The fault prediction model is trained using positive samples, first sample labels corresponding to the positive samples, and negative samples, second sample labels corresponding to the negative samples. The positive samples include the positive sample abnormal event sequence and sample unit attribute information, and the negative samples include the negative sample abnormal event sequence and the sample unit attribute information. In the above method, the sample unit attribute information of the service processing unit is taken into account during the training of the fault prediction model. The sample unit attribute information supplements the real-time information in the system log, enriching the training data for the fault prediction model. This allows the fault prediction model to learn abnormal conditions for service processing units with different attribute information, thereby improving the accuracy of the prediction results of the fault prediction model during application.BRIEF DESCRIPTION OF THE DRAWINGS Figure 1 is a schematic diagram of an application scenario of a fault prediction method provided in one embodiment of this specification; Figure 2 is a flow chart of a fault prediction method provided in one embodiment of this specification; Figure 3 is a schematic diagram of the encoding process in a fault prediction method provided in one embodiment of this specification; Figure 4 is a schematic diagram of a fault prediction model in a fault prediction method provided in one embodiment of this specification; Figure 5 is a flow chart of the training process of a fault prediction model in a fault prediction method provided in one embodiment of this specification; Figure 6 is a flow chart of the processing process of a fault prediction method provided in one embodiment of this specification; Figure 7 is a schematic diagram of the structure of a fault prediction device provided in one embodiment of this specification; Figure 8 is a flow chart of a fault prediction model training method provided in one embodiment of this specification; Figure 9 is a schematic diagram of the structure of a fault prediction model training device provided in one embodiment of this specification; Figure 10 is a block diagram of the structure of a computing device provided in one embodiment of this specification. DETAILED DESCRIPTION OF THE EMBODIMENTS The following description sets forth numerous specific details to facilitate a thorough understanding of this specification. However, this specification can be implemented in many other ways than those described herein, and those skilled in the art may make similar generalizations without departing from the scope of this specification. Therefore, this specification is not limited to the specific implementations disclosed below. The terms used in one or more embodiments of this specification are for the purpose of describing specific embodiments only and are not intended to limit the one or more embodiments of this specification. As used in one or more embodiments of this specification and the appended claims, the singular forms "a," "an," "the," and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It should also be understood that the term "and / or" used in one or more embodiments of this specification refers to and encompasses any and all possible combinations of one or more of the associated listed items. It should be understood that while the terms "first," "second," and so on may be employed to describe various information in one or more embodiments of this specification, such information should not be limited to these terms. These terms are used solely to distinguish information of the same type from one another. For example, "first" could be referred to as "second," and similarly, "second" could be referred to as "first," without departing from the scope of one or more embodiments of this specification. Depending on the context, the term "if" as used herein could be interpreted as meaning "when," "when," or "in response to determining."Furthermore, it should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, storage, and display) referred to in one or more embodiments of this specification are all authorized by the user or fully authorized by all parties. Furthermore, the collection, use, and processing of the relevant data must comply with the relevant laws, regulations, and standards of the relevant countries and regions, and corresponding operation portals are provided for users to choose to authorize or deny. In one or more embodiments of this specification, a large model refers to a deep learning model with large-scale model parameters, typically containing hundreds of millions, tens of billions, hundreds of billions, trillions, or even more than ten trillion model parameters. A large model can also be referred to as a foundation model. Pre-training the large model with large-scale unlabeled corpus produces a pre-trained model with more than 100 million parameters. This model is adaptable to a wide range of downstream tasks and has good generalization capabilities, such as a large language model (LLM) or a multi-modal pre-training model. In practical applications, large models only require a small number of samples to fine-tune the pre-trained model and can be applied to various tasks. Large models can be widely used in fields such as natural language processing (NLP) and computer vision. Specifically, they can be applied to computer vision tasks such as visual question answering (VQA), image captioning (IC), and image generation, as well as natural language processing tasks such as text-based sentiment classification, text summarization, and machine translation. Key application scenarios for large models include digital assistants, intelligent robots, search, online education, office software, e-commerce, and intelligent design. First, the terms used in one or more embodiments of this specification are explained.

[0002] Attention: The attention mechanism can be used to devote more attention resources to the target area of ​​focus to obtain more detailed information of the target that needs to be paid attention to and suppress other useless information. In this disclosure, the attention mechanism can usually be used as an interface to provide information on the correlation between elements in the mining sequence.

[0003] Transformer: An Attention-based machine learning model, commonly used in natural language processing and image processing tasks.

[0004] BERT: Bidirectional Encoder Representation from Transformers, bidirectional encoding Transformer model, commonly used in natural language processing and image processing tasks.

[0005] XgBoost: Extreme GradientBoosting, a commonly used ensemble learning algorithm.

[0006] NC: Node Controller, refers to a single unit in a cloud computing system used to count failures and downtimes.

[0007] ECS: Elastic Compute Server, cloud server.

[0008] NLP: Natural Language Processing, natural language processing.

[0009] MoE: Mixture of Experts, a deep learning structure.

[0010] The TAAT model, in the embodiments of this application, is a model based on the BERT model and employing the Transformer algorithm with a time-aware attention mechanism to implement machine learning fault prediction. This specification provides a fault prediction method, as well as a fault prediction device, a fault prediction model training method, a fault prediction model training device, a computing device, a computer-readable storage medium, and a computer program product, each of which is described in detail in the following embodiments. See Figure 1, which illustrates a schematic diagram of an application scenario of a fault prediction method provided according to one embodiment of this specification. As shown in Figure 1, a cloud computing platform 102 and a cloud computing server cluster 104 are included. Cloud computing platform 102 is used to manage cloud computing server cluster 104 and can be used to execute the fault prediction method. Specifically, cloud computing platform 102 can obtain abnormal log data and unit attribute information for each server from cloud computing server cluster 104. For example, for a particular server, an abnormal event sequence is determined based on the server's abnormal log data and unit attribute information. The abnormal event sequence and unit attribute information are then input into a fault prediction model to obtain a fault prediction result for the server. In practical applications, when performing fault prediction, the cloud computing platform 102 can obtain real-time abnormal log data. This collected abnormal log data can be obtained by sampling each server on a real-time link at a preset time interval, such as 5 minutes. Based on the fault prediction model, a prediction is then made regarding whether each server will experience a downtime. Based on the fault prediction result, a decision is made regarding whether to perform maintenance in advance to minimize user downtime, thereby optimizing the user experience. The fault prediction result includes a downtime result and a no-downtime result. A downtime result indicates that the server is at risk of downtime within a certain period of time. In this case, maintenance can be performed in advance to minimize user downtime. A no-downtime result indicates that the server is not at risk of downtime within a certain period of time. In this case, no operation can be performed temporarily. The cloud computing platform 102 can be understood as a service based on hardware resources and software resources, providing computing, network and storage capabilities. In this disclosure, it is used to provide a fault prediction service, which predicts whether a server will crash by obtaining abnormal log data of the server.The servers in the cloud computing server cluster 104 can be understood as servers that provide various services, including physical servers and cloud servers. For example, servers that provide communication services to multiple clients, servers that support background training for models used on clients, and servers that process data sent by clients. Referring to FIG2 , FIG2 shows a flowchart of a fault prediction method according to one embodiment of this specification, which is applied to a cloud computing system including a service processing unit. The method specifically includes the following steps: Step 202: Obtain abnormality log data and unit attribute information of the service processing unit. Specifically, the fault prediction method provided by this disclosure can be applied to a cloud computing system that can be used to manage multiple servers. A service processing unit can be understood as any server in the cloud computing system. In practical applications, a service processing unit can be, for example, an NC. The abnormality log data of the service processing unit can be understood as the abnormality log of the service processing unit detected by a detector. Unit attribute information can be understood as the attribute information of a service processing unit. This attribute information is static and inherent and does not change. Unit attribute information includes at least one of the following: the service processing unit's brand information, memory information, memory manufacturer information, CPU manufacturer information, server manufacturer information, etc. Based on this, a detector can be used to obtain abnormal log data reported by a service processing unit in real time, and static information fields can be extracted from the service processing unit to obtain the unit attribute information of the service processing unit. In one embodiment of this specification, real-time system log data can be obtained. This real-time system log data can be obtained by sampling each service processing unit on a real-time link at preset time intervals, such as 5 minutes or 10 seconds. It is understood that a cloud computing system may include multiple service processing units, and abnormal log data and unit attribute information can be obtained for each service processing unit. Furthermore, each service processing unit may include multiple abnormal log data. For example, abnormal log data A1, A2, and A3 for service processing unit A can be obtained. OStep 204: Determine an abnormal event sequence based on the abnormal log data. Specifically, after obtaining the abnormal log data from the service processing unit, the abnormal event sequence can be determined based on the abnormal log data. An abnormal event sequence can be understood as a sequence consisting of multiple abnormal events. In specific implementations, determining the abnormal event sequence based on the abnormal log data includes: processing the abnormal information in the abnormal log data to determine the abnormal event corresponding to the abnormal information; determining the event identifier corresponding to the abnormal event based on a matching relationship between reference abnormal events and reference event identifiers in an abnormal event library; and sorting the event identifiers corresponding to the abnormal events based on the abnormal occurrence time corresponding to the abnormal events to generate the abnormal event sequence. Abnormal events include, but are not limited to, cloud computing system crash events, hardware abnormality events, memory abnormality events, etc. The abnormal event library can be pre-built, similar to a corpus in natural language processing. The abnormal event library can include all types of abnormal events, and each reference abnormal event in the abnormal event library corresponds to a reference event identifier. The reference event identifier can be represented by numbers, letters, or other characters. For example, a reference event identifier can be represented by a number, such as a downtime event represented by the number 1 and a hardware anomaly time represented by the number 2. The exception occurrence time corresponding to the exception event can be determined based on the exception log data. Based on this, the exception information recorded in the exception log data can be processed to determine the exception event corresponding to the exception information. Based on the matching relationship between the reference exception events and the reference event identifiers in the exception event library, the event identifier corresponding to the exception event can be determined. The event identifiers corresponding to the exception event can be sorted based on the exception occurrence time corresponding to the exception event, thereby generating an exception event sequence. In a specific implementation, processing the exception information in the exception log data to determine the exception event corresponding to the exception information includes: abstracting the exception information in the exception log data based on a regular expression to determine the exception event corresponding to the exception information. In practical applications, the exception log data can be mapped to the exception event. In a specific implementation, the mapping process of the exception log data can be performed by mapping the exception log data to the exception event using a regular expression. Specifically, the exception log data can be abstracted into a phrase based on expert knowledge and the regular expression, and the abstracted phrase can be used as the exception event. For example, for one abnormal log data, keywords common to the abnormal log data and other abnormal log data can be determined, and these abnormal log data can be divided into different abnormal categories according to the types of keywords, thereby obtaining phrases for naming abnormal events.It is understandable that the abstracted exception events can be unified descriptions of the same type of exception log data. Continuing with the above example, for example, if the exception log data A1 of service processing unit A is "mce: [Hardware Error]: Machine check events logged," and the exception information recorded in this exception log data is a hardware error, then the exception information recorded in this exception log data can be processed to obtain the exception event A1 corresponding to this exception information as "dmesg_unrecover_mce." Based on the matching relationship between the reference exception events and reference event identifiers in the exception event library, the event identifier corresponding to exception event A1 is determined to be "2." Similarly, if the event identifier of exception event A2 corresponding to exception log data A2 is determined to be "1," and the event identifier of exception event A3 corresponding to exception log data A3 is determined to be "4," then the event identifiers corresponding to the exception events A1, A2, and A3 can be sorted according to the occurrence time of the exceptions, resulting in the exception event sequence "1, 4, 2." Furthermore, it is also possible to pre-collect various exception logs, process the exception information in the exception logs, construct corresponding exception events, and then perform encoding operations on the constructed exception events with corresponding numerical identifiers, thereby pre-building an exception event library for various exception events. Specifically, the exception event library can contain reference event identifiers for various exception events. This allows subsequent data pre-processing of the exception logs to be constructed based on a separate exception event library, eliminating the complex process of pre-training the fault prediction model to encode the exception log text. This encoding process, based on "abnormal log data to abnormal events to event identifiers," reduces the model size, accelerates training and testing, and replaces the original encoding process. In summary, by abstracting and simplifying the exception information into an abnormal event sequence, when the abnormal event sequence is input into the fault prediction model, the complex process of encoding the abnormal information text is simplified, reducing the size of the fault prediction model and reducing the storage space required by the computer system. In another embodiment of this specification, the event identifier corresponding to the abnormal event can also be determined based on the order in which the abnormal events occurred within a preset time period. For example, if abnormal event A occurs for the first time within a preset time period, the event ID corresponding to abnormal event A is 1; if abnormal event B occurs for the second time within a preset time period, the event ID corresponding to abnormal event B is 2. OBy determining the event identifier in the order of exception occurrence, there is no need to pre-set the matching relationship between the reference exception event and the reference event identifier, saving computing time and storage resources. Alternatively, the event identifier corresponding to the exception event can also be determined according to the event type of the exception event. The present disclosure does not limit this. Referring to FIG. 3, FIG. 3 shows a schematic diagram of the encoding process in a fault prediction method provided according to an embodiment of the present specification. As shown in FIG. 3, the event identifier of the exception event is 2, and the encoded vector obtained by encoding it is 巳【2】. The event identifier of the exception event is 1, and the encoded vector obtained by encoding it is 巳【1】. The event identifier of the exception event is 9, and the encoded vector obtained by encoding it is 巳【9】. The event identifier of the exception event is 30, and the encoded vector obtained by encoding it is 巳

[0030] . The unit attribute information of the service processing unit includes unit attribute information 1, 2, 3, and 4. One-hot encoding is performed on unit attribute information 1, and the obtained encoded vector is 0010. One-hot encoding is performed on unit attribute information 2, and the obtained encoded vector is 010. One-hot encoding is performed on unit attribute information 3, and the obtained encoded vector is 100. One-hot encoding is performed on unit attribute information 4, and the obtained encoded vector is 10 oTherefore, when inputting the abnormal event sequence and unit attribute information into the fault prediction model, the encoded abnormal event sequence and unit attribute information obtained through the above encoding process can be input into the fault prediction model. In summary, since the abnormal log data contains statements describing the computer status and contains a lot of redundant information, abstract processing of the abnormal log data can extract key information therein. The abnormal log data can also be selectively filtered, for example, by selecting abnormal log data with an Error field (i.e., an error field) for parsing. Furthermore, sorting the event identifiers corresponding to the abnormal events according to the abnormal occurrence time corresponding to the abnormal events to generate the abnormal event sequence includes: sorting the event identifiers corresponding to the abnormal events according to the abnormal occurrence time corresponding to the abnormal events using a preset sorting rule, and generating the abnormal time series based on the sorted event identifiers. The preset sorting rule can be understood as a rule for sorting the event identifiers according to the abnormal occurrence time. For example, the preset sorting rule can be a rule for sorting the event identifiers according to the abnormal occurrence time. Specifically, the event identifiers can be sorted in reverse order based on the anomaly occurrence time corresponding to the abnormal events. When predicting faults, abnormal events corresponding to anomaly occurrence times closer to the current moment are generally more relevant. Therefore, the event identifiers corresponding to the abnormal events are sorted in reverse order based on the anomaly occurrence time, thereby generating an abnormal event sequence based on the reverse order of the anomaly occurrence time. Furthermore, abnormal information often has a correlation; that is, abnormal information at a previous moment can cause another abnormal information at a later moment. By sorting the event identifiers (which can actually also be understood as abnormal information) based on the anomaly occurrence time, the fault prediction model can better utilize the contextual semantic information of the abnormal information to predict faults in the service processing unit. In summary, sorting the event identifiers corresponding to abnormal events according to preset sorting rules strengthens the correlation between abnormal events in the abnormal event sequence, allowing the fault prediction model to better utilize the contextual semantic information of the abnormal events. Step 206: Input the unit attribute information and the abnormal event sequence into a fault prediction model to obtain a fault prediction result of the service processing unit; wherein the fault prediction model is obtained by training positive samples, first sample labels corresponding to the positive samples, negative samples, and second sample labels corresponding to the negative samples; the positive samples include positive sample abnormal event sequences and sample unit attribute information; and the negative samples include negative sample abnormal event sequences and the sample unit attribute information.Specifically, the unit attribute information and abnormal event sequence of the service processing unit can be input into a fault prediction model. The fault prediction model can perform fault prediction based on the input unit attribute information and abnormal event sequence, predicting whether the cloud computing system will experience a failure. Based on the prediction results, the model can determine whether to perform operations and maintenance for the cloud computing system failure in advance, thereby minimizing user downtime and optimizing the user experience. In practical applications, NC downtime is a key factor affecting the stability of cloud computing systems. Unexpected and sudden downtime can cause serious losses to users. To maintain the stability of the cloud computing system, the fault prediction model can perform fault prediction based on the input unit attribute information and abnormal event sequence, inferring whether the current NC of the cloud computing system will experience downtime within the next period of time, and outputting a fault prediction result. The fault prediction result can include a downtime result and a no-downtime result. The downtime result can be understood as a prediction that the service processing unit is at risk of downtime within a certain period of time. In this case, operations and maintenance can be performed in advance to minimize user downtime. The no-downtime result can be understood as a prediction that the service processing unit is not at risk of downtime within a certain period of time. In this case, no operations will be performed temporarily. In one embodiment of this specification, when inputting unit attribute information into a fault prediction model, an encoding vector of the unit attribute information may be input into the fault prediction model. Specifically, inputting the unit attribute information and the abnormal event sequence into the fault prediction model to obtain a fault prediction result for the service processing unit includes: inputting the unit attribute information and the abnormal event sequence into the fault prediction model to obtain a confidence level output by the fault prediction model; and determining, based on the confidence level and a preset confidence threshold, whether the fault prediction result for the service processing unit is a downtime result or a non-downtime result. Specifically, the unit attribute information and the abnormal event sequence may be input into the fault prediction model. Within the fault prediction model, a target processing layer may be determined from multiple processing layers included in the fault prediction model based on the unit attribute information. The abnormal event sequence may be processed based on the target processing layer to obtain a confidence level output by the fault prediction model. If the confidence level is greater than the preset confidence threshold, the fault prediction result for the service processing unit is determined to be a downtime result. If the confidence level is less than the preset confidence threshold, the fault prediction result for the service processing unit is determined to be a non-downtime result.In practical applications, the fault prediction model includes a coding layer, a gating layer, and multiple processing layers. Accordingly, inputting the unit attribute information and the abnormal event sequence into the fault prediction model to obtain a fault prediction result for the service processing unit includes: inputting the abnormal event sequence into the coding layer to obtain abnormal event sequence features; inputting the unit attribute information into the gating layer, and using the gating layer to determine a target processing layer among the multiple processing layers; and inputting the abnormal event sequence features into the target processing layer to obtain a fault prediction result for the service processing unit. Specifically, in the fault prediction model, the abnormal event sequence can be encoded using the coding layer to obtain abnormal event sequence features, and the target processing layer can be determined from the multiple processing layers based on the unit attribute information using the gating layer. The target processing layer can then perform feature processing on the abnormal event sequence features to obtain a fault prediction result for the service processing unit. In summary, fault prediction for service processing units is achieved by using the gating layer to determine the target processing layer, the encoding layer to encode the abnormal event sequence, and the target processing layer to process the encoded abnormal event sequence features. The selection of the target processing layer takes into account the relationships between different service processing units and processing layers, ensuring targeted fault prediction and further improving the accuracy of fault prediction results. In a specific implementation, inputting the unit attribute information into the gating layer and using the gating layer to determine the target processing layer among the multiple processing layers includes: inputting the unit attribute information features into the gating layer, calculating the first attention weight of each processing layer using the gating layer; and determining the target processing layer among the multiple processing layers based on the first attention weights of each processing layer. Accordingly, after using the gating layer to determine the target processing layer among the multiple processing layers, the method further includes: determining a target first attention weight corresponding to the target processing layer based on the first attention weights of each processing layer, and sending the target first attention weight to the target processing layer. Specifically, the gating layer can be used to calculate the first attention weight for each processing layer. Based on the first attention weights of each processing layer, a target attention layer can be determined. The target first attention weight corresponding to the target processing layer can also be sent to the target processing layer. In summary, calculating the first attention weights facilitates determining the target processing layer that is most suitable for processing the characteristics of the abnormal event sequence. The target first attention weights are then sent to the target processing layer, allowing the target processing layer to subsequently process the characteristics of the abnormal event sequence based on the target first attention weights.In addition, the fault prediction model also includes an attention mechanism layer. Before inputting the abnormal event sequence features into the target processing layer to obtain a fault prediction result for the service processing unit, the method further includes: inputting the abnormal event sequence features into the attention mechanism layer, using the attention mechanism layer to calculate a second attention weight corresponding to the abnormal event sequence features; and sending the second attention weight to the target processing layer. Inputting the abnormal event sequence features into the target processing layer to obtain a fault prediction result for the service processing unit includes: processing the abnormal event sequence features based on the target first attention weight and the second attention weight to obtain a fault prediction result for the service processing unit. For a specific implementation, see Figure 4, which shows a schematic diagram of a fault prediction model in a fault prediction method provided in one embodiment of this specification. In practical applications, fault prediction models include a gating layer (i.e., static gates) and multiple processing layers (i.e., TAAT models). Each TAAT model includes an encoding layer (i.e., exception embedding), an attention mechanism layer (i.e., multi-head exception attention), a feature processing layer (i.e., MTA block), and a classifier (i.e., classifier). As shown in Figure 4, since the encoding layer, attention mechanism layer, and classifier structures of each TAAT model are identical, to simplify the model structure and reduce the memory resources occupied by the model, the encoding layer, attention mechanism layer, and classifier can be shared within each TAAT model. Figure 4 shows the encoding layer, attention mechanism layer, multiple feature processing layers, and classifier. These multiple feature processing layers can be used to implement feature processing for multiple TAAT models. In a specific implementation, the unit attribute information (including unit attribute information 1, 2, 3, and 4) of the service processing unit can be input into the gating layer, which can then be used to determine a target feature processing layer from among multiple feature processing layers. The gating layer can calculate the first attention weights of the multiple feature processing layers using a fully connected layer and softmax based on the unit attribute information and weight matrix of the service processing unit. The gating layer can then determine the target feature processing layer from among the multiple feature processing layers based on the first attention weights of the multiple feature processing layers, and send the first attention weight of each feature processing layer to the corresponding feature processing layer.The weight matrix can be understood as a matrix containing the initial attention weights of multiple feature processing layers. This weight matrix can be subsequently adjusted to enable the gating layer to determine the appropriate target feature processing layer from the multiple feature processing layers during application. In other words, the target feature processing layer determined by the gating layer can be understood as the target TAAT model (i.e., target processing layer) determined by the gating layer. After the gating layer determines the target feature processing layer, the abnormal event sequence of the service processing unit can be input into the encoding layer to obtain the abnormal event sequence features output by the encoding layer. These abnormal event sequence features are then input into the attention mechanism layer. The attention mechanism layer can divide the forward fully connected layer into multiple fully connected layers, calculate the second attention weight corresponding to the abnormal event sequence features, and then perform a weighted average based on the first and second attention weights through the target feature processing layer to output a predicted feature corresponding to the abnormal event sequence features. This predicted feature is then input into the classifier to obtain the confidence level of the service processing unit. This facilitates the subsequent determination of the fault prediction result for the service processing unit based on the confidence level and a preset confidence threshold. In practical applications, a fault prediction model including three feature processing layers (i.e., three feature processing layers included in the TAAT model) is used as an example for illustration. The gating layer can calculate the first attention weight of feature processing layer 1, the first attention weight of feature processing layer 2, and the first attention weight of feature processing layer 3 based on the input unit attribute information and weight matrix of the service processing unit, and send the first attention weight of feature processing layer 1 to feature processing layer 1, the first attention weight of feature processing layer 2 to feature processing layer 2, and the first attention weight of feature processing layer 3 to feature processing layer 3. For feature processing layer 1, the abnormal event sequence of the service processing unit is input into the encoding layer to obtain the abnormal event sequence features output by the encoding layer. The abnormal event sequence features are input into the attention mechanism layer, and the second attention weight corresponding to the abnormal event sequence features is calculated. Feature processing layer 1 outputs the predicted features corresponding to the abnormal event sequence features based on the second attention weight. Correspondingly, feature processing layers 2 and 3 also output predicted features. Therefore, feature processing layers 1, 2, and 3 can be respectively evaluated based on the first attention weights corresponding to feature processing layers 1, 2, and 3. The prediction features output by steps 2 and 3 are weighted and averaged to obtain the target prediction feature. This target prediction feature is then input into the classifier to obtain the confidence level of the service processing unit. In summary, the fault prediction model is used to predict faults for the service processing unit, thereby enabling fault prediction for the cloud computing system and maintaining its stability.In practical applications, refer to FIG5 , which illustrates a flow chart of the fault prediction model training process in a fault prediction method according to one embodiment of this specification. As shown in FIG5 , the fault prediction model training steps include: Step 502: Obtaining sample abnormality log data and sample unit attribute information of a service processing unit. Specifically, the sample abnormality log data and sample unit attribute information of the service processing unit can be obtained in real time via a detector. The specific acquisition process is similar to the aforementioned acquisition process of abnormality log data and unit attribute information, and will not be repeated in this disclosure. Step 504: Determining a sample abnormal event sequence based on the sample abnormality log data. In specific implementations, determining a sample abnormal event sequence based on the sample abnormality log data includes: processing sample abnormality information in the sample abnormality log data to determine sample abnormal events corresponding to the sample abnormality information; determining sample event identifiers corresponding to the sample abnormal events based on a matching relationship between reference abnormal events and reference event identifiers in an abnormal event library; and sorting the sample event identifiers corresponding to the sample abnormal events based on the abnormality occurrence time corresponding to the sample abnormal events to generate the sample abnormal event sequence. Specifically, the sample abnormality information recorded in the sample abnormality log data can be processed to determine the sample abnormality event corresponding to the sample abnormality information. Based on the matching relationship between the reference abnormality events and the reference event identifiers in the abnormality event library, the sample event identifiers corresponding to the sample abnormality events can be determined. The sample event identifiers corresponding to the sample abnormality events can be sorted according to the abnormality occurrence time corresponding to the sample abnormality events, thereby generating a sample abnormality event sequence. The specific process for generating the sample abnormality event sequence here is similar to the specific process for generating the abnormality event sequence described above, and will not be repeated here. In actual applications, processing the sample abnormality information in the sample abnormality log data to determine the sample abnormality event corresponding to the sample abnormality information includes: abstracting the sample abnormality information in the sample abnormality log data according to a regular expression, and determining the sample abnormality event corresponding to the sample abnormality information. Specifically, determining the sample abnormality event here is similar to the process for determining the abnormal event described above, and will not be repeated here. Specifically, the sorting of sample event identifiers corresponding to the sample abnormal events according to the abnormality occurrence times corresponding to the sample abnormal events to generate the sample abnormal event sequence includes: sorting the sample event identifiers corresponding to the sample abnormal events according to the abnormality occurrence times corresponding to the sample abnormal events using a preset sorting rule, and generating the sample abnormal event sequence according to the sorted sample event identifiers.Specifically, the process of generating a sample abnormal event sequence here is similar to the process of generating an abnormal event sequence described above and will not be repeated here. Step 506: Determine positive and negative samples based on the sample abnormal event sequence and the sample unit attribute information. In specific implementations, determining positive samples based on the sample abnormal event sequence and the sample unit attribute information includes: sampling the sample abnormal event sequence based on a sampling time interval and a sampling time length to obtain a positive sample abnormal event sequence; and using the positive sample abnormal event sequence and the sample unit attribute information as the positive sample. The sample abnormal event sequence can be understood as an abnormal event sequence determined from sample abnormality log data when a service processing unit experiences a downtime. The preset sampling time can be understood as a preset sampling time interval; the preset sampling length can be understood as a preset sampling window length; and the preset negative sample sampling rule can be understood as a rule for randomly acquiring samples proportionally from the sample abnormal event sequence. Specifically, when obtaining positive samples, the sample abnormal event sequence can be sampled with overlapping sampling at 5-minute intervals and a 3-day sampling window length, thereby obtaining a positive sample abnormal event sequence. In practical applications, a sliding window approach is employed, with a subsequence of all abnormal events within the previous 72 hours (i.e., 3 days) calculated starting at each 5-minute time point. For example, the first sampling window begins at time A and ends at time B (72 hours before time A). The window then shifts forward 5 minutes, with the second sampling window starting at time C (5 minutes before time A), also covering the previous 72 hours, and so on. In one embodiment of the present specification, the sample abnormal event sequence can be sampled according to a preset negative sample sampling rule to obtain a negative sample abnormal event sequence. The negative sample abnormal event sequence and the sample unit attribute information are used as negative samples. A negative sample abnormal event sequence can be understood as an abnormal event sequence determined from sample abnormality log data when the service processing unit does not experience downtime. The preset negative sample sampling rule can be understood as sampling according to a preset sampling ratio. Specifically, abnormal events can be randomly obtained from the sample abnormal event sequence according to the preset sampling ratio to determine the negative sample abnormal event sequence. In summary, the constructed positive and negative samples can help the fault prediction model fully learn and distinguish between the downtime and non-downtime states of the service processing unit, thereby improving the prediction accuracy and generalization ability of the fault prediction model in practical applications.Step 508: Train the fault prediction model based on the positive samples, the first sample labels corresponding to the positive samples, the negative samples, and the second sample labels corresponding to the negative samples until a fault prediction model that meets a training stop condition is obtained. The training stop condition can be understood as the model loss reaching a preset loss value threshold or the number of model training cycles reaching a preset number threshold. For example, the first sample label can be represented by 1, and the second sample label can be represented by 0. Specifically, the positive samples, the first sample labels, the negative samples, and the second sample labels can be input into the fault prediction model to obtain first prediction results corresponding to the positive samples and second prediction results corresponding to the negative samples, output by the fault prediction model. A first model loss value is calculated based on the first sample labels and the first prediction results. A second model loss value is calculated based on the second prediction results and the second sample labels. The fault prediction model is trained based on the first and second model loss values. In a specific implementation, the fault prediction model includes a coding layer, a gating layer, and multiple processing layers; accordingly, the fault prediction model is trained according to the positive sample, the first sample label corresponding to the positive sample, the negative sample, and the second sample label corresponding to the negative sample until a fault prediction model that meets the training stop condition is obtained, including: inputting the positive sample abnormal event sequence into the coding layer to obtain positive sample abnormal event sequence features; inputting the sample unit attribute information into the gating layer, and using the gating layer to determine the target processing layer among the multiple processing layers; inputting the positive sample abnormal event sequence features into the target processing layer to obtain a first prediction result corresponding to the positive sample abnormal event sequence features; and inputting the negative sample abnormal event sequence into the coding layer to obtain negative sample abnormal event sequence features; inputting the sample unit attribute information into the gating layer, and using the gating layer to determine the target processing layer among the multiple processing layers; inputting the negative sample abnormal event sequence features into the target processing layer to obtain a second prediction result corresponding to the negative sample abnormal event sequence features; and The fault prediction model is trained using the first sample labels and the second sample labels until a fault prediction model that meets the training termination criteria is obtained. Specifically, the processing during the fault prediction model training phase is similar to the processing during the aforementioned fault prediction model application phase and will not be further described here. In summary, by incorporating static information such as unit attribute information into both positive and negative samples, and utilizing both real-time and static information from service processing units, the data source is enriched, making the model more accurate.In a specific implementation, inputting the sample unit attribute information features into the gating layer and determining a target processing layer from the multiple processing layers using the gating layer includes: inputting the sample unit attribute information features into the gating layer, calculating the first attention weight of each processing layer using the gating layer; and determining the target processing layer from the multiple processing layers based on the first attention weights of each processing layer. Accordingly, after determining the target processing layer from the multiple processing layers using the gating layer, the method further includes: determining a target first attention weight corresponding to the target processing layer from the first attention weights of each processing layer, and sending the target first attention weight to the target processing layer. The first attention weight can be understood as the attention weight of the processing layer. Specifically, as shown in FIG4 , the gating layer can calculate the first attention weights of multiple feature processing layers using a fully connected layer and softmax based on the unit attribute information and weight matrix of the service processing unit. The gating layer can then determine the target feature processing layer from the multiple feature processing layers based on the first attention weights of the multiple feature processing layers, and send the target first attention weight of the target feature processing layer to the target feature processing layer. In addition, the gating layer can also send the first attention weights of other feature processing layers to the other feature processing layers. In summary, by calculating the first attention weight of each processing layer, the target processing layer is selected, allowing the model to specifically select the processing layer that processes the abnormal event sequence. Furthermore, the fault prediction model also includes an attention mechanism layer. Before inputting the negative abnormal event sequence features into the target processing layer and obtaining the second prediction result corresponding to the negative abnormal event sequence features, the method further includes: inputting the negative abnormal event sequence features into the attention mechanism layer, calculating the negative second attention weight corresponding to the negative abnormal event sequence features using the attention mechanism layer; and sending the negative second attention weight to the target processing layer. Inputting the negative abnormal event sequence features into the target processing layer and obtaining the second prediction result corresponding to the negative abnormal event sequence features includes: processing the negative abnormal event sequence features according to the target first attention weight and the negative second attention weight to obtain the second prediction result corresponding to the negative abnormal event sequence features.Furthermore, before inputting the positive sample abnormal event sequence features into the target processing layer to obtain a first prediction result corresponding to the positive sample abnormal event sequence features, the method further includes: inputting the positive sample abnormal event sequence features into the attention mechanism layer, and using the attention mechanism layer to calculate a positive sample second attention weight corresponding to the positive sample abnormal event sequence features; and sending the positive sample second attention weight to the target processing layer. Inputting the positive sample abnormal event sequence features into the target processing layer to obtain a first prediction result corresponding to the positive sample abnormal event sequence features includes: processing the positive sample abnormal event sequence features according to the target first attention weight and the positive sample second attention weight to obtain the first prediction result corresponding to the positive sample abnormal event sequence features. The target first attention weight can be understood as the attention weight of the target processing layer. The second attention weight can be understood as the attention weight of the sample abnormal event sequence features. Therefore, the positive sample second attention weight can be understood as the attention weight of the positive sample abnormal event sequence features. The negative sample second attention weight can be understood as the attention weight of the negative sample abnormal event sequence features. Specifically, as described in FIG4 , after the gating layer determines the target feature processing layer, the negative sample abnormal event sequence of the service processing unit can be input into the encoding layer to obtain the negative sample abnormal event sequence features output by the encoding layer. The negative sample abnormal event sequence features are then input into the attention mechanism layer. The attention mechanism layer can divide the forward fully connected layer into multiple fully connected layers, calculate the negative sample second attention weight corresponding to the negative sample abnormal event sequence features, and perform a weighted average based on the first attention weight and the negative sample second attention weight through the target feature processing layer. The predicted features are then output as prediction features corresponding to the negative sample abnormal event sequence features. This prediction feature is then input into the classifier to obtain the confidence level of the service processing unit. This facilitates the subsequent determination of the fault prediction result (i.e., the second prediction result) for the service processing unit based on the confidence level and a preset confidence threshold. It is understood that the process of obtaining the first prediction result corresponding to the positive sample abnormal event sequence features is similar to the process of obtaining the second prediction result described above, and will not be repeated here. In summary, the hybrid expert model calculates attention weights for each abnormal event sequence, thereby analyzing the samples in a targeted manner, enabling the model to integrate information for downtime prediction.In summary, the above method takes into account the sample unit attribute information of the service processing unit during the training of the fault prediction model. This sample unit attribute information supplements the real-time information in the system log, enriching the training data for the fault prediction model. This allows the fault prediction model to learn abnormal situations specific to service processing units with different attribute information, thereby improving the accuracy of the prediction results during application. The following, combined with FIG6 , further illustrates the fault prediction method provided in this specification using the application of the fault prediction method in fault prediction model training as an example. FIG6 illustrates a flowchart of the processing process of a fault prediction method provided in one embodiment of this specification, specifically including the following steps: Step 602: Obtain sample abnormality log data and sample unit attribute information of the service processing unit. Specifically, sample abnormality log data and sample unit attribute information (i.e., static information) of the NC (i.e., the service processing unit) can be obtained. Step 604: Process the sample abnormality information in the sample abnormality log data to determine the sample abnormal event corresponding to the sample abnormality information. Specifically, the sample abnormal log data can be analyzed based on regular expressions. uThe sample abnormality information recorded in "mce: [Hardware Error]: Machine check events logged" is abstracted to a sample abnormality event "dmesg_unrecover_mce" corresponding to the sample abnormality information. Step 606: Determine the sample event identifier corresponding to the sample abnormality event based on the matching relationship between the reference abnormal event and the reference event identifier in the abnormal event library. Specifically, the sample event identifier "32" corresponding to the sample abnormality event "dmesg_unrecover_mce" can be determined based on the matching relationship between the reference abnormal event and the reference event identifier in the pre-built abnormal event library. Step 608: Sort the sample event identifiers corresponding to the sample abnormality events based on the abnormality occurrence time corresponding to the sample abnormality events to generate the sample abnormality event sequence. Specifically, the sample event identifier corresponding to each sample abnormality event can be sorted in reverse order based on the abnormality occurrence time of multiple sample abnormality times to obtain the sample abnormality event sequence. Step 610: Sample the sample abnormality event sequence based on the sampling time interval and the sampling time length. A positive sample abnormal event sequence is obtained, and the positive sample abnormal event sequence and the sample unit attribute information are used as positive samples. Specifically, the sample abnormal event sequence can be sampled based on a sampling time interval of 5 minutes and a sampling time length of 3 days. When the sampling time is a downtime, the sample abnormal event sequence 3 days before the sampling time is obtained as the positive sample abnormal event sequence, and the positive sample abnormal event sequence and the sample unit attribute information are used as positive samples. Step 612: According to the preset negative sample sampling rule, the sample abnormal event sequence is sampled to obtain a negative sample abnormal event sequence, and the negative sample abnormal event sequence and the sample unit attribute information are used as negative samples. Specifically, the sample abnormal event sequence can be randomly sampled to obtain a sample abnormal event sequence 3 days before the sampling time as the negative sample abnormal event sequence, and the negative sample abnormal event sequence and the sample unit attribute information are used as negative samples. Alternatively, the sample abnormal event sequence can be sampled based on a sampling time interval of 5 minutes and a sampling time length of 3 days, and the sample abnormal event sequence can be sampled based on a sampling time interval of 5 minutes and a sampling time length of 3 days, and the sample abnormal event sequence can be sampled when the sampling time is not a downtime. The abnormal event sequence of samples from the three days prior to the sampling time is used as the negative abnormal event sequence. Step 614: Train the fault prediction model based on the positive samples, the first sample labels corresponding to the positive samples, the negative samples, and the second sample labels corresponding to the negative samples until a fault prediction model that meets the training stop condition is obtained.Specifically, the fault prediction model may be trained based on positive samples, first sample labels 1 corresponding to the positive samples, negative samples, and second sample labels 0 corresponding to the negative samples, until a fault prediction model that meets the training stop condition is obtained. In a specific implementation, the positive sample abnormal event sequence can be input into the encoding layer to obtain positive sample abnormal event sequence features; the sample unit attribute information can be input into the gating layer, and the gating layer can be used to determine a target processing layer among the multiple processing layers; the positive sample abnormal event sequence features can be input into the target processing layer to obtain a first prediction result corresponding to the positive sample abnormal event sequence features; and the negative sample abnormal event sequence can be input into the encoding layer to obtain negative sample abnormal event sequence features; the sample unit attribute information can be input into the gating layer, and the gating layer can be used to determine the target processing layer among the multiple processing layers; the negative sample abnormal event sequence features can be input into the target processing layer to obtain a second prediction result corresponding to the negative sample abnormal event sequence features; and the fault prediction model can be trained based on the first prediction result, the second prediction result, the first sample label, and the second sample label until a fault prediction model that meets the training stop condition is obtained. In summary, the above method takes into account the sample unit attribute information of the service processing unit during the training of the fault prediction model. This sample unit attribute information supplements the real-time information in the system log, enriching the training data for the fault prediction model. This enables the fault prediction model to learn abnormal conditions specific to service processing units with different attribute information, thereby improving the accuracy of the fault prediction model's prediction results during application. Corresponding to the above method embodiments, this specification also provides an embodiment of a fault prediction device. Figure 7 shows a schematic structural diagram of a fault prediction device provided in one embodiment of this specification. As shown in FIG7 , the apparatus includes: an acquisition module 702 configured to acquire abnormal log data and unit attribute information of the service processing unit; a determination module 704 configured to determine an abnormal event sequence based on the abnormal log data; and an input module 706 configured to input the unit attribute information and the abnormal event sequence into a fault prediction model to obtain a fault prediction result for the service processing unit. The fault prediction model is obtained by training with positive samples, first sample labels corresponding to the positive samples, negative samples, and second sample labels corresponding to the negative samples. The positive samples include positive sample abnormal event sequences and sample unit attribute information, and the negative samples include negative sample abnormal event sequences and the sample unit attribute information.In an optional embodiment, the fault prediction model includes a coding layer, a gating layer, and multiple processing layers. Accordingly, the input module 706 is further configured to: input the abnormal event sequence into the coding layer to obtain abnormal event sequence features; input the unit attribute information into the gating layer, and use the gating layer to determine a target processing layer among the multiple processing layers; and input the abnormal event sequence features into the target processing layer to obtain a fault prediction result for the service processing unit. In an optional embodiment, the input module 706 is further configured to: input the unit attribute information features into the gating layer, and use the gating layer to calculate a first attention weight for each processing layer; and determine a target processing layer among the multiple processing layers based on the first attention weights of each processing layer. Accordingly, after determining the target processing layer among the multiple processing layers using the gating layer, the method further includes: determining a target first attention weight corresponding to the target processing layer based on the first attention weights of each processing layer, and sending the target first attention weight to the target processing layer. In an optional embodiment, the fault prediction model further includes an attention mechanism layer; the input module 706 is further configured to: input the abnormal event sequence features into the attention mechanism layer, calculate a second attention weight corresponding to the abnormal event sequence features using the attention mechanism layer, and send the second attention weight to the target processing layer; and inputting the abnormal event sequence features into the target processing layer to obtain a fault prediction result for the service processing unit includes: processing the abnormal event sequence features based on the target first attention weight and the second attention weight to obtain a fault prediction result for the service processing unit. In an optional embodiment, the input module 706 is further configured to: input the unit attribute information and the abnormal event sequence into the fault prediction model to obtain a confidence level output by the fault prediction model; and determine whether the fault prediction result for the service processing unit is a downtime result or a non-downtime result based on the confidence level and a preset confidence threshold. In an optional embodiment, the determination module 704 is further configured to: process the abnormal information in the abnormal log data to determine the abnormal event corresponding to the abnormal information; determine the event identifier corresponding to the abnormal event based on the matching relationship between the reference abnormal event and the reference event identifier in the abnormal event library; and sort the event identifiers corresponding to the abnormal events according to the abnormal occurrence time corresponding to the abnormal event to generate the abnormal event sequence.In an optional embodiment, the determination module 704 is further configured to: abstract the abnormal information in the abnormal log data according to a regular expression to determine the abnormal event corresponding to the abnormal information. In an optional embodiment, the determination module 704 is further configured to: sort the event identifiers corresponding to the abnormal events according to the abnormal occurrence time corresponding to the abnormal events using a preset sorting rule, and generate the abnormal event sequence based on the sorted event identifiers. In an optional embodiment, the apparatus further includes a training module configured to: obtain sample abnormal log data and sample unit attribute information of the service processing unit; determine a sample abnormal event sequence based on the sample abnormal log data; determine the positive sample and the negative sample based on the sample abnormal event sequence and the sample unit attribute information; and train the fault prediction model based on the positive sample, the first sample label corresponding to the positive sample, the negative sample, and the second sample label corresponding to the negative sample until a fault prediction model that meets the training stop condition is obtained. In an optional embodiment, the fault prediction model includes an encoding layer, a gating layer, and multiple processing layers; accordingly, the training module is further configured to: input the positive sample abnormal event sequence into the encoding layer to obtain positive sample abnormal event sequence features; input the sample unit attribute information into the gating layer, and use the gating layer to determine a target processing layer among the multiple processing layers; input the positive sample abnormal event sequence features into the target processing layer to obtain a first prediction result corresponding to the positive sample abnormal event sequence features; and input the negative sample abnormal event sequence into the encoding layer to obtain negative sample abnormal event sequence features; input the sample unit attribute information into the gating layer, and use the gating layer to determine the target processing layer among the multiple processing layers; input the negative sample abnormal event sequence features into the target processing layer to obtain a second prediction result corresponding to the negative sample abnormal event sequence features; and train the fault prediction model based on the first prediction result, the second prediction result, the first sample label, and the second sample label until a fault prediction model that meets a training stop condition is obtained.In an optional embodiment, the training module is further configured to: input the sample unit attribute information characteristics into the gating layer, and use the gating layer to calculate the first attention weight of each processing layer; determine the target processing layer among the multiple processing layers based on the first attention weight of each processing layer; accordingly, after using the gating layer to determine the target processing layer among the multiple processing layers, it also includes: determining the target first attention weight corresponding to the target processing layer from the first attention weights of each processing layer, and sending the target first attention weight to the target processing layer. In an optional embodiment, the fault prediction model also includes an attention mechanism layer; the training module is further configured to: input the negative sample abnormal event sequence features into the attention mechanism layer, and use the attention mechanism layer to calculate the negative sample second attention weight corresponding to the negative sample abnormal event sequence features; send the negative sample second attention weight to the target processing layer; inputting the negative sample abnormal event sequence features into the target processing layer to obtain the second prediction result corresponding to the negative sample abnormal event sequence features, including: processing the negative sample abnormal event sequence features according to the target first attention weight and the negative sample second attention weight to obtain the second prediction result corresponding to the negative sample abnormal event sequence features. In an optional embodiment, the training module is further configured to: input the positive sample abnormal event sequence features into the attention mechanism layer, calculate the positive sample second attention weight corresponding to the positive sample abnormal event sequence features using the attention mechanism layer; and send the positive sample second attention weight to the target processing layer; and inputting the positive sample abnormal event sequence features into the target processing layer to obtain a first prediction result corresponding to the positive sample abnormal event sequence features includes: processing the positive sample abnormal event sequence features based on the target first attention weight and the positive sample second attention weight to obtain the first prediction result corresponding to the positive sample abnormal event sequence features. In an optional embodiment, the training module is further configured to: process the sample abnormality information in the sample abnormality log data to determine the sample abnormal event corresponding to the sample abnormality information; determine the sample event identifier corresponding to the sample abnormal event based on the matching relationship between the reference abnormal event and the reference event identifier in the abnormal event library; and sort the sample event identifiers corresponding to the sample abnormal events based on the abnormality occurrence time corresponding to the sample abnormal events to generate the sample abnormal event sequence.In an optional embodiment, the training module is further configured to: abstract the sample anomaly information in the sample anomaly log data according to a regular expression to determine the sample anomaly events corresponding to the sample anomaly information. In an optional embodiment, the training module is further configured to: sort the sample event identifiers corresponding to the sample anomaly events according to the anomaly occurrence time corresponding to the sample anomaly events using a preset sorting rule, and generate the sample anomaly event sequence based on the sorted sample event identifiers. In an optional embodiment, the training module is further configured to: sample the sample anomaly event sequence according to a sampling time interval and a sampling time length to obtain a positive sample anomaly event sequence; and use the positive sample anomaly event sequence and the sample unit attribute information as the positive sample. In summary, in the above-described device, during the training of the fault prediction model, the attribute information of the sample units of the service processing units is taken into account. This information supplements the real-time information in the system log, enriching the training data for the fault prediction model. This allows the fault prediction model to learn abnormalities specific to service processing units with different attribute information, thereby improving the accuracy of the prediction results of the fault prediction model during application. The above is a schematic diagram of a fault prediction device according to this embodiment. It should be noted that the technical solution of this fault prediction device and the technical solution of the above-described fault prediction method are based on the same concept. For details not described in detail in the technical solution of the fault prediction device, please refer to the description of the technical solution of the above-described fault prediction method. Corresponding to the above-described method embodiment, see Figure 8 , which shows a flow chart of a fault prediction model training method according to one embodiment of this specification, specifically comprising the following steps. Step 802: Obtain sample abnormality log data and sample unit attribute information of the service processing unit; Step 804: Determine a sample abnormality event sequence based on the sample abnormality log data; Step 806: Determine positive samples and negative samples based on the sample abnormality event sequence and the sample unit attribute information; Step 808: Train the fault prediction model based on the positive samples, the first sample labels corresponding to the positive samples, the negative samples, and the second sample labels corresponding to the negative samples until a fault prediction model that meets the training stop condition is obtained; wherein the positive samples include the positive sample abnormality event sequence and the sample unit attribute information, and the negative samples include the negative sample abnormality event sequence and the sample unit attribute information.In summary, in the above method, during the training of the fault prediction model, the attribute information of the sample units of the service processing units is taken into account. This attribute information supplements the real-time information in the system log, enriching the training data for the fault prediction model. This allows the fault prediction model to learn abnormal conditions specific to service processing units with different attribute information, thereby improving the accuracy of the prediction results of the fault prediction model during application. The above is a schematic diagram of a fault prediction model training method according to this embodiment. It should be noted that the technical solution of this fault prediction model training method and the technical solution of the above-mentioned fault prediction method are based on the same concept. For details not described in detail in the technical solution of the fault prediction model training method, please refer to the description of the technical solution of the above-mentioned fault prediction method. Corresponding to the above-mentioned method embodiment, this specification also provides an embodiment of a fault prediction model training device. Figure 9 shows a schematic structural diagram of a fault prediction model training device according to one embodiment of this specification. As shown in Figure 9, the apparatus includes: an acquisition module 902, configured to acquire sample abnormality log data and sample unit attribute information of a service processing unit; a first determination module 904, configured to determine a sample abnormality event sequence based on the sample abnormality log data; a second determination module 906, configured to determine the positive sample and the negative sample based on the sample abnormality event sequence and the sample unit attribute information; a training module 908, configured to train the fault prediction model based on the positive sample, the first sample label corresponding to the positive sample, the negative sample, and the second sample label corresponding to the negative sample, until a fault prediction model that meets a training stop condition is obtained; wherein the positive sample includes a positive sample abnormal event sequence and sample unit attribute information, and the negative sample includes a negative sample abnormal event sequence and the sample unit attribute information. In summary, in the above-described apparatus, the fault prediction model training process takes into account the sample unit attribute information of the service processing unit. This sample unit attribute information supplements the real-time information in the system log, enriching the training data for the fault prediction model. This enables the fault prediction model to learn abnormal conditions specific to service processing units with different attribute information, thereby improving the accuracy of the fault prediction model's prediction results during application. The above is a schematic diagram of a fault prediction model training apparatus according to this embodiment. It should be noted that the technical solution of this fault prediction model training apparatus and the technical solution of the above-described fault prediction method share the same concept. For details not described in detail in the technical solution of the fault prediction model training apparatus, reference can be made to the description of the technical solution of the above-described fault prediction method.FIG10 illustrates a block diagram of a computing device 1000 according to one embodiment of this specification. Components of computing device 1000 include, but are not limited to, a memory 1010 and a processor 1020. Processor 1020 and memory 1010 are connected via a bus 1030. A database 1050 is used to store data. Computing device 1000 also includes an access device 1040 that enables computing device 1000 to communicate via one or more networks 1060. Examples of these networks include a combination of a public switched telephone network (PSTN), a local area network (LAN), a wide area network (WAN), a personal area network (PAN), or a communication network such as the Internet. The access device 1040 may include one or more of any type of wired or wireless network interface (e.g., a network interface card (NIC)), such as an IEEE 802.11 wireless local area network (WLAN) wireless interface, a Worldwide Interoperability for Microwave Access (Wi-MAX) interface, an Ethernet interface, a Universal Serial Bus (USB) interface, a cellular network interface, a Bluetooth interface, a Near Field Communication (NFC) interface, and the like. In one embodiment of the present application, the aforementioned components of the computing device 1000 and other components not shown in FIG. 10 may also be connected to each other, for example, via a bus. It should be understood that the computing device structure block diagram shown in FIG. 10 is for illustrative purposes only and does not limit the scope of the present application. Those skilled in the art may add or replace other components as needed.Computing device 1000 can be any type of stationary or mobile computing device, including a mobile computer or mobile computing device (e.g., a tablet computer, personal digital assistant, laptop computer, notebook computer, netbook, etc.), a mobile phone (e.g., a smartphone), a wearable computing device (e.g., a smartwatch, smart glasses, etc.), or other types of mobile devices, or a stationary computing device such as a desktop computer or personal computer (PC). Computing device 1000 can also be a mobile or stationary server. Processor 1020 is configured to execute the following computer-executable instructions, which, when executed by the processor, implement the steps of the aforementioned fault prediction method or fault prediction model training method. The various embodiments in this specification are described in a progressive manner. References can be made to the common and similar parts between the various embodiments. Each embodiment focuses on the differences from other embodiments. In particular, the computing device embodiment, because it is substantially similar to the fault prediction method or fault prediction model training method embodiment, is described briefly. For relevant details, reference can be made to the description of the fault prediction method or fault prediction model training method embodiment. One embodiment of this specification also provides a computer-readable storage medium storing a computer program / instructions. When executed by a processor, these computer program / instructions implement the steps of the aforementioned fault prediction method or fault prediction model training method. The various embodiments in this specification are described in a progressive manner. Similar or identical parts between the various embodiments can be referenced to each other. Each embodiment focuses on the differences from other embodiments. In particular, the computer-readable storage medium embodiment is generally similar to the fault prediction method or fault prediction model training method embodiment, so the description is relatively simple. For relevant parts, reference can be made to the description of the fault prediction method or fault prediction model training method embodiment. One embodiment of this specification also provides a computer program product, including a computer program / instructions. When executed by a processor, these computer program / instructions implement the steps of the aforementioned fault prediction method or fault prediction model training method. The above is an illustrative embodiment of a computer program product of this embodiment. It should be noted that the technical solution of this computer program product shares the same concept as the technical solution of the aforementioned fault prediction method or fault prediction model training method. Details not described in detail in the technical solution of the computer program product can be found in the description of the technical solution of the aforementioned fault prediction method or fault prediction model training method. While the foregoing description describes certain embodiments of the present disclosure, other embodiments are within the scope of the following claims.In some cases, the actions or steps recited in the claims can be performed in a different order than that described in the embodiments and still achieve the desired results. Furthermore, the processes depicted in the drawings do not necessarily require the specific or sequential order shown to achieve the desired results. In certain embodiments, multitasking and parallel processing are also possible or may be advantageous. The computer instructions include computer program code, which may be in source code form, object code form, executable files, or some intermediate form. The computer-readable medium may include any entity or device capable of carrying the computer program code, recording media, USB flash drives, removable hard drives, magnetic disks, optical disks, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunication signals, and software distribution media. It should be noted that the content of the computer-readable medium may be appropriately increased or decreased based on the requirements of patent practice. For example, in some regions, according to patent practice, computer-readable media do not include electrical carrier signals or telecommunication signals. It should be noted that, for ease of description, the aforementioned method embodiments are presented as a series of actions. However, those skilled in the art should understand that the present disclosure is not limited by the order of the actions described, as certain steps may be performed in a different order or simultaneously, according to the present disclosure. Furthermore, those skilled in the art should also understand that the embodiments described in this specification are preferred embodiments, and the actions and modules described are not necessarily required for the present disclosure. In the above embodiments, the description of each embodiment has its own emphasis. For portions not described in detail in a particular embodiment, reference should be made to the relevant descriptions of other embodiments. The preferred embodiments disclosed above are merely intended to help illustrate this specification. The optional embodiments do not describe all details in detail, nor do they limit the invention to the specific implementation methods described. Obviously, many modifications and variations are possible based on the content of this disclosure. This specification selects and describes these embodiments in detail to better explain the principles and practical applications of the present disclosure, thereby enabling those skilled in the art to better understand and utilize this specification. This specification is limited only by the claims and their full scope and equivalents.

Claims

24 Claims 1. A fault prediction method, applied to a cloud computing system, wherein the cloud computing system includes a service processing unit, and comprising: Obtaining abnormal log data and unit attribute information of the service processing unit; Determining an abnormal event sequence according to the abnormal log data; The unit attribute information and the abnormal event sequence are input into a fault prediction model to obtain a fault prediction result of the service processing unit. The fault prediction model is obtained by training positive samples, first sample labels corresponding to the positive samples, negative samples, and second sample labels corresponding to the negative samples. The positive samples include positive sample abnormal event sequences and sample unit attribute information, and the negative samples include negative sample abnormal event sequences and the sample unit attribute information.

2. The fault prediction method according to claim 1, wherein the fault prediction model comprises a coding layer, a gating layer, and multiple processing layers; accordingly, inputting the unit attribute information and the abnormal event sequence into the fault prediction model to obtain a fault prediction result for the service processing unit comprises: Inputting the abnormal event sequence into the coding layer to obtain abnormal event sequence features; The unit attribute information is input into the gating layer, and a target processing layer is determined among the multiple processing layers using the gating layer; the abnormal event sequence feature is input into the target processing layer to obtain a fault prediction result of the service processing unit.

3. The fault prediction method according to claim 2, wherein inputting the unit attribute information into the gating layer and using the gating layer to determine a target processing layer among the plurality of processing layers comprises: Inputting the unit attribute information features into the gating layer, and using the gating layer to calculate the first attention weight of each processing layer; determining a target processing layer among the plurality of processing layers according to the first attention weights of the respective processing layers; Correspondingly, after using the gating layer to determine the target processing layer among the multiple processing layers, the method further includes: determining a target first attention weight corresponding to the target processing layer from the first attention weights of the processing layers, and sending the target first attention weight to the target processing layer.

4. The fault prediction method according to claim 3, wherein the fault prediction model further comprises an attention mechanism layer; and before inputting the abnormal event sequence features into the target processing layer to obtain the fault prediction result of the service processing unit, the method further comprises: Inputting the abnormal event sequence features into the attention mechanism layer, and using the attention mechanism layer to calculate a second attention weight corresponding to the abnormal event sequence features; Sending the second attention weight to the target processing layer; Inputting the abnormal event sequence feature into the target processing layer to obtain the fault prediction result of the service processing unit includes: The abnormal event sequence feature is processed according to the target first attention weight and the second attention weight to obtain a fault prediction result of the service processing unit.

5. The fault prediction method according to claim 1, wherein determining the abnormal event sequence based on the abnormal log data comprises: Processing the abnormal information in the abnormal log data to determine the abnormal event corresponding to the abnormal information; According to the matching relationship between the reference abnormal events and the reference event identifiers in the abnormal event library, the event identifiers corresponding to the abnormal events are determined; according to the abnormal occurrence time corresponding to the abnormal events, the event identifiers corresponding to the abnormal events are sorted to generate the abnormal event sequence.

6. The fault prediction method according to claim 5, wherein the processing of the abnormal information in the abnormal log data to determine the abnormal event corresponding to the abnormal information comprises: Abstract the abnormal information in the abnormal log data according to the regular expression to determine the abnormal event corresponding to the abnormal information.

7. The fault prediction method according to claim 5, wherein the generating the abnormal event sequence by sorting the event identifiers corresponding to the abnormal events according to the abnormal occurrence times corresponding to the abnormal events comprises: According to the abnormal occurrence time corresponding to the abnormal event, the event identifiers corresponding to the abnormal event are sorted using a preset sorting rule, and the abnormal event sequence is generated according to the sorted event identifiers.

8. The fault prediction method according to claim 1, wherein inputting the unit attribute information and the abnormal event sequence into a fault prediction model to obtain a fault prediction result of the service processing unit comprises: Inputting the unit attribute information and the abnormal event sequence into a fault prediction model to obtain a confidence level of an output of the fault prediction model; According to the confidence level and a preset confidence threshold, it is determined whether the fault prediction result of the service processing unit is a downtime result or a no-downtime result.

9. The fault prediction method according to claim 1, wherein the step of training the fault prediction model comprises: Acquire sample abnormality log data and sample unit attribute information of the service processing unit; Determining a sample abnormal event sequence according to the sample abnormal log data; The positive sample and the negative sample are determined based on the sample abnormal event sequence and the sample unit attribute information; and the fault prediction model is trained based on the positive sample, the first sample label corresponding to the positive sample, the negative sample, and the second sample label corresponding to the negative sample until a fault prediction model that meets a training stop condition is obtained.

10. The fault prediction method according to claim 9, wherein the fault prediction model comprises a coding layer, a gating layer, and a plurality of processing layers; accordingly, the fault prediction model is trained according to the positive sample, the first sample label corresponding to the positive sample, the negative sample, and the second sample label corresponding to the negative sample until a fault that meets the training stop condition is obtained. The fault prediction model comprises: inputting the positive sample abnormal event sequence into the encoding layer to obtain positive sample abnormal event sequence features; inputting the sample unit attribute information into the gating layer, and determining a target processing layer among the multiple processing layers using the gating layer; Inputting the positive sample abnormal event sequence feature into the target processing layer to obtain a first prediction result corresponding to the positive sample abnormal event sequence feature; and inputting the negative sample abnormal event sequence into the encoding layer to obtain negative sample abnormal event sequence features; Inputting the sample unit attribute information into the gating layer, and using the gating layer to determine the target processing layer among the multiple processing layers; Inputting the negative sample abnormal event sequence feature into the target processing layer to obtain a second prediction result corresponding to the negative sample abnormal event sequence feature; and training the fault prediction model based on the first prediction result, the second prediction result, the first sample label, and the second sample label until a fault prediction model that meets a training stop condition is obtained.

11. The fault prediction method according to claim 10, wherein inputting the attribute information characteristics of the sample unit into the gating layer and using the gating layer to determine a target processing layer among the plurality of processing layers comprises: Inputting the attribute information features of the sample unit into the gating layer, and using the gating layer to calculate the first attention weight of each processing layer; determining a target processing layer among the plurality of processing layers according to the first attention weights of the respective processing layers; Correspondingly, after using the gating layer to determine the target processing layer among the multiple processing layers, the method further includes: determining a target first attention weight corresponding to the target processing layer from the first attention weights of the processing layers, and sending the target first attention weight to the target processing layer.

12. The fault prediction method according to claim 11, wherein the fault prediction model further comprises an attention mechanism layer; and before inputting the negative sample abnormal event sequence features into the target processing layer to obtain the second prediction result corresponding to the negative sample abnormal event sequence features, the method further comprises: Inputting the negative sample abnormal event sequence features into the attention mechanism layer, and using the attention mechanism layer to calculate the negative sample second attention weight corresponding to the negative sample abnormal event sequence features; Sending the negative sample second attention weight to the target processing layer; Inputting the negative sample abnormal event sequence feature into the target processing layer to obtain a second prediction result corresponding to the negative sample abnormal event sequence feature includes: processing the negative sample abnormal event sequence feature according to the target first attention weight and the negative sample second attention weight to obtain the second prediction result corresponding to the negative sample abnormal event sequence feature.

13. The fault prediction method according to claim 12, further comprising:

27. Inputting the positive sample abnormal event sequence feature into the attention mechanism layer, and using the attention mechanism layer to calculate the positive sample second attention weight corresponding to the positive sample abnormal event sequence feature; Sending the second attention weight of the positive sample to the target processing layer; Inputting the positive sample abnormal event sequence feature into the target processing layer to obtain the first prediction result corresponding to the positive sample abnormal event sequence feature includes: processing the positive sample abnormal event sequence feature according to the target first attention weight and the positive sample second attention weight to obtain the first prediction result corresponding to the positive sample abnormal event sequence feature.

14. The fault prediction method according to claim 9, wherein determining a sample abnormal event sequence based on the sample abnormal log data comprises: Processing the sample abnormality information in the sample abnormality log data to determine the sample abnormality event corresponding to the sample abnormality information; Determine the sample event identifier corresponding to the sample abnormal event based on the matching relationship between the reference abnormal event and the reference event identifier in the abnormal event library; and sort the sample event identifiers corresponding to the sample abnormal event based on the abnormal occurrence time corresponding to the sample abnormal event to generate the sample abnormal event sequence.

15. The fault prediction method according to claim 14, wherein the processing of the sample abnormality information in the sample abnormality log data to determine the sample abnormality event corresponding to the sample abnormality information comprises: According to the regular expression, the sample abnormality information in the sample abnormality log data is abstracted to determine the sample abnormality event corresponding to the sample abnormality information.

16. The fault prediction method according to claim 14, wherein the generating the sample abnormal event sequence by sorting the sample event identifiers corresponding to the sample abnormal events according to the abnormality occurrence times corresponding to the sample abnormal events comprises: sorting the sample event identifiers corresponding to the sample abnormal events according to the abnormality occurrence times corresponding to the sample abnormal events using a preset sorting rule, and generating the sample abnormal event sequence according to the sorted sample event identifiers.

17. The fault prediction method according to claim 9, wherein determining a positive sample based on the sample abnormal event sequence and the sample unit attribute information comprises: Sampling the sample abnormal event sequence according to a sampling time interval and a sampling time length to obtain a positive sample abnormal event sequence; The positive sample abnormal event sequence and the sample unit attribute information are used as the positive sample.

18. A fault prediction model training method, comprising: Obtaining sample exception log data and sample unit attribute information of the service processing unit; Determining a sample abnormal event sequence according to the sample abnormal log data; Determining positive samples and negative samples according to the sample abnormal event sequence and the sample unit attribute information; 28. Training the fault prediction model according to the positive samples, the first sample labels corresponding to the positive samples, the negative samples, and the second sample labels corresponding to the negative samples until a fault prediction model that meets a training stop condition is obtained; The positive sample includes a positive sample abnormal event sequence and sample unit attribute information, and the negative sample includes a negative sample abnormal event sequence and the sample unit attribute information.

19. A computing device comprising: Memory and processor; The memory is used to store computer programs / instructions, and the processor is used to execute the computer programs / instructions. When the computer program / instructions are executed by the processor, the steps of the method according to any one of claims 1 to 18 are implemented.

20. A computer-readable storage medium storing a computer program / instruction, wherein the computer program / instruction, when executed by a processor, implements the steps of the method according to any one of claims 1 to 18.

21. A computer program product comprising a computer program / instructions, which, when executed by a processor, implements the steps of the method according to any one of claims 1 to 18.

Images