Fault prediction method and apparatus, fault prediction model training method and apparatus, and computing device, computer storage medium and computer program product

Abstract

Provided in the present disclosure are a fault prediction method and apparatus, a fault prediction model training method and apparatus, and a computing device, a computer storage medium and a computer program product. The fault prediction method is applied to a cloud computing system, wherein the cloud computing system comprises a service processing unit. The fault prediction method comprises: acquiring anomaly log data of a service processing unit and a log acquisition time of the anomaly log data; on the basis of the anomaly log data and the log acquisition time, determining an anomaly event sequence and an anomaly timestamp sequence; on the basis of a time interval threshold and anomaly occurrence times corresponding to anomaly events in the anomaly event sequence, grouping the anomaly events to obtain an anomaly group sequence; and on the basis of the anomaly event sequence, the anomaly timestamp sequence, and the anomaly group sequence, using a fault prediction model to obtain a fault prediction result of the service processing unit. Anomaly log data is analyzed from multiple dimensions, thereby improving the prediction accuracy of a fault prediction model, and improving the stability of a cloud computing system.

Description

[0001] Fault Prediction Method and Apparatus, Fault Prediction Model Training Method and Apparatus, Computing Device, Computer Storage Medium, and Computer Program Product TECHNICAL FIELD The present disclosure relates to the field of computer technology, and more particularly to a fault prediction method and apparatus, a fault prediction model training method and apparatus, computing device, computer storage medium, and computer program product. Background Cloud computing systems enable centralized management and utilization of servers, thereby improving the efficiency of computing resource utilization. However, server downtime can reduce the stability of cloud computing systems and, in severe cases, lead to user information loss, impacting the user experience. Therefore, predicting downtime in advance and implementing maintenance based on server anomaly log data is key to solving this problem. Because the corpus of existing natural language processing methods does not contain real-world time information, and because anomaly log data can contain multiple types of anomalies, and the time intervals between anomalies are not fixed, analyzing anomaly log data using natural language processing methods can easily lead to overlooking or misjudging the time-related information in the anomaly log data. Consequently, it is difficult to accurately predict server downtime using natural language processing methods, which is detrimental to maintaining the stability of cloud computing systems. SUMMARY OF THE INVENTION In view of this, the present disclosure provides a fault prediction method. One or more embodiments of this specification simultaneously relate to a fault prediction apparatus, a fault prediction model training method, a fault prediction model training apparatus, a computing device, a computer-readable storage medium, and a computer program product to address technical deficiencies in the prior art. According to a first aspect of this disclosure, a fault prediction method is provided for use in a cloud computing system, the cloud computing system including a service processing unit. The method comprises: obtaining abnormal log data and a log acquisition time of the abnormal log data from the service processing unit; determining an abnormal event sequence and an abnormal timestamp sequence based on the abnormal log data and the log acquisition time; grouping the abnormal events in the abnormal event sequence based on a time interval threshold and the abnormal occurrence times corresponding to the abnormal events to obtain an abnormal group sequence; and obtaining a fault prediction result for the service processing unit using a fault prediction model based on the abnormal event sequence, the abnormal timestamp sequence, and the abnormal group sequence.According to a second aspect of the present disclosure, a fault prediction device is provided, which is applied to a cloud computing system, the cloud computing system including a service processing unit, and the device including: a data acquisition module, configured to acquire abnormal log data of the service processing unit and a log acquisition time of the abnormal log data; a sequence determination module, configured to determine an abnormal event sequence and an abnormal timestamp sequence based on the abnormal log data and the log acquisition time; a sequence acquisition module, configured to group the abnormal events in the abnormal event sequence according to a time interval threshold and the abnormal occurrence time corresponding to the abnormal events, to obtain an abnormal group sequence; and a result acquisition module, configured to acquire a fault prediction result of the service processing unit using a fault prediction model based on the abnormal event sequence, the abnormal timestamp sequence, and the abnormal group sequence. According to a third aspect of the present disclosure, a fault prediction model training method is provided, which is applied to a cloud computing system, the cloud computing system including a service processing unit, the method including: obtaining sample abnormality log data of the service processing unit and a sample log acquisition time of the sample abnormality log data; determining a sample abnormality event sequence and a sample abnormality timestamp sequence based on the sample abnormality log data and the sample log acquisition time of the sample abnormality log data; grouping the sample abnormality events based on the time interval threshold and the sample abnormality occurrence times corresponding to the sample abnormality events in the sample abnormality event sequence to obtain a sample abnormality grouping sequence; determining positive samples and negative samples based on the sample abnormality event sequence, the sample abnormality timestamp sequence, and the sample abnormality grouping sequence; and training a fault prediction model based on the positive samples, the sample labels corresponding to the positive samples, the negative samples, and the sample labels corresponding to the negative samples.According to a fourth aspect of the present disclosure, a fault prediction model training device is provided, which is applied to a cloud computing system, the cloud computing system including a service processing unit, and the device including: a data acquisition module, configured to acquire sample abnormality log data of the service processing unit and a sample log acquisition time of the sample abnormality log data; a sequence determination module, configured to determine a sample abnormality event sequence and a sample abnormality timestamp sequence based on the sample abnormality log data and the sample log acquisition time of the sample abnormality log data; a sequence acquisition module, configured to group the sample abnormality events in the sample abnormality event sequence according to the time interval threshold and the sample abnormality occurrence time corresponding to the sample abnormality events, to obtain a sample abnormality grouping sequence; a sample determination module, configured to determine positive samples and negative samples based on the sample abnormality event sequence, the sample abnormality timestamp sequence, and the sample abnormality grouping sequence; and a training module, configured to train and acquire a fault prediction model based on the positive samples, the sample labels corresponding to the positive samples, the negative samples, and the sample labels corresponding to the negative samples. According to a fifth aspect of the present disclosure, a computing device is provided, comprising: a memory and a processor; the memory is configured to store a computer program / instructions, and the processor is configured to execute the computer program / instructions. When executed by the processor, the computer program / instructions implement the steps of the aforementioned fault prediction method or fault prediction model training method. According to a sixth aspect of the present disclosure, a computer-readable storage medium is provided, storing a computer program / instructions. When executed by the processor, the computer program / instructions implement the steps of the aforementioned fault prediction method or fault prediction model training method. According to a seventh aspect of the present disclosure, a computer program product is provided, comprising a computer program / instructions. When executed by the processor, the computer program / instructions implement the steps of the aforementioned fault prediction method or fault prediction model training method. A fault prediction method provided in one embodiment of the present specification is applied to a cloud computing system, wherein the cloud computing system includes a service processing unit. The method includes: obtaining abnormal log data of the service processing unit and a log acquisition time of the abnormal log data; determining an abnormal event sequence and an abnormal timestamp sequence based on the abnormal log data and the log acquisition time; grouping the abnormal events in the abnormal event sequence based on a time interval threshold and the abnormal occurrence time corresponding to the abnormal events to obtain an abnormal group sequence; and obtaining a fault prediction result for the service processing unit using a fault prediction model based on the abnormal event sequence, the abnormal timestamp sequence, and the abnormal group sequence.Based on this, the fault prediction method obtains abnormal log data from the service processing unit and the log acquisition time of the abnormal log data to determine the abnormal event sequence and the abnormal timestamp sequence. The abnormal events are then grouped according to their time intervals to obtain the abnormal group sequence. When abnormal events occurring at similar times are more correlated, the abnormal event sequence, abnormal timestamp sequence, and abnormal group sequence are input into the fault prediction model. This allows the fault prediction model to analyze the abnormal log data from multiple dimensions and obtain the event correlation and time correlation between the abnormalities in the abnormal log data. This improves the fault prediction model's fault prediction accuracy and recall rate, enabling the cloud computing system to predict downtime in advance and perform timely operation and maintenance, reducing downtime rates and improving the stability of the cloud computing system. BRIEF DESCRIPTION OF THE DRAWINGS Figure 1 is a schematic diagram of a fault prediction method according to one embodiment of this specification; Figure 2 is a flow chart of a fault prediction method according to one embodiment of this specification; Figure 3 is a flow chart of a fault prediction model training method according to one embodiment of this specification; Figure 4 is a flow chart of the processing process of a fault prediction model training method according to one embodiment of this specification; Figure 5 is a schematic diagram of a data preprocessing process according to one embodiment of this specification; Figure 6 is a schematic diagram of a code mapping process according to one embodiment of this specification; Figure 7 is a schematic diagram of the structure of a fault prediction device according to one embodiment of this specification; Figure 8 is a schematic diagram of the structure of a fault prediction model training device according to one embodiment of this specification; and Figure 9 is a block diagram of a computing device according to one embodiment of this specification. DETAILED DESCRIPTION The following description sets forth numerous specific details to facilitate a thorough understanding of this specification. However, this specification can be implemented in many other ways than those described herein, and those skilled in the art may make similar generalizations without departing from the scope of this specification. Therefore, this specification is not limited to the specific implementations disclosed below. The terminology used in one or more embodiments of this specification is for the purpose of describing specific embodiments only and is not intended to limit this specification. As used in one or more embodiments of this specification and the appended claims, the singular forms "a," "an," "the," and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It should also be understood that the term "and / or" used in one or more embodiments of this specification refers to and encompasses any and all possible combinations of one or more of the associated listed items. It should be understood that while the terms "first," "second," and so on may be used to describe various information in one or more embodiments of this specification, such information should not be limited to these terms. These terms are merely used to distinguish information of the same type from one another.For example, without departing from the scope of one or more embodiments of this specification, the first may also be referred to as the second, and similarly, the second may also be referred to as the first. Depending on the context, the term "if" as used herein may be interpreted as "at the time of," "when," or "in response to a determination." Furthermore, it should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, and displayed data, etc.) referred to in one or more embodiments of this specification are all authorized by the user or fully authorized by all parties. The collection, use, and processing of such data must comply with the relevant laws, regulations, and standards of the relevant countries and regions, and corresponding operation portals are provided for users to choose to authorize or deny. In one or more embodiments of this specification, a large model refers to a deep learning model with large-scale model parameters, typically containing hundreds of millions, tens of billions, hundreds of billions, trillions, or even more than ten trillion model parameters. Large models, also known as foundation models, are pre-trained on large-scale unlabeled corpora to produce pre-trained models with over 100 million parameters. These models are adaptable to a wide range of downstream tasks and have good generalization capabilities. Examples include Large Language Model I (LLM) and multimodal pre-training model I. In practical applications, large models only require a small number of samples to fine-tune the pre-trained model and can be applied to different tasks. Large models can be widely used in fields such as natural language processing (NLP) and computer vision. Specifically, they can be applied to computer vision tasks such as visual question answering (VQA), image description (IC), and image generation, as well as natural language processing tasks such as text-based sentiment classification, text summarization, and machine translation. The main application scenarios of large models include digital assistants, intelligent robots, search, online education, office software, e-commerce, and intelligent design. First, the terms used in one or more embodiments of this specification are explained.

[0002] Attention: The attention mechanism can be used to invest more attention resources in the target area of ​​focus to obtain more detailed information of the target that needs attention and suppress other useless information. In this disclosure, it is used to mine the correlation information between elements in the sequence.

[0003] Transformer: An Attention-based machine learning model, commonly used in natural language processing and image processing tasks.

[0004] NC: Node Controller, refers to a single unit in a cloud computing system used to count fault downtime, and can be understood as a service processing unit in this disclosure. This specification provides a fault prediction method, which also involves a fault prediction method and apparatus, a fault prediction model training method, a fault prediction model training apparatus, a computing device, a computer-readable storage medium, and a computer program product, each of which is described in detail in the following embodiments. See Figure 1, which shows a schematic diagram of an application scenario of a fault prediction method provided according to one embodiment of this specification. The fault prediction method can be applied in a cloud computing system, involving a cloud computing platform 102 and a cloud computing server cluster 104. Specifically, the cloud computing platform 102 may obtain the abnormal log data of each server from the cloud computing server cluster 104 and determine the log acquisition time for obtaining the abnormal log data. For example, for a particular server, the abnormal log data is processed based on the abnormal log data and the log acquisition time of the server to obtain an abnormal event sequence corresponding to the abnormal information in the abnormal log data and an abnormal timestamp sequence related to the abnormal occurrence time of the abnormal information. The abnormal events are grouped using a time interval threshold, the abnormal events in the abnormal event sequence, and the corresponding abnormal occurrence time to obtain an abnormal group sequence. Based on the abnormal event sequence, the abnormal timestamp sequence, and the abnormal group sequence, a fault prediction result for the server is obtained using a fault prediction model. In practical applications, fault prediction can be achieved by the cloud computing platform 102 acquiring real-time exception log data. This data can be obtained by sampling each server on a real-time link at preset intervals, such as 5 minutes. Based on a fault prediction model, the platform predicts whether each server will experience a downtime failure. Based on the prediction results, the platform determines whether to perform maintenance in advance to mitigate the server downtime, thereby minimizing user downtime and improving the user experience. Fault prediction results include downtime and no-downtime results. A downtime result indicates that the server is at risk of downtime within a certain period of time. In this case, maintenance can be performed in advance to mitigate user downtime. A no-downtime result indicates that the server is not at risk of downtime within a certain period of time. In this case, no operations can be performed temporarily. The cloud computing platform 102 can be understood as a service based on hardware and software resources, providing computing, network, and storage capabilities. In this disclosure, it is used to provide fault prediction services, predicting server downtime by acquiring server exception log data.The servers in the cloud computing server cluster 104 can be understood as servers that provide various services, including physical servers and cloud servers. For example, servers providing communication services to multiple clients, servers supporting backend training for models used by clients, and servers processing data sent by clients. The fault prediction method provided by the present disclosure can fully utilize the event, time, and grouping information in abnormal log data. By grouping abnormal events that occur consecutively at similar times, the method uses time information to better integrate event information and extract higher-level sequence features, thereby improving the accuracy and recall of fault predictions. This enables the cloud computing system to more quickly and accurately operate and maintain servers that are about to fail, thereby reducing the downtime rate or the losses caused by downtime to users, and significantly improving the stability and reliability of the cloud computing system. Referring to FIG2 , FIG2 shows a flowchart of a fault prediction method provided by one embodiment of this specification, which specifically includes the following steps: Step 202: Obtain abnormal log data from the service processing unit and the log acquisition time of the abnormal log data. The service processing unit can be understood as the NC, i.e., the server in the above-mentioned embodiments; exception log data includes exception information and the time of the exception corresponding to the exception information; exception information can be understood as raw, unprocessed, formatted, or compressed log information in the service processing unit. This exception information typically includes detailed errors, warnings, and debugging information, and comprehensively records all activity details during the operation of the service processing unit; the time of the exception corresponding to the exception information can be understood as the timestamp of the exception information, recording the time of occurrence of each exception information. Log acquisition time can be understood as the time of acquiring the exception log data of the service processing unit. Specifically, a detector can be used to continuously monitor the operation of the service processing unit and, when an exception or error occurs in the service processing unit, record and capture the relevant exception log data. In one or more embodiments of this specification, when initial exception logs are obtained, the initial log data can be sorted according to the time of the exception corresponding to the initial exception information, thereby obtaining exception log data arranged in order according to the time of the exception corresponding to the initial exception information.The specific implementation is as follows: Obtaining the exception log data of the service processing unit includes: obtaining initial exception log data of the service processing unit, wherein the initial exception log data includes initial exception information and the exception occurrence time corresponding to the initial exception information; sorting the initial exception log data according to the exception occurrence time corresponding to the initial exception information using the preset sorting rule, and obtaining the exception log data based on the sorted initial exception log data. The initial exception log data can be understood as out-of-order exception situations obtained from the service processing unit; the preset sorting rule can be understood as a pre-set rule for sorting according to the exception occurrence time corresponding to the initial exception information, which can be sorting from earliest to latest according to the exception occurrence time corresponding to the initial exception information, or from latest to earliest according to the exception occurrence time corresponding to the initial exception information. Specifically, initial exception log data from the service processing unit is obtained and parsed to extract the initial exception information and the corresponding exception occurrence time. The initial exception log data is then sorted according to a preset sorting rule (e.g., sorting the exception occurrence time corresponding to the initial exception information from latest to earliest). This ensures that the initial exception log data is arranged in an orderly manner according to the chronological order of the exception occurrence time. Once the sorting is complete, the resulting ordered initial exception log data is the exception log data, which chronologically displays the exceptions encountered by the service processing unit and their specific occurrence times. The fault prediction method provided herein sorts the initial exception log data according to the exception occurrence time corresponding to the initial exception information to obtain time-ordered exception log data. This allows for more rapid acquisition of an exception event sequence, an exception timestamp sequence, and an exception packet sequence from the time-ordered exception log data. Step 204: Determine the exception event sequence and the exception timestamp sequence based on the exception log data and the log acquisition time. The abnormal event sequence can be understood as a sequence containing the semantic information of the abnormal log data; the abnormal timestamp sequence can be understood as a sequence containing the time information of the abnormal log data. Specifically, the abnormal log data in the service processing unit is analyzed and processed to obtain the abnormal event sequence and abnormal timestamp sequence, respectively. Thus, when the abnormal event sequence and abnormal timestamp sequence are input into the fault prediction model, the semantic information and time information contained in the abnormal log data are extracted.In one or more embodiments of this specification, to ensure that the abnormal event sequence contains the semantic information of the abnormal log data, the abnormal timestamp sequence contains the time information of the abnormal log data. The abnormal event sequence is determined based on the abnormal information in the abnormal log data; and the abnormal timestamp sequence is determined based on the abnormal occurrence time. A specific implementation is as follows: Determining the abnormal event sequence and the abnormal timestamp sequence based on the abnormal log data and the log acquisition time includes: determining the abnormal event sequence based on the abnormal information in the abnormal log data; determining the abnormal occurrence time corresponding to the abnormal event in the abnormal event sequence based on the abnormal occurrence time of the abnormal information; and determining the abnormal timestamp sequence based on the abnormal occurrence time and the log acquisition time. An abnormal event can be understood as data resulting from abstract processing of abnormal information, used to abstract and simplify complex abnormal information. An abnormal event sequence can be understood as a sequence obtained by abstracting and encoding abnormal information. An abnormal timestamp sequence can be understood as a sequence obtained by abstracting and encoding the abnormal occurrence time corresponding to the abnormal information. Specifically, an abnormal event sequence is determined based on the abnormal information in the abnormal log data. This abnormal event sequence contains the semantic information of the abnormal log data. Since the abnormal event is obtained by abstracting the abnormal information, the abnormal occurrence time of the abnormal information is the abnormal event in the abnormal event sequence and the corresponding abnormal occurrence time. An abnormal timestamp sequence is determined based on the abnormal occurrence time corresponding to the abnormal event and the log acquisition time of the abnormal log data. This abnormal timestamp sequence contains the time information of the abnormal log data. The fault prediction method provided by the present disclosure organizes the abnormal log data of the service processing unit by determining the abnormal event sequence and the abnormal timestamp sequence, forming a structured sequence. This facilitates the subsequent input of the structured sequence into the fault prediction model, thereby improving the processing efficiency of the fault prediction model. In one or more embodiments of this specification, abnormal information is processed to obtain an abnormal event sequence, which is then input into a fault prediction model, eliminating the need for the fault prediction model to encode text information. A specific implementation is as follows: Determining the abnormal event sequence based on the abnormal information in the abnormal log data includes: processing the abnormal information to determine the abnormal event corresponding to the abnormal information; determining the event identifier corresponding to the abnormal event based on a matching relationship between reference abnormal events and reference event identifiers in an abnormal event library; and sorting the event identifiers based on the occurrence time of the abnormal events to generate the abnormal event sequence.The event identifier can be understood as an event identifier corresponding to an abnormal event, determined based on the matching relationship between the reference abnormal event and the reference event identifier. This identifier can be represented by a numerical value, a symbol, or other means, without limitation. The abnormal event library contains multiple reference abnormal event types, each of which corresponds to a reference event identifier, thereby establishing a matching relationship between the reference abnormal event and the reference event identifier. Specifically, the matching relationship between the reference abnormal event and the reference event identifier can be obtained from historical abnormal log data. By abstracting the historical abnormal log data, the corresponding reference abnormal event is constructed. The constructed reference abnormal event is then subjected to corresponding identification encoding operations to obtain the reference event identifier corresponding to the reference abnormal event, thereby pre-establishing a matching relationship between each reference abnormal event and the reference event identifier. Specifically, the exception information can be abstracted to determine the exception event corresponding to the exception information. For example, the exception information "mce: [Hardware Error]: Machine check events logged" can be abstracted into the exception event "dmesg_unrecover_mce" using a regular expression. In the exception event library, the event identifier corresponding to the exception event is determined based on the matching relationship between the reference exception events and the reference event identifiers in the exception event library. For example, the event identifier corresponding to the exception event "dmesg_unrecover_mce" is 2. Based on the determined event identifier, the event identifiers need to be sorted according to the exception occurrence time corresponding to the exception event to generate an exception event sequence. In practical applications, reported exception information can be mapped to exception events using regular expressions. Specifically, for each piece of exception information, keywords shared by this exception information and other exception information can be identified, such as "Error" and "Hardware." These keywords can then be classified into different exception names based on their type, yielding phrases used to name the exception events. For example, the exception information "mce: [Hardware Error]: Machine check events logged" can be abstracted into the exception event "dmesg_unrecover_mce." Because exception information describes the computer status and contains a lot of redundant information, abstracting the exception information text can extract key information. Furthermore, reported exception information can be selectively filtered, such as by parsing exception information containing the "Error" field. It should be noted that the abstracted exception events often provide a unified description of a category of exception information.The fault prediction method provided herein abstracts and simplifies abnormal information into a sequence of abnormal events. When the abnormal event sequence is input into a fault prediction model, the complex process of encoding the abnormal information text in the fault prediction model is simplified, reducing the size of the fault prediction model and the storage space required by the computer system. In one or more embodiments of this specification, event identifiers are sorted according to a preset sorting rule, thereby generating an abnormal event sequence based on the sorted event identifiers. A specific implementation is as follows: Sorting the event identifiers corresponding to the abnormal events according to the abnormal occurrence time corresponding to the abnormal events to generate the abnormal event sequence includes: sorting the event identifiers corresponding to the abnormal events according to the abnormal occurrence time corresponding to the abnormal events using a preset sorting rule, and generating an abnormal event sequence based on the sorted event identifiers. The preset sorting rule can be understood as a rule for sorting event identifiers according to the abnormal occurrence time. Specifically, the event identifiers can be sorted in reverse order based on the abnormal occurrence time corresponding to the abnormal events. When predicting faults, abnormal events corresponding to abnormal occurrence times closer to the current moment are generally more relevant. Therefore, the event identifiers corresponding to the abnormal events are sorted in reverse order based on the abnormal occurrence time, thereby generating an abnormal event sequence based on the reverse order of the abnormal occurrence time. Furthermore, abnormal information often has a correlation; that is, abnormal information at a previous moment can cause another abnormal information at a later moment. By sorting the event identifiers (which can also be understood as abnormal information) based on the abnormal occurrence time, the fault prediction model can better utilize the contextual semantic information of the abnormal information to predict faults in the service processing unit. The fault prediction method provided in this disclosure sorts the event identifiers corresponding to abnormal events according to a preset sorting rule, strengthening the correlation between abnormal events in the abnormal event sequence and enabling the fault prediction model to better utilize the contextual semantic information of the abnormal events. In one or more embodiments of this specification, similar to obtaining the abnormal event sequence, the abnormal occurrence time is processed, and abnormal occurrence times in different representations are uniformly structured to facilitate the fault prediction model's processing of abnormal occurrence times in the uniform representation.The specific implementation is as follows: Determining the exception timestamp sequence based on the exception occurrence time and the log acquisition time includes: calculating the time difference between the exception occurrence time and the log acquisition time; grouping the exception occurrence times based on the time difference and a preset time encoding rule, and determining group numbers for the groups, wherein the preset time encoding rule is used to determine the groups corresponding to the exception occurrence times based on the time difference; and encoding the exception occurrence times based on the group numbers to obtain the exception timestamp sequence. The group numbers can be understood as sequence numbers assigned to the grouped exception occurrence times; and encoding can be understood as the process of converting the exception occurrence times into group numbers. For example, the acquired exception log data includes exception occurrence time 1, exception occurrence time 2, exception occurrence time 3, exception occurrence time 4, and exception occurrence time 5, and the log acquisition time of the exception log data is time A (in fact, time A is later than the exception occurrence time in the exception log data). The time difference between each exception occurrence time and the log acquisition time is calculated. Under the preset time coding rule, the exception occurrence time with a time difference within 1000 seconds is divided into the first group, the exception occurrence time with a time difference between 1000-2000 seconds is divided into the second group; the exception occurrence time with a time difference between 2000-3000 seconds is divided into the third group, and so on. In the case of grouping, if the time difference between exception occurrence time 1 and time A is 156 seconds, the time difference between exception occurrence time 2 and time A is 865 seconds, the time difference between exception occurrence time 3 and time A is 1426 seconds, the time difference between exception occurrence time 4 and time A is 2159 seconds, and the time difference between exception occurrence time 5 and time A is 2596 seconds; the exception occurrence time 1, Exception time 2 is grouped into the first group, exception time 3 is grouped into the second group, and exception time 3 and exception time 4 are grouped into the third group. Thus, when encoding the exception times according to the group number, exception time 1 and exception time 2 are encoded as 1, exception time 3 is encoded as 2, and exception time 3 and exception time 4 are encoded as 3, thereby obtaining the exception timestamp sequence [1, 1, 2, 3, 3]. Furthermore, in practical applications, time can be represented in different forms, such as text or delimiters. Each server may have different representations for exception times depending on its settings. In this case, by processing the exception times in the above manner, despite the different representations, they can all be encoded into a unified exception timestamp sequence.Of course, in practical applications, after calculating the time difference between each anomaly occurrence time and the log acquisition time, the anomaly occurrence time can also be encoded based on the time difference to obtain an anomaly timestamp sequence. However, this approach may not effectively utilize time information to analyze anomaly occurrence patterns. The fault prediction method provided herein processes a unified anomaly timestamp sequence in the fault prediction model, where the anomaly timestamp sequence is a sequence encoded with the anomaly occurrence time. This simplifies the processing flow of the fault prediction model and allows the fault prediction model to extract time information from the anomaly log data based on the anomaly timestamp sequence, thereby obtaining more accurate fault prediction results. Step 206: Group the anomaly events in the anomaly event sequence based on the time interval threshold and the anomaly occurrence times corresponding to the anomaly events, obtaining an anomaly grouping sequence. The time interval threshold can be understood as a threshold used to determine whether two adjacent anomaly events meet a threshold for close time proximity and can be set based on actual needs. Specifically, prior knowledge is incorporated into the data processing layer, namely that abnormal events occurring at close times are more highly correlated. Given the sequence characteristic that abnormal event sequences are sorted according to their corresponding abnormal occurrence times, abnormal events occurring at close times can be combined into abnormal event groups. Therefore, a time interval threshold can be set to determine whether adjacent abnormal events meet the criteria of close time. Based on the time interval between adjacent abnormal events, abnormal events that are less than or equal to the time interval threshold are grouped together. For example, if the time interval threshold is 30 minutes, if the time difference between the abnormal occurrence times of adjacent abnormal events is less than or equal to 30 minutes, the two adjacent abnormal events can be combined into an abnormal event group. For example, in an abnormal event sequence, abnormal events A, B, C, and D are adjacent to each other. If the time difference between the abnormal occurrence times of abnormal events A, B, and C is less than 30 minutes, abnormal events A, B, and C can be grouped into abnormal event group 1. However, if the time difference between the abnormal occurrence times of abnormal events D and C is greater than 30 minutes, and the time difference between abnormal event D and another adjacent abnormal event is also greater than 30 minutes, abnormal event D can be grouped into abnormal event group 2, thereby obtaining an abnormal group sequence. In one or more embodiments of the present specification, when obtaining abnormal event groups, the abnormal events in the abnormal event groups are encoded to obtain an abnormal group sequence, and the abnormal events in the same abnormal event group are encoded with the same numerical identifier.The specific implementation is as follows: Grouping the abnormal events according to the time interval threshold and the abnormal occurrence times corresponding to the abnormal events in the abnormal event sequence to obtain an abnormal group sequence includes: grouping the abnormal events according to the time interval threshold and the abnormal occurrence times corresponding to the abnormal events in the abnormal event sequence to obtain multiple abnormal event groups; encoding the abnormal events according to the position of the target abnormal event in each abnormal event group in the abnormal event sequence to obtain an abnormal group sequence. The target abnormal event can be understood as the first abnormal event in the abnormal event group. Specifically, the first abnormal event in the abnormal event group is encoded according to its position in the abnormal event sequence. For example, if the first two abnormal events in a certain abnormal event sequence are grouped together, and the next three abnormal events are grouped together, then the abnormal group sequence may be [1, 1, 3, 3, 3]. Continuing with the above example, if abnormal events A, B, and C are grouped into abnormal event group 1, and abnormal event D is grouped into abnormal event group 2, the first abnormal event in abnormal event group 1 is abnormal event A, which is located at position 1 in the abnormal event sequence. Therefore, abnormal events A, B, and C in abnormal event group 1 are encoded as 1. The first abnormal event in abnormal event group 2 is abnormal event D, which is located at position 4 in the abnormal event sequence. Therefore, abnormal event D in abnormal event group 2 is encoded as 4, resulting in the abnormal group sequence [1, 1, 1, 4]. In practical applications, abnormal event sequences, abnormal timestamp sequences, and abnormal group sequences all use "[start]" as the starting symbol. This symbol has no specific meaning and is used to identify the starting position of the entire sequence. The fault prediction method provided herein groups abnormal events that occur consecutively at similar times based on their abnormal occurrence times. This method uses a fault prediction model to extract higher-level sequence features from the abnormal grouping sequence, accurately predicting the probability of another abnormal event caused by the occurrence of a particular abnormal event. Step 208: Based on the abnormal event sequence, the abnormal timestamp sequence, and the abnormal grouping sequence, the fault prediction model is used to obtain a fault prediction result for the service processing unit. The fault prediction model can be understood as a model for predicting whether a service processing unit will experience downtime, and it has a Transform structure. The fault prediction result includes a downtime result and a no-downtime result.Specifically, the abnormal event sequence, abnormal timestamp sequence, and abnormal packet sequence are input into the fault prediction model to extract semantic information, temporal information, and packet information from the abnormal log data. This allows the fault prediction model to extract information from the abnormal log data from multiple dimensions, resulting in a more accurate prediction of whether the service processing unit will experience a downtime. In one or more embodiments of this specification, to enable the fault prediction model to focus more on abnormal events that have a significant impact on the fault prediction results and capture the temporal changes in the impact of abnormal events, a self-attention mechanism is utilized to process the abnormal event sequence, abnormal timestamp sequence, and abnormal packet sequence. A specific implementation method is as follows: Obtaining a fault prediction result for the service processing unit using the fault prediction model based on the abnormal event sequence, abnormal timestamp sequence, and abnormal packet sequence includes: obtaining an event correlation matrix and a time correlation matrix based on the abnormal event sequence, abnormal timestamp sequence, and abnormal packet sequence using the self-attention layer of the fault prediction model; and obtaining a fault prediction result for the service processing unit based on the event correlation matrix and the time correlation matrix. The event correlation matrix represents the intrinsic connections and impact levels between different abnormal events calculated based on semantic information; the temporal correlation matrix represents the correlations between abnormal events calculated based on temporal information. Both the event correlation matrix and the temporal correlation matrix can be represented as square matrices with a sequence length dimension. Specifically, the abnormal event sequence, abnormal timestamp sequence, and abnormal group sequence are input into the self-attention layer of the fault prediction model. The self-attention mechanism of the self-attention layer is used to calculate the event correlation matrix and the temporal correlation matrix. The correlations between abnormalities in the abnormal log data are obtained from different dimensions. Based on the correlations between abnormalities in the abnormal log data, the fault prediction results of the service processing unit are predicted. In the fault prediction method provided herein, the self-attention layer dynamically assigns weights based on the importance of different abnormal events and their impact on the fault prediction results, enabling the fault prediction model to pay more attention to abnormal log data with a greater impact on the fault prediction results, thereby improving prediction accuracy. In one or more embodiments of this specification, the abnormal event sequence is input into a first self-attention layer, and the abnormal timestamp sequence and abnormal group sequence are input into a second self-attention layer. The event correlation matrix and the temporal correlation matrix are obtained based on the different self-attention layers.The specific implementation is as follows: The method of obtaining an event correlation matrix and a time correlation matrix using the self-attention layer of the fault prediction model based on the abnormal event sequence, the abnormal timestamp sequence, and the abnormal packet sequence includes: inputting the abnormal event sequence into the first self-attention layer of the fault prediction model to obtain the event correlation matrix; and inputting the abnormal timestamp sequence and the abnormal packet sequence into the second self-attention layer of the fault prediction model to obtain the time correlation matrix. The first self-attention layer can be understood as a self-attention layer that processes the abnormal event sequence; the second self-attention layer can be understood as a self-attention layer that processes the abnormal timestamp sequence and the abnormal packet sequence; the first and second self-attention layers are two parallel self-attention layers in the fault prediction model; the first self-attention layer is used to process the abnormal event sequence, and the second self-attention layer is used to process the abnormal timestamp sequence and the abnormal packet sequence. Specifically, before inputting the abnormal event sequence into the first self-attention layer of the fault prediction model, the abnormal event sequence can be first input into the fault prediction model's abnormal event embedding layer (Exception Embedding). The abnormal event embedding layer maps the abnormal event sequence into an event vector. The output of the Except Embedding layer is used as the input to the first self-attention layer, and the event correlation matrix is ​​calculated using the self-attention mechanism. Before inputting the abnormal timestamp sequence and abnormal packet sequence into the fault prediction model's second self-attention layer, the abnormal timestamp sequence can first be input into the fault prediction model's timestamp kilosecond embedding layer (Temporal Embedding). The timestamp kilosecond embedding layer maps the abnormal timestamp sequence into a timestamp vector. The abnormal packet sequence can be input into the fault prediction model's group embedding layer, and the group embedding layer maps the abnormal packet sequence into a group vector. The outputs of Temporal Embedding and Group Embedding, namely the timestamp vector and group vector, are superimposed as the input to the second self-attention layer, and the self-attention mechanism is used to construct a temporal correlation matrix. In practical applications, when abnormal log data is input into a fault prediction model, the abnormal event sequence can be obtained in the abnormal event embedding layer of the fault prediction model and mapped into an event vector; the abnormal timestamp sequence can be obtained in the timestamp kilosecond embedding layer of the fault prediction model and mapped into a timestamp vector; and the abnormal group sequence can be obtained in the group embedding layer and mapped into a group vector.For example, the element in row i and column j of the generated event correlation matrix can be determined based on the correlation between two abnormal events at positions i and j in the abnormal event sequence. The fault prediction method provided by this disclosure processes the abnormal event sequence using a first self-attention layer to capture and quantify the dependencies and potential impacts between different abnormal events, forming an event correlation matrix. The second self-attention layer processes the abnormal timestamp sequence and abnormal packet sequence, enabling in-depth analysis of the temporal evolution patterns and periodic characteristics of abnormal events. In one or more embodiments of this specification, the event correlation matrix and the time correlation matrix are fused to obtain an attention matrix, and a fault prediction result for the service processing unit is obtained through subsequent calculations. A specific implementation method is as follows: Obtaining the fault prediction result for the service processing unit based on the event correlation matrix and the time correlation matrix includes: obtaining an attention matrix using the attention fusion layer of the fault prediction model based on the event correlation matrix and the time correlation matrix; determining a target feature vector based on the attention matrix; and inputting the target feature vector into the classification layer of the fault prediction model to obtain the fault prediction result for the service processing unit. The attention fusion layer is used to fuse the event correlation matrix and the temporal correlation matrix; the target feature vector can be understood as the feature vector corresponding to the start symbol in the output sequence composed of the attention matrix; and the classification layer can be understood as a classifier. In practical applications, the temporal correlation matrix and the event correlation matrix can be combined through the attention fusion layer. The fault prediction model has multiple layers of attention fusion layers, which can be used to instruct the fault prediction model to perform fault prediction based on event, time, and grouping information. The temporal correlation matrix and the event correlation matrix can be summed to fuse the extracted event, time, and grouping information. This enables the fault prediction model to simultaneously extract information from the abnormal event sequence, the abnormal timestamp sequence, and the abnormal grouping sequence. Furthermore, when searching for abnormal event correlation, it can also consider the meaning of the abnormal event itself, the time of abnormal occurrence, and the correlation between abnormal events within the abnormal event group. The sum of the time correlation matrix and the event correlation matrix can be used as the Attention Score in the fault prediction model. The Attention Score refers to the correlation matrix calculated by the Attention process in the fault prediction model. Specifically, it can be regarded as a dynamic weight matrix calculated by the fault prediction model, so that the Attention Score can be multiplied by the input items in subsequent steps to weight the input items.It should be noted that the entire Attention process can be understood as multiplying the input by its own transpose to obtain a dynamic weight matrix (i.e., Attention Score), which is then used to weight the input. After weighting, the input dimension remains unchanged and is subsequently fed into the fully connected layer and classifier module for classification. After summing to obtain the Attention Score, the output can be calculated using Transformer's calculation method. Specifically, the temporal correlation matrix and the event correlation matrix are used as inputs for the first layer of the attention fusion layer. That is, the first layer of the attention fusion layer uses the temporal correlation matrix and the event correlation matrix as inputs. The sum of the temporal correlation matrix and the event correlation matrix can then be used as the input for the first layer, and the resulting matrix can be multiplied by the weight matrix to obtain the output of the first layer. Starting from the second layer, the sum of the previous layer's input and output can be used as the input for the next layer, and multiplied by the weight matrix to obtain the output of the next layer. This continues until the sum of the previous layer's input and output is multiplied by the weight matrix to obtain the output of the top layer. In one embodiment of the present specification, the output items of the top-level attention fusion layer in the fault prediction model are expressed in matrix form (attention matrix). This matrix form is equivalent to a special vector, that is, it can be converted into a feature vector for representation. In this case, the feature vectors of each row vector in the output items can be combined into an output sequence. The target feature vector at the first position in the output sequence, i.e., the feature vector corresponding to the start symbol, can be obtained. This target feature vector is input into a classifier for classification, and the output is the confidence level that the service processing unit will experience a downtime. A preset threshold can be set. When the confidence level exceeds the preset threshold, it is predicted that the corresponding service processing unit will experience a downtime. In actual applications, the feature vector corresponding to the start symbol of the output sequence of the top-level attention fusion layer (class token) is used as the representative of the output sequence and fed into the classifier for classification. The start symbol does not correspond to any abnormal information. However, when calculating the correlation matrix, the correlation between each abnormal event and the start symbol is calculated and the start symbol vector is weighted based on this correlation. Therefore, the start symbol can be considered as a symbol that is independent of each abnormal event, but can also represent the combination of all abnormal events. Therefore, the feature vector corresponding to this start symbol is used for classification.The fault prediction method provided by this disclosure can fully utilize the event, time, and grouping information in abnormal log data. By grouping abnormal events that occur consecutively at similar times, the method uses time information to better integrate event information and extract higher-level sequence features, thereby improving the accuracy and recall of fault predictions. This enables cloud computing systems to more quickly and accurately operate and maintain servers that are about to crash, thereby reducing the downtime rate and the losses caused by downtime to users, and significantly improving the stability and reliability of cloud computing systems. In one or more embodiments of the present specification, the fault prediction model is trained and obtained through the following steps: obtaining sample abnormality log data of the service processing unit and the sample log acquisition time of the sample abnormality log data; determining a sample abnormality event sequence and a sample abnormality timestamp sequence based on the sample abnormality log data and the sample log acquisition time of the sample abnormality log data; grouping the sample abnormality events in the sample abnormality event sequence based on the time interval threshold and the sample abnormality occurrence time corresponding to the sample abnormality events to obtain a sample abnormality group sequence; determining positive samples and negative samples based on the sample abnormality event sequence, the sample abnormality timestamp sequence, and the sample abnormality group sequence; and training and obtaining the fault prediction model based on the positive samples, the sample labels corresponding to the positive samples, the negative samples, and the sample labels corresponding to the negative samples. Positive samples can be understood as downtime samples. That is, when a service processing unit experiences a downtime, the sample abnormality event sequence, the sample abnormality timestamp sequence, and the sample abnormality group sequence are determined based on the obtained sample abnormality log data of the service processing unit and the sample log acquisition time of the sample abnormality log data; and the sample labels corresponding to the positive samples are the downtime results of the service processing unit. Negative samples can be understood as normal samples. That is, when the service processing unit does not experience downtime, the sample abnormality event sequence, sample abnormality timestamp sequence, and sample abnormality group sequence are determined based on the acquired sample abnormality log data of the service processing unit and the sample log acquisition time of the sample abnormality log data. The sample labels corresponding to the negative samples are the server non-downtime results. The specific implementation of obtaining the sample abnormality event sequence, sample abnormality timestamp sequence, and sample abnormality group sequence can be found in the above embodiment and will not be repeated here. When a fault prediction model is trained based on the positive samples, the sample labels corresponding to the positive samples, the negative samples, and the sample labels corresponding to the negative samples, the fault prediction model can predict, based on the acquired abnormality log data and the log acquisition time, whether the service processing unit has experienced downtime or not.The fault prediction method provided herein distinguishes between positive and negative samples, enabling the fault prediction model to better learn patterns in abnormal events that result in downtime or non-downtime, thereby enabling accurate predictions based on acquired abnormal log data. In one or more embodiments of this specification, determining a sample abnormal event sequence and a sample abnormal timestamp sequence based on the sample abnormal log data and the time at which the sample log data was acquired includes: determining a positive sample abnormal event sequence and a negative sample abnormal event sequence based on the sample abnormal log data; and determining a positive sample abnormal timestamp sequence and a negative sample abnormal timestamp sequence based on the positive sample abnormal event sequence, the negative sample abnormal event sequence, and the time at which the sample log data was acquired. The positive sample abnormal event sequence can be understood as the abnormal event sequence determined from the sample abnormal log data when a service processing unit experiences a downtime; and the negative sample abnormal event sequence can be understood as the abnormal event sequence determined from the sample abnormal log data when a service processing unit does not experience a downtime. Specifically, when a fault prediction model needs to be trained using positive and negative samples, a positive sample abnormal event sequence and a negative sample abnormal event sequence are determined for the acquired sample abnormality log data. A positive sample abnormality timestamp sequence is determined based on the positive sample abnormality event sequence and the sample log acquisition time of the sample abnormality log data, and a negative sample abnormality timestamp sequence is determined based on the negative sample abnormality event sequence and the sample log acquisition time of the sample abnormality log data. In one or more embodiments of this specification, determining the positive sample abnormal event sequence and the negative sample abnormal event sequence based on the sample abnormality log data includes: determining the sample abnormality event sequence based on sample abnormality information in the sample abnormality log data, and determining the positive sample abnormal event sequence and the negative sample abnormal event sequence based on the sample abnormality event sequence. In one or more embodiments of the present specification, determining a sample abnormal event sequence based on sample abnormality information in the sample abnormality log data includes: processing the sample abnormality information to determine a sample abnormal event corresponding to the sample abnormality information; determining a sample event identifier corresponding to the sample abnormal event based on a matching relationship between reference abnormal events and reference event identifiers in an abnormal event library; and sorting the sample event identifiers based on the occurrence times of the sample abnormalities corresponding to the sample abnormal events to generate the sample abnormal event sequence. The specific implementation of generating the sample abnormal event sequence is similar to that in the above embodiment and is not further described here.In one or more embodiments of this specification, a positive abnormal event sequence is acquired using a preset sampling time and a preset sampling length, while a negative abnormal event sequence is determined using a preset negative sampling rule. The specific implementation is as follows: Determining the positive abnormal event sequence and the negative abnormal event sequence based on the sample abnormal event sequence includes: determining the positive abnormal event sequence from the sample abnormal event sequence based on a preset sampling time and a preset sampling length; and determining the negative abnormal event sequence from the sample abnormal event sequence based on a preset negative sampling rule. The preset negative sampling rule is a rule for randomly sampling according to a preset ratio. The preset sampling time can be understood as a preset sampling time interval; the preset sampling length can be understood as a preset sampling window length; and the preset negative sampling rule can be understood as a rule for randomly acquiring samples from the sample abnormal event sequence according to a preset ratio. Specifically, when acquiring positive samples, overlapping sampling can be performed within the sample abnormal event sequence at 5-minute intervals and a 3-day sampling window length. This yields a positive sample abnormal event sequence. When acquiring negative samples, abnormal events can be randomly sampled at a preset ratio (e.g., 60%) within the sample abnormal event sequence to determine the negative sample abnormal event sequence. In practical applications, a sliding window approach is employed, where a subsequence containing all abnormal events within the previous 72 hours (i.e., 3 days) is calculated at every 5-minute time point. For example, the first sampling window begins at time A and ends at time B (72 hours before time A). The window then shifts forward 5 minutes, with the second sampling window starting at time C (5 minutes before time A), also covering the previous 72 hours, and so on. In one or more embodiments of the present specification, grouping the sample abnormal events based on the time interval threshold and the sample abnormality occurrence times corresponding to the sample abnormal events in the sample abnormality event sequence to obtain a sample abnormality grouping sequence includes: grouping the positive sample abnormal events based on the time interval threshold and the positive sample abnormality occurrence times corresponding to the positive sample abnormal events in the positive sample abnormality event sequence to obtain a positive sample abnormality grouping sequence; and grouping the negative sample abnormal events based on the time interval threshold and the negative sample abnormality occurrence times corresponding to the negative sample abnormal events in the negative sample abnormality event sequence to obtain a negative sample abnormality grouping sequence. The specific implementation of grouping the positive sample abnormal events and the negative sample abnormal events is similar to the grouping method in the above-described embodiment and is not further described here.In one or more embodiments of this specification, determining positive and negative samples based on the sample abnormal event sequence, the sample abnormal timestamp sequence, and the sample abnormal grouping sequence includes: using the positive sample abnormal event sequence, the positive sample abnormal timestamp sequence, and the positive sample abnormal grouping sequence as positive samples, and using the negative sample abnormal event sequence, the negative sample abnormal timestamp sequence, and the negative sample abnormal grouping sequence as negative samples. The fault prediction method provided herein, through the constructed positive and negative samples, can help a fault prediction model fully learn and distinguish between service processing unit downtime and non-downtime states, thereby improving the prediction accuracy and generalization capability of the fault prediction model in practical applications. The fault prediction method provided herein determines an abnormal event sequence and an abnormal timestamp sequence by acquiring abnormal log data from a service processing unit and the time at which the abnormal log data was acquired. The abnormal events are then grouped by their time intervals to obtain an abnormal grouping sequence. When abnormal events occurring at similar times are more correlated, the abnormal log data is analyzed from multiple dimensions. This utilizes a fault prediction model to improve the accuracy and recall of fault predictions, enabling the cloud computing system to predict downtimes in advance and perform timely maintenance, reducing downtime rates and improving the stability of the cloud computing system. Referring to FIG3 , FIG3 illustrates a flowchart of a fault prediction model training method provided by one embodiment of this specification, specifically comprising the following steps: Step 302: Acquire sample abnormal log data from the service processing unit and the time at which the sample abnormal log data was acquired. Determining a positive sample abnormal event sequence and a negative sample abnormal event sequence based on the sample abnormal log data includes: determining a sample abnormal event sequence based on sample abnormality information in the sample abnormal log data, and determining the positive sample abnormal event sequence and the negative sample abnormal event sequence based on the sample abnormal event sequence. Determining a sample abnormal event sequence based on sample abnormality information in the sample abnormality log data includes: processing the sample abnormality information to determine a sample abnormal event corresponding to the sample abnormality information; determining a sample event identifier corresponding to the sample abnormal event based on a matching relationship between a reference abnormal event and a reference event identifier in an abnormal event library; and sorting the sample event identifiers based on the sample abnormality occurrence time corresponding to the sample abnormal event to generate the sample abnormal event sequence.Determining the positive sample abnormal event sequence and the negative sample abnormal event sequence based on the sample abnormal event sequence includes: determining the positive sample abnormal event sequence from the sample abnormal event sequence based on a preset sampling time and a preset sampling length; and determining the negative sample abnormal event sequence from the sample abnormal event sequence based on a preset negative sample sampling rule, wherein the preset negative sample sampling rule is a rule for random sampling according to a preset ratio. Step 304: Determining a sample abnormal event sequence and a sample abnormal timestamp sequence based on the sample abnormal log data and the sample log acquisition time of the sample abnormal log data. Determining the sample abnormal event sequence and the sample abnormal timestamp sequence based on the sample abnormal log data and the sample log acquisition time of the sample abnormal log data includes: determining the positive sample abnormal event sequence and the negative sample abnormal event sequence based on the sample abnormal log data; and determining the positive sample abnormal timestamp sequence and the negative sample abnormal timestamp sequence based on the positive sample abnormal event sequence, the negative sample abnormal event sequence, and the sample log acquisition time of the sample abnormal log data. Step 306: Group the sample abnormal events according to the time interval threshold and the sample abnormality occurrence times corresponding to the sample abnormal events in the sample abnormality event sequence to obtain a sample abnormality grouping sequence; Grouping the sample abnormal events according to the time interval threshold and the sample abnormality occurrence times corresponding to the sample abnormal events in the sample abnormality event sequence to obtain a sample abnormality grouping sequence includes: Grouping the positive sample abnormal events according to the time interval threshold and the positive sample abnormality occurrence times corresponding to the positive sample abnormal events in the positive sample abnormality event sequence to obtain a positive sample abnormality grouping sequence; Grouping the negative sample abnormal events according to the time interval threshold and the negative sample abnormality occurrence times corresponding to the negative sample abnormal events in the negative sample abnormality event sequence to obtain a negative sample abnormality grouping sequence. Step 308: Determine positive samples and negative samples based on the sample abnormal event sequence, the sample abnormal timestamp sequence, and the sample abnormal grouping sequence; determining positive samples and negative samples based on the sample abnormal event sequence, the sample abnormal timestamp sequence, and the sample abnormal grouping sequence includes: taking the positive sample abnormal event sequence, the positive sample abnormal timestamp sequence, and the positive sample abnormal grouping sequence as positive samples, and taking the negative sample abnormal event sequence, the negative sample abnormal timestamp sequence, and the negative sample abnormal grouping sequence as negative samples.Step 310: A fault prediction model is trained based on the positive samples, their corresponding sample labels, the negative samples, and their corresponding sample labels. The specific implementation can be found in the above-mentioned embodiments and will not be further described here. The fault prediction model training method provided in this disclosure determines an abnormal event sequence and an abnormal timestamp sequence; groups abnormal events by their time intervals to obtain an abnormal grouping sequence. When abnormal events occurring at similar times are more highly correlated, the abnormal log data is analyzed from multiple dimensions, enabling the trained fault prediction model to achieve more accurate predictions. The above is a schematic diagram of a fault prediction model training method in this embodiment. It should be noted that the technical solution of this fault prediction model training method shares the same concept as the technical solution of the above-mentioned fault prediction method. Details not described in detail in the technical solution of the fault prediction model training method can be found in the description of the technical solution of the above-mentioned fault prediction method. Referring to Figure 4, a flowchart of the processing of a fault prediction model training method provided in one embodiment of this specification is shown, specifically including the following steps: Step 402: Preprocess the training sample data. The detector obtains exception log data corresponding to the NC (i.e., the service processing unit in the above embodiment). The exception information in the exception log data is abstracted into an exception event. The same type of exception information is abstracted into the same type of exception event. The exception event is converted into a corresponding event identifier using an exception event library. Specifically, Figure 5 illustrates a schematic diagram of a data preprocessing process provided in one embodiment of this specification. As shown in Figure 5, the data preprocessing process involves organizing exception log data into structured data. Specifically, the exception log data includes the log time (i.e., the exception occurrence time in the above embodiment) and the original record information (i.e., the exception information in the above embodiment). The exception information is abstracted, with the color-coded portion of the original record information being abstracted into an exception event. The exception event library contains all types of exception events, and each exception event is associated with an integer (i.e., the event identifier in the above embodiment). Each exception is converted into an integer using the exception event library. For example, the abnormal event "dmesg_unrecover_mce" is converted to 2. The purpose of using colors to distinguish in FIG5 is to indicate that abnormal events of the same type are represented by the same integer number, thereby obtaining a preprocessing result that uses integer numbers to represent abnormal information. Step 404: Sampling.When anomaly log data is obtained through the detector, it includes the time of occurrence of the anomaly corresponding to the anomaly information. The anomaly log data is sorted in reverse order of the anomaly occurrence time. Then, the acquired anomaly log data is sampled according to a preset sampling interval and sampling window length to obtain sample anomaly log data. In practical applications, the anomaly log data reported by each NC is sorted in reverse order of the anomaly occurrence time to form a sequence. The sampling is performed with an interval of 5 minutes and a sampling window length of 3 days, with overlapping sampling across the entire sequence. (According to step 402, the resulting sample format is "[start], 1, 2, >, 3," where [start] is a start symbol and has no specific meaning.) For downtime samples (positive samples), only data with a sampling start within 3 days of the downtime is retained. For normal samples (negative samples), a certain percentage of samples are randomly retained from the entire sequence. Step 406: Code mapping. Specifically, the sequence "[start], 1, 2, ..., 3" obtained above is coded and mapped into a vector that can be trained by the fault prediction model. For example, the abnormal event sequence obtained above is coded and mapped. For the abnormal timestamp sequence, the time difference between the occurrence time of each abnormality and the sampling time is calculated. For example, if three days total 259,200 seconds, 0-1000 seconds are mapped to the number 1, 1000-2000 seconds are mapped to the number 2, and so on. The encoding is then performed and mapped into a vector. For the abnormal group sequence, abnormal events less than a certain threshold are grouped according to the time interval between adjacent abnormal events. The group is then coded according to the position of the first abnormal event in the sequence. For example, if the first three abnormal events in a sequence are grouped together, and the next five abnormal events are grouped together, the abnormal group sequence is "[start], 1, 1, 1, 4, 4, 4, 4, 4", and the abnormal group sequence is coded and mapped. Figure 6 shows a schematic diagram of a coding and mapping process provided by one embodiment of this specification.The abnormal event sequence corresponding to the abnormal event is coded and mapped, such as "2, 1, 9, ..., 30" is coded and mapped to obtain the coding vector "E2] EJ1] E, [9] ... EJ30] corresponding to the abnormal event sequence; based on the abnormal occurrence time "20230501 16: 20: 00, 20230501 16: 19: 10, 20230501 15: 56: 04, 20230501 13: 57: 47", the abnormal timestamp sequence and the abnormal group sequence are obtained by coding and mapped into vectors, such as the coding vector corresponding to the abnormal timestamp sequence is 'E2

[0001] E2

[0001] ... E2

[0030] \ The coding vector corresponding to the abnormal group sequence is "E3〔1] E3[1] E3[3] ... E3

[0089] ". Step 408: Obtain an event correlation matrix and a time correlation matrix. The output of the fault prediction model embedding layer is used as input and input into the self-attention layer of the fault prediction model; first, the output of Except i on Embedding, that is, the abnormal event sequence after encoding and mapping, is input into the first self-attention layer, and the event correlation matrix is ​​obtained using the self-attention mechanism; the outputs of Tempora I Embedding and Group Embedding, that is, the abnormal timestamp sequence and the abnormal group sequence after encoding and mapping are superimposed and input into the second self-attention layer, and the correlation between each event in the sequence is calculated based on the time information to obtain the time correlation matrix. Step 410: Matrix fusion. The event correlation matrix and the time correlation matrix are added and fused to obtain the attention matrix, and the attention matrix is ​​input into each attention fusion layer of the fault prediction model to obtain the output sequence of the top attention fusion layer. Step 412: Model training. In the output sequence of the top attention fusion layer, the feature vector (c I ass token) corresponding to the start symbol is used as the representative of this output sequence. The data is sent to the classifier for classification. Fault prediction is a binary classification task, and the fault prediction result (downtime, normal) is obtained. The fault prediction result and sample labels are used to update the model parameters of the fault prediction model by calculating the loss function. In practical applications, the loss function used in model training is the cross-bing loss, and the gradient descent algorithm is used to backpropagate the gradient of the loss to update the model parameters.The fault prediction model training method provided in this disclosure fully considers temporal information, specifically time and grouping information. It eliminates the need for direct learning from raw recorded data, instead using preprocessed results for learning, improving model training efficiency. By effectively integrating event, temporal, and grouping information, it can more effectively extract information from sequences, enhancing data representation. This allows subsequent application of the fault prediction model to improve the accuracy and recall of fault predictions, enabling cloud computing systems to predict downtime in advance and implement timely maintenance, reducing downtime and improving cloud computing system stability. Corresponding to the aforementioned method embodiments, this specification also provides an embodiment of a fault prediction device. Figure 7 shows a schematic structural diagram of a fault prediction device provided in one embodiment of this specification. As shown in FIG7 , the apparatus includes: a data acquisition module 702 configured to acquire abnormal log data of the service processing unit and a log acquisition time of the abnormal log data; a sequence determination module 704 configured to determine an abnormal event sequence and an abnormal timestamp sequence based on the abnormal log data and the log acquisition time; a sequence acquisition module 706 configured to group the abnormal events in the abnormal event sequence according to a time interval threshold and the abnormal occurrence time corresponding to the abnormal events, to obtain an abnormal grouping sequence; and a result acquisition module 708 configured to obtain a fault prediction result of the service processing unit using a fault prediction model based on the abnormal event sequence, the abnormal timestamp sequence, and the abnormal grouping sequence. The device further includes: a model training module, configured to obtain sample abnormality log data of the service processing unit and the sample log acquisition time of the sample abnormality log data; determine a sample abnormality event sequence and a sample abnormality timestamp sequence based on the sample abnormality log data and the sample log acquisition time of the sample abnormality log data; group the sample abnormality events according to the time interval threshold and the sample abnormality occurrence time corresponding to the sample abnormality events in the sample abnormality event sequence to obtain a sample abnormality grouping sequence; determine positive samples and negative samples based on the sample abnormality event sequence, the sample abnormality timestamp sequence, and the sample abnormality grouping sequence; and train a fault prediction model based on the positive samples, the sample labels corresponding to the positive samples, the negative samples, and the sample labels corresponding to the negative samples.Optionally, the model training module is further configured to: determine a sequence of positive and negative abnormal events based on the sample abnormality log data; and determine a sequence of positive and negative abnormal timestamps based on the sequence of positive and negative abnormal events and the sample log acquisition time of the sample abnormality log data. Optionally, the model training module is further configured to: group the positive abnormal events based on the time interval threshold and the positive abnormality occurrence times corresponding to the positive abnormal events in the positive abnormal event sequence to obtain a sequence of positive abnormal groupings; and group the negative abnormal events based on the time interval threshold and the negative abnormality occurrence times corresponding to the negative abnormal events in the negative abnormal event sequence to obtain a sequence of negative abnormal groupings. Optionally, the model training module is further configured to: use the sequence of positive abnormal events, the sequence of positive abnormal timestamps, and the sequence of positive abnormal groups as positive samples, and use the sequence of negative abnormal events, the sequence of negative abnormal timestamps, and the sequence of negative abnormal groups as negative samples. Optionally, the model training module is further configured to: determine a sample abnormal event sequence based on the sample abnormality information in the sample abnormality log data, and determine the positive sample abnormal event sequence and the negative sample abnormal event sequence based on the sample abnormal event sequence. Optionally, the model training module is further configured to: process the sample abnormality information to determine the sample abnormal events corresponding to the sample abnormality information; determine the sample event identifiers corresponding to the sample abnormal events based on a matching relationship between reference abnormal events and reference event identifiers in the abnormal event library; sort the sample event identifiers based on the sample abnormality occurrence times corresponding to the sample abnormal events to generate the sample abnormal event sequence. Optionally, the model training module is further configured to: determine the positive sample abnormal event sequence from the sample abnormal event sequence based on a preset sampling time and a preset sampling length; and determine the negative sample abnormal event sequence from the sample abnormal event sequence based on a preset negative sample sampling rule, wherein the preset negative sample sampling rule is a rule for random sampling according to a preset ratio. Optionally, the sequence determination module 704 is further configured to: determine the abnormal event sequence according to the abnormal information in the abnormal log data; determine the abnormal occurrence time corresponding to the abnormal event in the abnormal event sequence according to the abnormal occurrence time of the abnormal information; and determine the abnormal timestamp sequence according to the abnormal occurrence time and the log acquisition time.Optionally, the sequence determination module 704 is further configured to: process the exception information to determine the abnormal event corresponding to the exception information; determine the event identifier corresponding to the abnormal event based on the matching relationship between the reference abnormal event and the reference event identifier in the abnormal event library; sort the event identifiers according to the abnormal occurrence time corresponding to the abnormal event to generate the abnormal event sequence. Optionally, the sequence determination module 704 is further configured to: calculate the time difference between the abnormal occurrence time and the log acquisition time; group the abnormal occurrence times according to the time difference and a preset time encoding rule, and determine group numbers for the groups, wherein the preset time encoding rule is used to determine the groups corresponding to the abnormal occurrence times based on the time difference; and encode the abnormal occurrence times according to the group numbers to obtain the abnormal timestamp sequence. Optionally, the sequence determination module 704 is further configured to: sort the event identifiers corresponding to the abnormal events according to the abnormal occurrence time corresponding to the abnormal events using a preset sorting rule, and generate the abnormal event sequence based on the sorted event identifiers. Optionally, the sequence acquisition module 706 is further configured to: group the abnormal events according to the time interval threshold and the abnormal occurrence times corresponding to the abnormal events in the abnormal event sequence to obtain multiple abnormal event groups; and encode the abnormal events according to the position of the target abnormal event in each abnormal event group in the abnormal event sequence to obtain an abnormal group sequence. Optionally, the result acquisition module 708 is further configured to: obtain an event correlation matrix and a time correlation matrix using the self-attention layer of the fault prediction model based on the abnormal event sequence, the abnormal timestamp sequence, and the abnormal group sequence; and obtain a fault prediction result for the service processing unit based on the event correlation matrix and the time correlation matrix. Optionally, the result acquisition module 708 is further configured to: input the abnormal event sequence into the first self-attention layer of the fault prediction model to obtain the event correlation matrix; and input the abnormal timestamp sequence and the abnormal group sequence into the second self-attention layer of the fault prediction model to obtain the time correlation matrix.Optionally, the result acquisition module 708 is further configured to: obtain an attention matrix using the attention fusion layer of the fault prediction model based on the event correlation matrix and the time correlation matrix; determine a target feature vector based on the attention matrix; and input the target feature vector into the classification layer of the fault prediction model to obtain a fault prediction result for the service processing unit. The above is a schematic diagram of a fault prediction device according to this embodiment. It should be noted that the technical solution of this fault prediction device shares the same concept as the technical solution of the aforementioned fault prediction device. For details not described in detail in the technical solution of the fault prediction device, please refer to the description of the technical solution of the aforementioned fault prediction method. Corresponding to the aforementioned method embodiment, this specification also provides an embodiment of a fault prediction model training device. Figure 8 shows a schematic structural diagram of a fault prediction model training device provided in one embodiment of this specification. As shown in Figure 8, the device includes: a data acquisition module 802, configured to acquire sample abnormality log data of the service processing unit and the sample log acquisition time of the sample abnormality log data; a sequence determination module 804, configured to determine a sample abnormality event sequence and a sample abnormality timestamp sequence based on the sample abnormality log data and the sample log acquisition time of the sample abnormality log data; a sequence acquisition module 806, configured to group the sample abnormality events according to the time interval threshold and the sample abnormality occurrence time corresponding to the sample abnormality events in the sample abnormality event sequence to obtain a sample abnormality grouping sequence; a sample determination module 808, configured to determine positive samples and negative samples based on the sample abnormality event sequence, the sample abnormality timestamp sequence, and the sample abnormality grouping sequence; and a training module 810, configured to train and obtain a fault prediction model based on the positive samples, the sample labels corresponding to the positive samples, the negative samples, and the sample labels corresponding to the negative samples. Optionally, the sequence determination module 804 is further configured to: determine a positive sample abnormal event sequence and a negative sample abnormal event sequence according to the sample abnormal log data; and determine a positive sample abnormal timestamp sequence and a negative sample abnormal timestamp sequence according to the positive sample abnormal event sequence, the negative sample abnormal event sequence, and the sample log acquisition time of the sample abnormal log data.Optionally, the sequence acquisition module 806 is further configured to: group the positive abnormal events according to the time interval threshold and the positive abnormal occurrence times corresponding to the positive abnormal events in the positive abnormal event sequence to obtain a positive abnormal group sequence; and group the negative abnormal events according to the time interval threshold and the negative abnormal occurrence times corresponding to the negative abnormal events in the negative abnormal event sequence to obtain a negative abnormal group sequence. Optionally, the sample determination module 808 is further configured to: use the positive abnormal event sequence, the positive abnormal timestamp sequence, and the positive abnormal group sequence as positive samples, and use the negative abnormal event sequence, the negative abnormal timestamp sequence, and the negative abnormal group sequence as negative samples. Optionally, the sequence determination module 804 is further configured to: determine a sample abnormal event sequence according to the sample abnormality information in the sample abnormality log data, and determine the positive abnormal event sequence and the negative abnormal event sequence based on the sample abnormal event sequence. Optionally, the sequence determination module 804 is further configured to: process the sample abnormality information to determine the sample abnormal events corresponding to the sample abnormality information; determine the sample event identifiers corresponding to the sample abnormal events based on the matching relationship between reference abnormal events and reference event identifiers in the abnormal event library; and sort the sample event identifiers based on the sample abnormality occurrence times corresponding to the sample abnormal events to generate the sample abnormal event sequence. Optionally, the sequence determination module 804 is further configured to: determine the positive sample abnormal event sequence from the sample abnormal event sequence based on a preset sampling time and a preset sampling length; and determine the negative sample abnormal event sequence from the sample abnormal event sequence based on a preset negative sample sampling rule, wherein the preset negative sample sampling rule is a rule for random sampling according to a preset ratio. The above is a schematic scheme of a fault prediction model training device according to this embodiment. It should be noted that the technical scheme of the fault prediction model training device and the technical scheme of the aforementioned fault prediction method are based on the same concept. Details not described in detail in the technical scheme of the fault prediction model training device can be found in the description of the technical scheme of the aforementioned fault prediction method. 9 shows a block diagram of a computing device 900 according to an embodiment of the present disclosure. Components of the computing device 900 include, but are not limited to, a memory 910 and a processor 920 . oThe processor 920 is connected to the memory 910 via a bus 930. A database 950 is used to store data. The computing device 900 also includes an access device 940 that enables the computing device 900 to communicate via one or more networks 960. Examples of these networks include a public switched telephone network (PSTN), a local area network (LAN), a wide area network (WAN), a personal area network (PAN), or a combination of communication networks such as the Internet. The access device 940 may include one or more of any type of wired or wireless network interface (e.g., a network interface card (NIC)), such as an IEEE 802.11 wireless local area network (WLAN) wireless interface, a Worldwide Interoperability for Microwave Access (Wi-MAX) interface, an Ethernet interface, a universal serial bus (USB) interface, a cellular network interface, a Bluetooth interface, or a near field communication (NFC) interface. In one embodiment of the present specification, the aforementioned components of the computing device 900 and other components not shown in FIG. 9 may also be connected to each other, for example, via a bus. It should be understood that the computing device structure block diagram shown in FIG. 9 is for illustrative purposes only and does not limit the scope of this specification. Those skilled in the art may add or replace other components as needed. Computing device 900 may be any type of stationary or mobile computing device, including a mobile computer or mobile computing device (e.g., a tablet computer, personal digital assistant, laptop computer, notebook computer, netbook computer, etc.), a mobile phone (e.g., a smartphone), a wearable computing device (e.g., a smartwatch, smart glasses, etc.), or other types of mobile devices, or a stationary computing device such as a desktop computer or personal computer (PC). Computing device 900 may also be a mobile or stationary server.The processor 920 is configured to execute the following computer program / instructions, which, when executed by the processor, implement the steps of the aforementioned fault prediction method. The various embodiments in this specification are described in a progressive manner. Similar or identical portions between the various embodiments may be referenced to each other. Each embodiment focuses on the differences from other embodiments. In particular, the computing device embodiment, since it is substantially similar to the fault prediction method embodiment, is described relatively simply. For relevant portions, refer to the description of the fault prediction method embodiment. An embodiment of this specification also provides a computer-readable storage medium storing a computer program / instructions. When executed by the processor, the computer program / instructions implement the steps of the aforementioned fault prediction method or fault prediction model training method. The various embodiments in this specification are described in a progressive manner. Similar or identical portions between the various embodiments may be referenced to each other. Each embodiment focuses on the differences from other embodiments. In particular, the computer-readable storage medium embodiment, since it is substantially similar to the fault prediction method embodiment, is described relatively simply. For relevant portions, refer to the description of the fault prediction method embodiment. One embodiment of this specification also provides a computer program product, including a computer program / instructions. When executed by a processor, the computer program / instructions implement the steps of the above-described fault prediction method or fault prediction model training method. The above is an illustrative embodiment of a computer program product according to this embodiment. It should be noted that the technical solution of this computer program product and the technical solution of the above-described fault prediction method are based on the same concept. For details not described in detail in the technical solution of the computer program product, please refer to the description of the technical solution of the above-described fault prediction method. The above describes specific embodiments of this specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the figures do not necessarily require the specific order or sequential order shown to achieve the desired results. In certain embodiments, multi-tasking and parallel processing are also possible or may be advantageous. The computer instructions include computer program code, which may be in source code form, object code form, executable file, or some intermediate form.The computer-readable medium may include any entity or device capable of carrying the computer program code, a recording medium, a USB flash drive, a mobile hard drive, a magnetic disk, an optical disk, a computer memory, a read-only memory (ROM), a random access memory (RAM), an electric carrier signal, a telecommunications signal, and a software distribution medium. It should be noted that the content of the computer-readable medium may be appropriately increased or decreased based on the requirements of patent practice. For example, in some regions, according to patent practice, computer-readable media do not include electric carrier signals and telecommunications signals. It should be noted that for ease of description, the aforementioned method embodiments are described as a series of actions. However, those skilled in the art should understand that the present disclosure is not limited by the order of the actions described, as certain steps may be performed in another order or simultaneously according to the present disclosure. Furthermore, those skilled in the art should also understand that the embodiments described in this specification are preferred embodiments, and the actions and modules involved are not necessarily required for the present disclosure. In the above embodiments, the descriptions of each embodiment have their own specific focus. For portions not described in detail in a particular embodiment, reference should be made to the relevant descriptions of other embodiments. The preferred embodiments disclosed above are intended only to facilitate illustration of this specification. The alternative embodiments do not exhaustively describe all details, nor do they limit the invention to the specific embodiments described. Obviously, many modifications and variations are possible based on the content of this disclosure. These embodiments are selected and described in detail in this specification to better explain the principles and practical applications of this disclosure, thereby enabling those skilled in the art to better understand and utilize this specification. This specification is limited only by the claims and their full scope and equivalents.

Claims

25 Claims 1. A fault prediction method, applied to a cloud computing system, wherein the cloud computing system includes a service processing unit, and comprising: Acquire abnormal log data of the service processing unit and log acquisition time of the abnormal log data; determining an abnormal event sequence and an abnormal timestamp sequence based on the abnormal log data and the log acquisition time; grouping the abnormal events according to a time interval threshold and the abnormal occurrence time corresponding to the abnormal events in the abnormal event sequence to obtain an abnormal grouping sequence; A fault prediction result of the service processing unit is obtained by using a fault prediction model according to the abnormal event sequence, the abnormal timestamp sequence, and the abnormal packet sequence.

2. The fault prediction method according to claim 1, wherein: The fault prediction model is obtained by training through the following steps: obtaining sample abnormality log data of the service processing unit and the sample log acquisition time of the sample abnormality log data; determining a sample abnormality event sequence and a sample abnormality timestamp sequence based on the sample abnormality log data and the sample log acquisition time of the sample abnormality log data; grouping the sample abnormality events according to the time interval threshold and the sample abnormality occurrence time corresponding to the sample abnormality events in the sample abnormality event sequence to obtain a sample abnormality grouping sequence; determining positive samples and negative samples based on the sample abnormality event sequence, the sample abnormality timestamp sequence, and the sample abnormality grouping sequence; and training to obtain a fault prediction model based on the positive samples, the sample labels corresponding to the positive samples, the negative samples, and the sample labels corresponding to the negative samples.

3. The fault prediction method according to claim 2, wherein: The determining of a sample abnormal event sequence and a sample abnormal timestamp sequence based on the sample abnormal log data and the sample log acquisition time of the sample abnormal log data includes: determining a positive sample abnormal event sequence and a negative sample abnormal event sequence based on the sample abnormal log data; and determining a positive sample abnormal timestamp sequence and a negative sample abnormal timestamp sequence based on the positive sample abnormal event sequence, the negative sample abnormal event sequence, and the sample log acquisition time of the sample abnormal log data.

4. The fault prediction method according to claim 3, wherein: The step of grouping the sample abnormal events according to the time interval threshold and the sample abnormality occurrence times corresponding to the sample abnormal events in the sample abnormality event sequence to obtain a sample abnormality grouping sequence includes: grouping the positive sample abnormal events according to the time interval threshold and the positive sample abnormality occurrence times corresponding to the positive sample abnormal events in the positive sample abnormality event sequence to obtain a positive sample abnormality grouping sequence; The negative sample abnormal events are grouped according to the time interval threshold and the negative sample abnormality occurrence time corresponding to the negative sample abnormal events in the negative sample abnormality event sequence to obtain a negative sample abnormality grouping sequence.

5. The fault prediction method according to claim 4, wherein: The determining of positive samples and negative samples based on the sample abnormal event sequence, the sample abnormal timestamp sequence, and the sample abnormal grouping sequence includes: using the positive sample abnormal event sequence, the positive sample abnormal timestamp sequence, and the positive sample abnormal grouping sequence as positive samples, and using the negative sample abnormal event sequence, the negative sample abnormal timestamp sequence, and the negative sample abnormal grouping sequence as negative samples.

6. The fault prediction method according to claim 3, wherein: Determining a positive sample abnormal event sequence and a negative sample abnormal event sequence based on the sample abnormality log data includes: determining a sample abnormal event sequence based on sample abnormality information in the sample abnormality log data, and determining the positive sample abnormal event sequence and the negative sample abnormal event sequence based on the sample abnormality event sequence.

7. The fault prediction method according to claim 6, wherein: Determining a sample abnormal event sequence based on sample abnormality information in the sample abnormality log data includes: processing the sample abnormality information to determine a sample abnormal event corresponding to the sample abnormality information; determining a sample event identifier corresponding to the sample abnormal event based on a matching relationship between a reference abnormal event and a reference event identifier in an abnormal event library; and sorting the sample event identifiers based on the sample abnormality occurrence time corresponding to the sample abnormal event to generate the sample abnormal event sequence.

8. The fault prediction method according to claim 6, wherein: The determining the positive sample abnormal event sequence and the negative sample abnormal event sequence based on the sample abnormal event sequence includes: determining the positive sample abnormal event sequence from the sample abnormal event sequence based on a preset sampling time and a preset sampling length; and determining the negative sample abnormal event sequence from the sample abnormal event sequence based on a preset negative sample sampling rule, wherein the preset negative sample sampling rule is a rule for randomly sampling according to a preset ratio.

9. The fault prediction method according to claim 1, wherein: Determining an abnormal event sequence and an abnormal timestamp sequence based on the abnormal log data and the log acquisition time includes: determining the abnormal event sequence based on abnormal information in the abnormal log data; determining the abnormal occurrence time corresponding to the abnormal event in the abnormal event sequence based on the abnormal occurrence time of the abnormal information; and determining the abnormal timestamp sequence based on the abnormal occurrence time and the log acquisition time.

10. The fault prediction method according to claim 9, wherein: The abnormal information in the abnormal log data The abnormal event sequence is determined based on the abnormal information, including: processing the abnormal information to determine the abnormal event corresponding to the abnormal information; Determining an event identifier corresponding to the abnormal event based on a matching relationship between a reference abnormal event and a reference event identifier in the abnormal event library; The event identifiers are sorted according to the abnormal occurrence times corresponding to the abnormal events to generate the abnormal event sequence.

11. The fault prediction method according to claim 9, wherein: The determining the abnormal timestamp sequence based on the abnormality occurrence time and the log acquisition time includes: calculating the time difference between the abnormality occurrence time and the log acquisition time; grouping the abnormality occurrence time according to the time difference and a preset time coding rule, and determining the group number of the group, wherein the preset time coding rule is used to determine the group corresponding to the abnormality occurrence time according to the time difference; encoding the abnormality occurrence time according to the group number to obtain the abnormal timestamp sequence.

12. The fault prediction method according to claim 10, wherein: The step of sorting the event identifiers corresponding to the abnormal events according to the abnormal occurrence times corresponding to the abnormal events to generate an abnormal event sequence includes sorting the event identifiers corresponding to the abnormal events according to the abnormal occurrence times corresponding to the abnormal events using a preset sorting rule, and generating an abnormal event sequence according to the sorted event identifiers.

13. The fault prediction method according to claim 1, wherein: The grouping the abnormal events according to the time interval threshold and the abnormal occurrence times corresponding to the abnormal events in the abnormal event sequence to obtain an abnormal group sequence includes: grouping the abnormal events according to the time interval threshold and the abnormal occurrence times corresponding to the abnormal events in the abnormal event sequence to obtain multiple abnormal event groups; and encoding the abnormal events according to the position of the target abnormal event in each abnormal event group in the abnormal event sequence to obtain an abnormal group sequence.

14. The fault prediction method according to claim 1, wherein: The method of obtaining a fault prediction result of the service processing unit based on the abnormal event sequence, the abnormal timestamp sequence, and the abnormal packet sequence using a fault prediction model includes: obtaining an event correlation matrix and a time correlation matrix based on the abnormal event sequence, the abnormal timestamp sequence, and the abnormal packet sequence using a self-attention layer of the fault prediction model; and obtaining a fault prediction result of the service processing unit based on the event correlation matrix and the time correlation matrix. 28 15. The fault prediction method according to claim 14, wherein: The method of obtaining an event correlation matrix and a time correlation matrix based on the abnormal event sequence, the abnormal timestamp sequence, and the abnormal grouping sequence using the self-attention layer of the fault prediction model includes: inputting the abnormal event sequence into the first self-attention layer of the fault prediction model to obtain the event correlation matrix; and inputting the abnormal timestamp sequence and the abnormal grouping sequence into the second self-attention layer of the fault prediction model to obtain the time correlation matrix.

16. The fault prediction method according to claim 14, wherein: Obtaining the fault prediction result of the service processing unit based on the event correlation matrix and the time correlation matrix includes: obtaining an attention matrix based on the event correlation matrix and the time correlation matrix using the attention fusion layer of the fault prediction model; determining a target feature vector based on the attention matrix; and inputting the target feature vector into the classification layer of the fault prediction model to obtain the fault prediction result of the service processing unit.

17. A fault prediction model training method, applied to a cloud computing system, wherein the cloud computing system includes a service processing unit, the method comprising: Obtain sample abnormality log data of the service processing unit and a sample log acquisition time of the sample abnormality log data; determine a sample abnormality event sequence and a sample abnormality timestamp sequence based on the sample abnormality log data and the sample log acquisition time of the sample abnormality log data; group the sample abnormality events based on the time interval threshold and the sample abnormality occurrence time corresponding to the sample abnormality events in the sample abnormality event sequence to obtain a sample abnormality grouping sequence; determine positive samples and negative samples based on the sample abnormality event sequence, the sample abnormality timestamp sequence, and the sample abnormality grouping sequence; and train a fault prediction model based on the positive samples, the sample labels corresponding to the positive samples, the negative samples, and the sample labels corresponding to the negative samples.

18. The fault prediction model training method according to claim 17, wherein: The determining of a sample abnormal event sequence and a sample abnormal timestamp sequence based on the sample abnormal log data and the sample log acquisition time of the sample abnormal log data comprises: determining a positive sample abnormal event sequence and a negative sample abnormal event sequence based on the sample abnormal log data; determining a positive sample abnormal event sequence and a negative sample abnormal event sequence based on the positive sample abnormal event sequence, the negative sample abnormal event sequence and the sample abnormal log data; 29 Sample log acquisition time, determine the positive sample abnormal timestamp sequence and the negative sample abnormal timestamp sequence.

19. The fault prediction model training method according to claim 18, wherein: The grouping the sample abnormal events according to the time interval threshold and the sample abnormality occurrence times corresponding to the sample abnormal events in the sample abnormality event sequence to obtain a sample abnormality grouping sequence includes: grouping the positive sample abnormal events according to the time interval threshold and the positive sample abnormality occurrence times corresponding to the positive sample abnormal events in the positive sample abnormality event sequence to obtain a positive sample abnormality grouping sequence; and grouping the negative sample abnormal events according to the time interval threshold and the negative sample abnormality occurrence times corresponding to the negative sample abnormal events in the negative sample abnormality event sequence to obtain a negative sample abnormality grouping sequence.

20. The fault prediction model training method according to claim 19, wherein: The determining of positive samples and negative samples based on the sample abnormal event sequence, the sample abnormal timestamp sequence, and the sample abnormal grouping sequence includes: taking the positive sample abnormal event sequence, the positive sample abnormal timestamp sequence, and the positive sample abnormal grouping sequence as positive samples, and taking the negative sample abnormal event sequence, the negative sample abnormal timestamp sequence, and the negative sample abnormal grouping sequence as negative samples.

21. The fault prediction model training method according to claim 18, wherein: Determining a positive sample abnormal event sequence and a negative sample abnormal event sequence based on the sample abnormality log data includes: determining a sample abnormal event sequence based on sample abnormality information in the sample abnormality log data, and determining the positive sample abnormal event sequence and the negative sample abnormal event sequence based on the sample abnormality event sequence.

22. The fault prediction model training method according to claim 21, wherein: Determining a sample abnormal event sequence based on sample abnormality information in the sample abnormality log data includes: processing the sample abnormality information to determine a sample abnormal event corresponding to the sample abnormality information; determining a sample event identifier corresponding to the sample abnormal event based on a matching relationship between a reference abnormal event and a reference event identifier in an abnormal event library; and sorting the sample event identifiers based on the sample abnormality occurrence time corresponding to the sample abnormal event to generate the sample abnormal event sequence.

23. The fault prediction model training method according to claim 21, wherein: The determining the positive sample abnormal event sequence and the negative sample abnormal event sequence based on the sample abnormal event sequence includes: determining the positive sample abnormal event sequence from the sample abnormal event sequence based on a preset sampling time and a preset sampling length; and determining the negative sample abnormal event sequence from the sample abnormal event sequence based on a preset negative sample sampling rule, wherein the preset negative sample sampling rule is a rule for randomly sampling according to a preset ratio.

24. A fault prediction device, applied to a cloud computing system, wherein the cloud computing system includes a service processing unit, 30 includes: a data acquisition module, configured to acquire the abnormal log data of the service processing unit and the log acquisition time of the abnormal log data; a sequence determination module configured to determine an abnormal event sequence and an abnormal timestamp sequence according to the abnormal log data and the log acquisition time; a sequence obtaining module configured to group the abnormal events according to a time interval threshold and abnormal occurrence times corresponding to the abnormal events in the abnormal event sequence to obtain an abnormal grouping sequence; The result obtaining module is configured to obtain a fault prediction result of the service processing unit by using a fault prediction model according to the abnormal event sequence, the abnormal timestamp sequence, and the abnormal packet sequence.

25. A fault prediction model training device, applied to a cloud computing system, the cloud computing system including a service processing unit, the device comprising: a data acquisition module configured to acquire sample abnormality log data of the service processing unit and a sample log acquisition time of the sample abnormality log data; a sequence determination module configured to determine a sample abnormality event sequence and a sample abnormality timestamp sequence based on the sample abnormality log data and the sample log acquisition time of the sample abnormality log data; a sequence acquisition module configured to group the sample abnormality events according to the time interval threshold and the sample abnormality occurrence time corresponding to the sample abnormality events in the sample abnormality event sequence to obtain a sample abnormality grouping sequence; a sample determination module configured to determine positive samples and negative samples according to the sample abnormal event sequence, the sample abnormal timestamp sequence, and the sample abnormal grouping sequence; The training module is configured to train and obtain a fault prediction model according to the positive samples, the sample labels corresponding to the positive samples, the negative samples, and the sample labels corresponding to the negative samples.

26. A computing device comprising: memory and processor; The memory is used to store computer programs / instructions, and the processor is used to execute the computer programs / instructions. When the computer program / instructions are executed by the processor, the fault prediction method according to any one of claims 1 to 16 is implemented, or the steps of the fault prediction model training method according to any one of claims 17 to 23 are implemented.

27. A computer-readable storage medium storing a computer program / instruction, wherein when the computer program / instruction is executed by a processor, the computer program / instruction implements the fault prediction method according to any one of claims 1 to 16, or implements the steps of the fault prediction model training method according to any one of claims 17 to 23.

28. A computer program product comprising a computer program / instruction, wherein when the computer program / instruction is executed by a processor, the computer program / instruction implements the fault prediction method according to any one of claims 1 to 16, or implements the fault detection method according to any one of claims 17 to 23. 31 Steps of the prediction model training method.

Images