Abnormality detection method, device, electronic device and storage medium in business execution

Abstract

The present disclosure provides a method, device, electronic device and storage medium for troubleshooting anomalies in business execution. The present disclosure is used for optimizing vulnerability repair efficiency in system performance optimization. The method includes: receiving an operation instruction from a user, wherein the operation instruction is an instruction for an operation in the business; inspecting the operation instruction according to a preset inspection rule corresponding to the operation in the operation instruction, and generating an inspection result log; in response to a report of an abnormality in business execution, searching the inspection result log based on the type of abnormality, locating the abnormal log segment corresponding to the type of abnormality in the inspection result log; inputting the abnormal log segment into a first machine learning model, and the first machine learning model outputs the cause of the abnormality. The embodiments of the present disclosure reduce the occupation of operation and maintenance resources, and ensure efficient abnormality troubleshooting in business execution.

Description

Background Art

[0002] There are a large number of repetitive daily tasks in the daily IT operation and maintenance work of the unit. Some of these tasks are complex and tedious, some are heavily dependent on the execution order, and some need to wait for various conditions to be met before they can be executed. Although the technology of IT operation and maintenance management is constantly improving, in fact, IT operation and maintenance personnel have not been truly liberated. At present, most of the work such as system opening and closing, system update and upgrade, emergency operation, etc. in many enterprises is manually operated. Even simple system changes or software copy-and-paste upgrades often require operation and maintenance personnel to log in to each device one by one to make manual changes. Especially in the case of cloud platforms, big data and massive devices, the workload can be imagined. Such changes and inspection operations often occur every day in IT operation and maintenance, occupying a large amount of operation and maintenance resources.

[0003] The prior art urgently needs an efficient abnormality troubleshooting solution in business execution that reduces the occupation of operation and maintenance resources. Summary of the invention

[0004] The present disclosure aims to provide an efficient abnormality troubleshooting solution in business execution that reduces the occupation of operation and maintenance resources.

[0005] According to a first aspect of the present disclosure, a method for troubleshooting anomalies in business execution is provided, wherein the business includes a sequence of multiple operations executed continuously, each operation corresponds to a preset inspection rule, and the method includes:

[0006] receiving an operation instruction from a user, wherein the operation instruction is an instruction for an operation in the service;

[0007] Inspect the operation instruction according to the preset inspection rules corresponding to the operation in the operation instruction, and generate an inspection result log;

[0008] In response to a report of an exception occurring during service execution, searching the inspection result log based on the type of the exception, and locating an exception log segment in the inspection result log corresponding to the type of the exception;

[0009] The abnormal log segment is input into a first machine learning model, and the first machine learning model outputs the cause of the abnormality, wherein the first machine learning model is trained in the following manner: each abnormal log segment sample in the abnormal log segment sample set is input into the first machine learning model, each abnormal log segment sample is pre-labeled with a known label of the abnormal cause of the abnormal log segment sample, and the first machine learning model outputs the cause of the abnormality; if the cause of the abnormality output by the first machine learning model is inconsistent with the label of the abnormal log segment sample, the first machine learning model is adjusted so that the cause of the abnormality output by the first machine learning model is consistent with the label of the abnormal log segment sample.

[0010] In one embodiment, after the abnormal log segment is input into a first machine learning model and the first machine learning model outputs the abnormal cause, the method further includes:

[0011] Based on the cause of the exception, a comparison table of causes of exception and solutions is searched to obtain the solution corresponding to the cause of the exception.

[0012] In one embodiment, the step of inspecting the operation instruction according to a preset inspection rule corresponding to the operation in the operation instruction and generating an inspection result log includes:

[0013] Obtaining the operation name in the operation instruction;

[0014] Searching the operation name-to-preset inspection rule comparison table to obtain the preset inspection rule corresponding to the operation name, wherein the preset inspection rule includes conditions that each field in the operation instruction needs to meet;

[0015] Checking whether each field in the operation instruction meets the conditions that the field needs to meet in the predetermined inspection rule;

[0016] Generate a test result log based on the test results.

[0017] In one embodiment, in response to the report of an exception occurring during the execution of the service, searching the inspection result log based on the type of the exception, and locating the exception log segment corresponding to the type of the exception in the inspection result log includes:

[0018] Identifying the type of anomaly from the report of anomaly in the execution of the business;

[0019] Look up the abnormal type and abnormal keyword comparison table to obtain the keyword corresponding to the abnormal type;

[0020] Locating the keyword in the inspection result log;

[0021] Based on the keywords located in the inspection result log and based on a predetermined criterion, an abnormal log segment corresponding to the keywords in the inspection result log is located as an abnormal log segment corresponding to the type of the abnormality.

[0022] In one embodiment, the predetermined criteria include: taking the template segment that appears in the context of the keyword and is closest to the keyword as the abnormal log segment corresponding to the keyword, and the template segment is selected from a predetermined template segment library.

[0023] In one embodiment, the abnormality cause and solution comparison table is pre-established based on the second machine learning model, and the second machine learning model is pre-established in the following manner:

[0024] Each abnormal cause sample in the abnormal cause sample library is input into the second machine learning model. Each abnormal cause sample is pre-labeled with a known solution to the abnormal cause sample. The second machine learning model outputs the determined solution. If the solution determined by the second machine learning model is inconsistent with the label of the abnormal cause sample, the second machine learning model is adjusted so that the solution determined by the second machine learning model is consistent with the label of the abnormal cause sample.

[0025] In one embodiment, after searching the abnormality cause and solution comparison table based on the abnormality cause and obtaining the solution corresponding to the abnormality cause, the method further includes:

[0026] Based on the obtained solution, searching for a script corresponding to the solution in a pre-established script library;

[0027] Execute the script corresponding to the solution.

[0028] According to a second aspect of the present disclosure, a device for troubleshooting anomalies in business execution is provided, wherein the business includes a sequence of multiple operations executed continuously, each operation corresponds to a preset inspection rule, and the device includes:

[0029] A receiving unit, configured to receive an operation instruction from a user, wherein the operation instruction is an instruction for an operation in the service;

[0030] A testing unit, configured to test the operation instruction according to a preset testing rule corresponding to the operation in the operation instruction, and generate a testing result log;

[0031] a locating unit, configured to, in response to a report of an abnormality occurring during service execution, search the inspection result log based on the type of the abnormality, and locate an abnormal log segment in the inspection result log corresponding to the type of the abnormality;

[0032] An abnormality cause obtaining unit is used to input the abnormal log segment into a first machine learning model, and the first machine learning model outputs the abnormality cause, wherein the first machine learning model is trained in the following manner: each abnormal log segment sample in the abnormal log segment sample set is input into the first machine learning model, each abnormal log segment sample is pre-labeled with a known abnormality cause of the abnormal log segment sample, and the first machine learning model outputs the abnormality cause. If the abnormality cause output by the first machine learning model is inconsistent with the label of the abnormal log segment sample, the first machine learning model is adjusted so that the abnormality cause output by the first machine learning model is consistent with the label of the abnormal log segment sample.

[0033] According to a third aspect of the present disclosure, there is provided an electronic device, including:

[0034] A memory configured to store executable instructions.

[0035] The processor is configured to execute the executable instructions stored in the memory to perform the above method.

[0036] According to a fourth aspect of the present disclosure, a computer-readable program medium is provided, which stores computer program instructions. When the computer instructions are executed by a computer, the computer executes the method described above.

[0037] In the disclosed embodiment, the business is regarded as a sequence consisting of multiple operations executed continuously, and a preset inspection rule is set for each operation. In this way, when an operation instruction for an operation in the sequence is received from the user, the operation instruction is inspected according to the preset inspection rule corresponding to the operation in the operation instruction, and an inspection result log is generated. Once an abnormality is found in the execution of the business, the inspection result log can be searched based on the type of abnormality, and the abnormal log segment corresponding to the type of abnormality in the inspection result log can be located. The abnormal log segment is input into the first machine learning model, and the first machine learning model outputs the cause of the abnormality. The above process is completely executed by the machine, and does not require the intervention of operation and maintenance personnel, which reduces the occupation of operation and maintenance resources and realizes the automation of abnormality detection in business execution.

[0038] Other features and advantages of the present disclosure will become apparent from the following detailed description, or may be learned in part by the practice of the present disclosure.

[0039] It is to be understood that the foregoing general description and the following detailed description are exemplary only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 A flowchart of a method for troubleshooting anomalies in business execution according to an example implementation of the present disclosure is shown.

[0041] Figure 2 A flowchart of a method for troubleshooting anomalies in business execution according to an example implementation of the present disclosure is shown.

[0042] Figure 3 A specific flow chart of step 120 according to an example implementation of the present disclosure is shown.

[0043] Figure 4 A specific flow chart of step 130 according to an example implementation of the present disclosure is shown.

[0044] Figure 5 A block diagram of a device for troubleshooting abnormalities in business execution according to an example implementation of the present disclosure is shown.

[0045] Figure 6A hardware device diagram of an electronic device according to an example embodiment of the present disclosure is shown.

[0046] Figure 7 A diagram of a computer-readable storage medium according to an example embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0047] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in a variety of forms and should not be construed as being limited to the examples set forth herein; on the contrary, these embodiments are provided so that the present disclosure will be more comprehensive and complete, and the concepts of the example embodiments are fully conveyed to those skilled in the art. The described features, structures, or characteristics may be combined in one or more embodiments in any suitable manner. In the following description, many specific details are provided to provide a full understanding of the embodiments of the present disclosure. However, those skilled in the art will appreciate that the technical solutions of the present disclosure may be practiced while omitting one or more of the specific details, or other methods, components, devices, steps, etc. may be adopted. In other cases, known technical solutions are not shown or described in detail to avoid obscuring various aspects of the present disclosure.

[0048] In addition, the accompanying drawings are only schematic illustrations of the present disclosure and are not necessarily drawn to scale. The same reference numerals in the figures represent the same or similar parts, and their repeated description will be omitted. Some of the block diagrams shown in the accompanying drawings are functional entities and do not necessarily correspond to physically or logically independent entities. These functional entities can be implemented in software form, or implemented in one or more hardware modules or integrated circuits, or implemented in different networks and / or processor devices and / or microcontroller devices.

[0049] like Figure 1 As shown, in one embodiment, a method for troubleshooting exceptions in business execution is provided. The business here refers to a complete activity carried out in a unit (enterprise, institution, agency, team, etc.). For example, the insurance business in an insurance company is a business it engages in, including a complete set of processes, such as user recording an order -> quotation -> application for insurance -> submission of order -> calling the financial system to issue an order -> customer payment -> calling the financial account -> underwriting. Anomalies refer to situations in which the system is inconsistent with normal operation during business execution, such as "order recording failure" when "user recording an order", etc. Anomaly troubleshooting method refers to a method for verifying the cause of the exception when an exception occurs. The method is executed by the system server of the unit.

[0050] In one embodiment, the business includes a sequence of multiple operations executed in succession. Each specific action in the business is called an operation. For example, the insurance business is a sequence of the above operations executed in succession: user recording, quotation, application for insurance, order submission, calling the financial system to issue an order, customer payment, calling the financial account, and underwriting. Each operation corresponds to a preset inspection rule. The preset inspection rule is a pre-set rule for inspecting the operation instruction. The operation instruction is an instruction for executing the operation. For example, in the user recording, there must be a requirement for each field in the user entry form. For example, the name field is entered in Chinese or Chinese plus Pinyin. In other words, the name field in the corresponding recording operation instruction is Chinese or Chinese plus Pinyin. If the operation instruction does not meet the preset inspection rules, it cannot pass the inspection, but must be recorded in the log. This is described in detail below.

[0051] like Figure 1 As shown, the method includes:

[0052] Step 110: receiving an operation instruction from a user, wherein the operation instruction is an instruction for an operation in the service;

[0053] Step 120: Check the operation instruction according to the preset inspection rule corresponding to the operation in the operation instruction, and generate an inspection result log;

[0054] Step 130: In response to a report of an exception occurring during service execution, searching the inspection result log based on the type of the exception, and locating an exception log segment in the inspection result log corresponding to the type of the exception;

[0055] Step 140: input the abnormal log segment into a first machine learning model, and the first machine learning model outputs the cause of the abnormality, wherein the first machine learning model is trained in the following manner: input each abnormal log segment sample in the abnormal log segment sample set into the first machine learning model, each abnormal log segment sample is pre-labeled with a known label of the abnormal cause of the abnormal log segment sample, and the first machine learning model outputs the cause of the abnormality. If the cause of the abnormality output by the first machine learning model is inconsistent with the label of the abnormal log segment sample, adjust the first machine learning model so that the cause of the abnormality output by the first machine learning model is consistent with the label of the abnormal log segment sample.

[0056] These steps are described in detail below.

[0057] In step 110, an operation instruction of a user is received, wherein the operation instruction is an instruction for an operation in the service.

[0058] For example, for the operation instruction of recording an order, the operation instruction may first have an operation name field, indicating that the operation to be performed by the operation instruction is recording an order. In addition, the operation instruction may carry the specific content field of the recording order, such as: the name field, which carries the name of the insured; the age field, which carries the age of the insured, etc. Different operations have different operation instructions.

[0059] In step 120, the operation instruction is checked according to a preset check rule corresponding to the operation in the operation instruction, and a check result log is generated.

[0060] In one embodiment, Figure 3 As shown, step 120 includes:

[0061] Step 1201, obtaining the operation name in the operation instruction;

[0062] Step 1202: Look up the comparison table of operation names and preset inspection rules to obtain the preset inspection rules corresponding to the operation names, where the preset inspection rules include conditions that each field in the operation instruction needs to meet;

[0063] Step 1203: Check whether each field in the operation instruction meets the conditions that the field needs to meet in the predetermined inspection rule;

[0064] Step 1204: Generate a test result log based on the test result.

[0065] As shown above, one field of the operation instruction is the operation name field, so in step 1201, the operation name is read from the operation name field.

[0066] The operation name and preset inspection rule comparison table of step 1202 is a table pre-set to store operation names and corresponding inspection rules. The inspection rules are for the fields in the operation instructions. The content of each field is different, and the inspection rules are different. Therefore, it is necessary to store different preset inspection rules corresponding to the operation names in the operation name and preset inspection rule comparison table.

[0067] For example, for the name field, the validation rule may be: Chinese + Pinyin. For the date of birth field, the validation rule may be: xxxx-yy-zz, where xxxx represents year, yy represents month, and zz represents day.

[0068] In step 1203, for each field in the operation instruction, it is checked whether it complies with the corresponding preset inspection rule obtained in step 1202. For example, "August 21, 2017" does not comply with a corresponding inspection rule such as xxxx-yy-zz.

[0069] In step 1204, since every operation of the computer will be recorded in the log, the inspection action will also generate a log, that is, the inspection result log, which stores the inspection time, whether the inspection passed, the field that failed the inspection, and which predetermined inspection rule the field does not meet.

[0070] In step 130, in response to a report of an exception occurring during service execution, the inspection result log is searched based on the type of the exception, and an exception log segment corresponding to the type of the exception in the inspection result log is located.

[0071] During the execution of a business, an exception may occur in any of the operations. An exception refers to a situation where a business cannot be executed or is executed differently from the normal execution. For example, in the insurance business with a process of user recording an order -> quotation -> application for insurance -> submission of order -> calling the financial system to issue an order -> customer payment -> calling the financial system to receive the account -> underwriting, there may be exceptions in various links such as order recording exceptions, order submission exceptions, and payment exceptions. Once an exception occurs during the execution of a business, an exception report will be generated, indicating the type of exception, the time of occurrence, etc. The types of exceptions include the business system stopping operation, the business system being unable to log in, and the order recording exception.

[0072] In one embodiment, Figure 4 As shown, step 130 includes:

[0073] Step 1301: Identify the type of anomaly from the report of anomaly in the execution of the service;

[0074] Step 1302: Look up the abnormality type and abnormality keyword comparison table to obtain the keyword corresponding to the abnormality type;

[0075] Step 1303: locate the keyword in the inspection result log;

[0076] Step 1304: Based on the keywords located in the inspection result log and based on predetermined criteria, locate the abnormal log segment corresponding to the keywords in the inspection result log as the abnormal log segment corresponding to the type of the abnormality.

[0077] The abnormality report in step 1301 may be reported by the service execution module of the server to the abnormality troubleshooting module of the server when the abnormality is detected. The report includes the type of abnormality, the time of occurrence, etc. Therefore, the type of abnormality can be identified from the report.

[0078] In step 1302, the abnormal keyword is a characteristic feature that may appear in the test result log when the abnormality of the type occurs, which is determined for each type of abnormality. For example, for the type of abnormality "payment abnormality", the corresponding transaction result log may have abnormal keywords such as "account name error", "password error", "no such account", etc. Therefore, these keywords can be obtained, and then these keywords can be used to locate the abnormal log segment in the test result log.

[0079] After the keyword is obtained, in step 1303, the inspection result log is searched with the keyword to locate the keyword.

[0080] Then, in step 1304, based on the keywords located in the inspection result log and based on predetermined criteria, the abnormal log segment corresponding to the keywords in the inspection result log can be located as the abnormal log segment corresponding to the type of the abnormality.

[0081] The exception log segment is the part of the test result log that may contain data required to troubleshoot the cause of the exception.

[0082] In one embodiment, the predetermined criteria include: using the segment including the keyword in the test result log as the abnormal log segment corresponding to the keyword in the test result log. This segment is the segment where the keyword is located, and it is possible to use it as the abnormal log segment to obtain the abnormal cause through subsequent processing.

[0083] In one embodiment, the predetermined criteria include: taking the template segment that appears in the context of the keyword and is closest to the keyword as the abnormal log segment corresponding to the keyword, and the template segment is selected from a predetermined template segment library.

[0084] The segment where the keyword is located may not necessarily reflect the cause of the anomaly, but some segments before and after the segment may better reflect the cause of the anomaly. These segments often have some common characteristics, and the common parts can be made into template segments. Once some template segments appear in the context of the keyword (not necessarily the segment where the keyword is located), these template segments are likely to reflect the cause of the anomaly. Therefore, the template segment that appears in the context of the keyword and is closest to the keyword can be used as the abnormal log segment corresponding to the keyword, and the template segment is selected from a predetermined template segment library. If the template segment is in front of the keyword, the distance between the template segment and the keyword refers to the number of characters between the last character of the template segment and the first character of the keyword; if the template segment is after the keyword, the distance between the template segment and the keyword refers to the number of characters between the last character of the keyword and the first character of the template segment; if the keyword is in the template segment, the distance between the template segment and the keyword is 0.

[0085] In step 140, after the abnormal log segment is located, the abnormal log segment can be input into the first machine learning model, and the first machine learning model outputs the cause of the abnormality.

[0086] The first machine learning model is trained in advance by: inputting each abnormal log segment sample in the abnormal log segment sample set into the first machine learning model. The abnormal log segment sample is an abnormal log segment extracted from the historical test result log. The extraction method can refer to Figure 4 As shown. The abnormal log segment sample set is a set consisting of a large number of abnormal log segment samples. Each abnormal log segment sample is affixed with a known label of the abnormal cause of the abnormal log segment sample in advance, and the label can be affixed by experts sample by sample. The first machine learning model outputs the abnormal cause. If the abnormal cause output by the first machine learning model is inconsistent with the label of the abnormal log segment sample, adjust the coefficients in the first machine learning model so that the abnormal cause output by the first machine learning model is consistent with the label of the abnormal log segment sample. After a large number of sample training, the first machine learning model will be able to generate an output of the abnormal cause after receiving any abnormal log segment.

[0087] like Figure 2 As shown, in one embodiment, the method further includes, after step 140: step 150, searching a comparison table of abnormal causes and solutions based on the abnormal cause, and obtaining a solution corresponding to the abnormal cause.

[0088] The abnormal cause and solution comparison table is a table storing various abnormal causes and corresponding solutions. When determining the abnormal cause in step 140, the table can be searched to obtain the solution corresponding to the abnormal cause.

[0089] The advantage of this embodiment is that it can not only automatically determine the cause of the exception, but also automatically find a solution to the exception.

[0090] In one embodiment, the abnormal cause and solution comparison table is pre-established based on a second machine learning model, and the second machine learning model is pre-established in the following manner: each abnormal cause sample in the abnormal cause sample library is input into the second machine learning model, and each abnormal cause sample is pre-labeled with a known solution to the abnormal cause sample. The second machine learning model outputs the determined solution. If the solution determined by the second machine learning model is inconsistent with the label of the abnormal cause sample, the second machine learning model is adjusted so that the solution determined by the second machine learning model is consistent with the label of the abnormal cause sample.

[0091] The exception reason sample can be the historical situation where users encountered exceptions during business execution. Figure 1The abnormal cause sample library is a library including a large number of abnormal cause samples, each of which has a solution determined by an expert and a label attached to the solution.

[0092] In one embodiment, the present disclosure can not only find a solution to an anomaly, but also automatically execute the solution. Figure 2 As shown, the method further includes, after step 150:

[0093] Step 160: Based on the obtained solution, search for a script corresponding to the solution in a pre-established script library;

[0094] Step 170: Execute the script corresponding to the solution.

[0095] In an embodiment, for each solution listed in the abnormal cause and solution comparison table, a script of the solution is written in advance by a programmer and stored in a database. Once the abnormal cause and solution comparison table is searched to obtain a solution, the script that passes the solution can be found from the database (for example, the script is stored in correspondence with the solution ID, and the abnormal cause and solution comparison table also stores the correspondence between the cause and the solution ID). Then, the script is loaded into the memory for execution, and as a result of the script execution, the solution is executed.

[0096] like Figure 5 As shown, the embodiment of the present disclosure also discloses a device for troubleshooting anomalies in business execution, wherein the business includes a sequence of multiple operations executed continuously, each operation corresponds to a preset inspection rule, and the device includes:

[0097] A receiving unit 210, configured to receive an operation instruction from a user, wherein the operation instruction is an instruction for an operation in the service;

[0098] The inspection unit 220 is used to inspect the operation instruction according to the preset inspection rules corresponding to the operation in the operation instruction and generate an inspection result log;

[0099] A positioning unit 230, configured to respond to a report of an abnormality occurring during service execution, search the inspection result log based on the type of the abnormality, and locate an abnormal log segment corresponding to the type of the abnormality in the inspection result log;

[0100] The abnormality cause obtaining unit 240 is used to input the abnormal log segment into a first machine learning model, and the first machine learning model outputs the abnormality cause, wherein the first machine learning model is trained in the following manner: each abnormal log segment sample in the abnormal log segment sample set is input into the first machine learning model, each abnormal log segment sample is pre-labeled with a known abnormality cause of the abnormal log segment sample, and the first machine learning model outputs the abnormality cause. If the abnormality cause output by the first machine learning model is inconsistent with the label of the abnormal log segment sample, the first machine learning model is adjusted so that the abnormality cause output by the first machine learning model is consistent with the label of the abnormal log segment sample.

[0101] In one embodiment, the apparatus further comprises:

[0102] A solution acquisition unit (not shown) is used to search the abnormality cause and solution comparison table based on the abnormality cause, and acquire the solution corresponding to the abnormality cause.

[0103] In one embodiment, the inspection unit 220 is further configured to:

[0104] Obtaining the operation name in the operation instruction;

[0105] Searching the comparison table of operation name and preset inspection rule to obtain the preset inspection rule corresponding to the operation name, wherein the preset inspection rule includes the conditions that each field in the operation instruction needs to meet;

[0106] Checking whether each field in the operation instruction meets the conditions that the field needs to meet in the predetermined inspection rule;

[0107] Generate a test result log based on the test results.

[0108] In one embodiment, the positioning unit 230 is further configured to:

[0109] Identifying the type of anomaly from the report of anomaly in the execution of the business;

[0110] Look up the abnormal type and abnormal keyword comparison table to obtain the keyword corresponding to the abnormal type;

[0111] Locating the keyword in the inspection result log;

[0112] Based on the keywords located in the inspection result log and based on a predetermined criterion, an abnormal log segment corresponding to the keywords in the inspection result log is located as an abnormal log segment corresponding to the type of the abnormality.

[0113] In one embodiment, the predetermined criteria include: taking the template segment that appears in the context of the keyword and is closest to the keyword as the abnormal log segment corresponding to the keyword, and the template segment is selected from a predetermined template segment library.

[0114] In one embodiment, the abnormality cause and solution comparison table is pre-established based on the second machine learning model, and the second machine learning model is pre-established in the following manner:

[0115] Each abnormal cause sample in the abnormal cause sample library is input into the second machine learning model. Each abnormal cause sample is pre-labeled with a known solution to the abnormal cause sample. The second machine learning model outputs the determined solution. If the solution determined by the second machine learning model is inconsistent with the label of the abnormal cause sample, the second machine learning model is adjusted so that the solution determined by the second machine learning model is consistent with the label of the abnormal cause sample.

[0116] In one embodiment, the apparatus further comprises:

[0117] A script search unit, used for searching a script corresponding to the solution in a pre-established script library based on the obtained solution;

[0118] The script execution unit is used to execute the script corresponding to the solution.

[0119] The implementation process of the functions and effects of each unit in the above-mentioned device is specifically described in the implementation process of the corresponding steps in the above-mentioned method, and will not be repeated here.

[0120] It should be noted that, although several modules or units of the device for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into multiple modules or units to be embodied.

[0121] In addition, although the steps of the method in the present disclosure are described in a specific order in the drawings, this does not require or imply that the steps must be performed in this specific order, or that all the steps shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps, etc.

[0122] Through the description of the above implementation, it is easy for those skilled in the art to understand that the example implementation described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, including several instructions to enable a computing device (which can be a personal computer, a server, a mobile terminal, or a network device, etc.) to execute the method according to the implementation of the present disclosure.

[0123] In an exemplary embodiment of the present disclosure, an electronic device capable of implementing the above method is also provided.

[0124] It will be appreciated by those skilled in the art that various aspects of the present invention may be implemented as a system, method or program product. Therefore, various aspects of the present invention may be specifically implemented in the following forms, namely: a complete hardware implementation, a complete software implementation (including firmware, microcode, etc.), or a combination of hardware and software, which may be collectively referred to herein as a "circuit", "module" or "system".

[0125] Refer to the following Figure 6 An electronic device 400 according to this embodiment of the present invention will be described. Figure 6 The electronic device 400 shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0126] like Figure 6 As shown, the electronic device 400 is in the form of a general computing device. The components of the electronic device 400 may include but are not limited to: at least one processing unit 410, at least one storage unit 420, and a bus 430 connecting different system components (including the storage unit 420 and the processing unit 410).

[0127] The storage unit stores program codes, which can be executed by the processing unit 410, so that the processing unit 410 performs the steps according to various exemplary embodiments of the present invention described in the above “Exemplary Method” section of this specification. For example, the processing unit 410 can perform the following steps: Figure 1 The process shown in .

[0128] The storage unit 420 may include a readable medium in the form of a volatile storage unit, such as a random access storage unit (RAM) 4201 and / or a cache storage unit 4202 , and may further include a read-only storage unit (ROM) 4203 .

[0129] The storage unit 420 may also include a program / utility 4204 having a set (at least one) of program modules 4205, such program modules 4205 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0130] Bus 430 may represent one or more of several types of bus structures, including a memory unit bus or memory unit controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local bus using any of a variety of bus architectures.

[0131] The electronic device 400 may also communicate with one or more external devices 500 (e.g., keyboards, pointing devices, Bluetooth devices, etc.), may also communicate with one or more devices that enable a user to interact with the electronic device 400, and / or communicate with any device that enables the electronic device 400 to communicate with one or more other computing devices (e.g., routers, modems, etc.). Such communication may be performed via an input / output (I / O) interface 450. Furthermore, the electronic device 400 may also communicate with one or more networks (e.g., local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) via a network adapter 460. As shown, the network adapter 460 communicates with other modules of the electronic device 400 via a bus 430. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device 400, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0132] Through the description of the above implementation, it is easy for those skilled in the art to understand that the example implementation described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, including several instructions to enable a computing device (which can be a personal computer, a server, a terminal device, or a network device, etc.) to execute the method according to the implementation of the present disclosure.

[0133] In an exemplary embodiment of the present disclosure, a computer-readable storage medium is also provided, on which a program product capable of implementing the above method of the present specification is stored. In some possible implementations, various aspects of the present invention can also be implemented in the form of a program product, which includes a program code, and when the program product is run on a terminal device, the program code is used to enable the terminal device to execute the steps according to various exemplary embodiments of the present invention described in the above "Exemplary Method" section of the present specification.

[0134] refer to Figure 7 As shown, a program product 600 for implementing the above method according to an embodiment of the present invention is described, which can adopt a portable compact disk read-only memory (CD-ROM) and include program code, and can be run on a terminal device, such as a personal computer. However, the program product of the present invention is not limited thereto. In this document, a readable storage medium can be any tangible medium containing or storing a program, which can be used by or in combination with an instruction execution system, an apparatus or a device.

[0135] The program product may use any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0136] Computer readable signal media may include data signals propagated in baseband or as part of a carrier wave, in which readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Readable signal media may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0137] The program code embodied on the readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the foregoing.

[0138] Program code for performing the operations of the present invention may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving a remote computing device, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., through the Internet using an Internet service provider).

[0139] In addition, the above-mentioned figures are only schematic illustrations of the processes included in the method according to an exemplary embodiment of the present invention, and are not intended to be limiting. It is easy to understand that the processes shown in the above-mentioned figures do not indicate or limit the time sequence of these processes. In addition, it is also easy to understand that these processes can be performed synchronously or asynchronously, for example, in multiple modules.

[0140] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of the present disclosure that follow the general principles of the present disclosure and include common knowledge or customary technical means in the art that are not disclosed in the present disclosure. The specification and examples are to be considered as exemplary only, and the true scope and spirit of the present disclosure are indicated by the claims.

Claims

1. A method for troubleshooting abnormalities in business execution, characterized in that: The service includes a sequence of multiple operations executed in succession, each operation corresponds to a preset inspection rule, and the method includes: Receive an operation instruction from a user, wherein the operation instruction is an instruction for an operation in the business, the business includes an insurance business, and the operation instruction is an instruction for executing operations of the insurance business including user order recording, quotation, insurance application, order submission, invoking a financial system to issue an order, customer payment, invoking a financial account, and underwriting; Inspect the operation instruction according to the preset inspection rules corresponding to the operation in the operation instruction, and generate an inspection result log; identifying the type of the anomaly from a report of the anomaly occurring during the execution of the service, wherein the report is generated after an anomaly occurs in any operation during the execution of the service, and the report is used to indicate the type of the anomaly; Look up the abnormal type and abnormal keyword comparison table to obtain the keyword corresponding to the abnormal type; Locating the keyword in the inspection result log; Based on the keywords located in the inspection result log, based on a predetermined criterion, the abnormal log segment corresponding to the keyword in the inspection result log is located as the abnormal log segment corresponding to the type of the abnormality, the predetermined criterion comprising: taking the template segment that appears in the context of the keyword and is closest to the keyword as the abnormal log segment corresponding to the keyword, the template segment being selected from a predetermined template segment library; Wherein, if the template paragraph is before the keyword, the distance between the template paragraph and the keyword refers to the number of characters between the last character of the template paragraph and the first character of the keyword; if the template paragraph is after the keyword, the distance between the template paragraph and the keyword refers to the number of characters between the last character of the keyword and the first character of the template paragraph; if the keyword is in the template paragraph, the distance between the template paragraph and the keyword is 0; The abnormal log segment is input into a first machine learning model, and the first machine learning model outputs the cause of the abnormality, wherein the first machine learning model is trained in the following manner: each abnormal log segment sample in the abnormal log segment sample set is input into the first machine learning model, each abnormal log segment sample is pre-labeled with a known label of the abnormal cause of the abnormal log segment sample, and the first machine learning model outputs the cause of the abnormality; if the cause of the abnormality output by the first machine learning model is inconsistent with the label of the abnormal log segment sample, the first machine learning model is adjusted so that the cause of the abnormality output by the first machine learning model is consistent with the label of the abnormal log segment sample.

2. The method according to claim 1, characterized in that: After the abnormal log segment is input into a first machine learning model and the first machine learning model outputs an abnormal cause, the method further includes: Based on the cause of the exception, a comparison table of causes of exception and solutions is searched to obtain the solution corresponding to the cause of the exception.

3. The method according to claim 1, characterized in that The step of inspecting the operation instruction according to a preset inspection rule corresponding to the operation in the operation instruction and generating an inspection result log includes: Obtaining the operation name in the operation instruction; Searching the comparison table of operation name and preset inspection rule to obtain the preset inspection rule corresponding to the operation name, wherein the preset inspection rule includes the conditions that each field in the operation instruction needs to meet; Check whether each field in the operation instruction meets the conditions that the field needs to meet in the preset inspection rule; Generate a test result log based on the test results.

4. The method according to claim 2, characterized in that: The abnormality cause and solution comparison table is pre-established based on the second machine learning model, and the second machine learning model is pre-established in the following manner: Each abnormal cause sample in the abnormal cause sample library is input into the second machine learning model. Each abnormal cause sample is pre-labeled with a known solution to the abnormal cause sample. The second machine learning model outputs the determined solution. If the solution determined by the second machine learning model is inconsistent with the label of the abnormal cause sample, the second machine learning model is adjusted so that the solution determined by the second machine learning model is consistent with the label of the abnormal cause sample.

5. The method according to claim 2, characterized in that: After searching the abnormality cause and solution comparison table based on the abnormality cause and obtaining the solution corresponding to the abnormality cause, the method further includes: Based on the obtained solution, searching for a script corresponding to the solution in a pre-established script library; Execute the script corresponding to the solution.

6. A device for troubleshooting abnormalities in business execution, characterized in that: The service includes a sequence of multiple operations executed in succession, each operation corresponds to a preset inspection rule, and the device includes: a receiving unit, configured to receive an operation instruction from a user, wherein the operation instruction is an instruction for an operation in the business, the business includes an insurance business, and the operation instruction is an instruction for executing operations of the insurance business including user order recording, quotation, insurance application, order submission, invoking a financial system to issue an order, customer payment, invoking a financial account, and underwriting; A testing unit, configured to test the operation instruction according to a preset testing rule corresponding to the operation in the operation instruction, and generate a testing result log; a positioning unit, used to identify the type of the abnormality from the report of the abnormality in the execution of the service, wherein the report is generated after any operation in the execution of the service is abnormal, and the report is used to indicate the type of the abnormality; Look up the abnormal type and abnormal keyword comparison table to obtain the keyword corresponding to the abnormal type; Locating the keyword in the inspection result log; Based on the keywords located in the inspection result log, based on a predetermined criterion, the abnormal log segment corresponding to the keyword in the inspection result log is located as the abnormal log segment corresponding to the type of the abnormality, the predetermined criterion comprising: taking the template segment that appears in the context of the keyword and is closest to the keyword as the abnormal log segment corresponding to the keyword, the template segment being selected from a predetermined template segment library; Wherein, if the template paragraph is before the keyword, the distance between the template paragraph and the keyword refers to the number of characters between the last character of the template paragraph and the first character of the keyword; if the template paragraph is after the keyword, the distance between the template paragraph and the keyword refers to the number of characters between the last character of the keyword and the first character of the template paragraph; if the keyword is in the template paragraph, the distance between the template paragraph and the keyword is 0; An abnormality cause obtaining unit is used to input the abnormal log segment into a first machine learning model, and the first machine learning model outputs the abnormality cause, wherein the first machine learning model is trained in the following manner: each abnormal log segment sample in the abnormal log segment sample set is input into the first machine learning model, each abnormal log segment sample is pre-labeled with a known abnormality cause of the abnormal log segment sample, and the first machine learning model outputs the abnormality cause. If the abnormality cause output by the first machine learning model is inconsistent with the label of the abnormal log segment sample, the first machine learning model is adjusted so that the abnormality cause output by the first machine learning model is consistent with the label of the abnormal log segment sample.

7. An electronic device, comprising: a memory configured to store executable instructions; A processor configured to execute the executable instructions stored in the memory to perform the method according to any one of claims 1-5.

8. A computer-readable program medium, characterized in that The computer program instructions are stored therein, and when the computer program instructions are executed by a computer, the computer is caused to execute the method according to any one of claims 1 to 5.

Images