Abnormal analysis method, device and storage medium

Abstract

The present application provides an abnormal analysis method, device and storage medium, including: obtaining an abnormal data sequence generated by an abnormal event; using a preset clustering model to classify the abnormal data sequence to obtain at least two categories of abnormal sequences; the preset clustering model is used to obtain the abnormal type of the abnormal data sequence; performing association mining on at least two categories of abnormal sequences to obtain at least one association rule; associating at least one association rule to construct an abnormal association relationship; locating the cause of the abnormal event according to the abnormal association relationship. By classifying the anomalies and mining the association rules of the anomalies to obtain the association relationship between the anomalies, the cause of the abnormal event is located, and the clustering model can be maintained in real time to avoid feature failure, which improves the mining effect of anomalies without propagation relationship, and achieves rapid and accurate positioning of the cause of the abnormal event.

Description

Technical Field

[0001] The present application relates to the field of electronic equipment, and in particular to an abnormality analysis method, device and storage medium. Background Art

[0002] In the prior art, the analysis of the causes of equipment abnormalities is generally carried out through two means: 1) using a simple artificial fault library to diagnose abnormalities. The artificial fault library is the result of the operation and maintenance personnel accumulating a lot of manual experience to solve and solidify repeated, manually identifiable abnormalities; 2) extracting abnormal features based on abnormal data and manual experience, and generating an abnormal feature library for matching; calculating the possibility score based on the fluctuation influence of abnormal propagation to locate at which aggregation level the multi-dimensional indicator abnormality causes the multi-dimensional indicator to change.

[0003] The above scheme has the following disadvantages: the manual fault library requires a lot of manpower, the manual confirmation process is relatively slow, and manual experience deteriorates; the abnormal feature library is difficult to maintain, the accumulated features may deteriorate, and the effectiveness of the features will gradually change over time; the method of calculating the possibility score based on the fluctuation influence can only solve the single-level abnormality positioning problem, and requires that the abnormalities are propagated. Summary of the invention

[0004] The present application hopes to provide an anomaly analysis method, device and storage medium to solve the technical problems in the prior art that the artificial fault library is costly and has low diagnostic accuracy, the anomaly feature library is difficult to maintain, the feature effectiveness deteriorates over time, and the calculation based on the influence of fluctuations can only perform diagnostic analysis on single-level and highly propagable anomalies.

[0005] By classifying anomalies and mining their association rules, we can obtain the associations between anomalies and locate the causes of abnormal events. The clustering model can be maintained in real time to avoid feature failure, which improves the mining effect of anomalies with no propagation relationship and achieves the goal of quickly and accurately locating the causes of abnormal events.

[0006] To achieve the above purpose, the technical solution of this application is implemented as follows:

[0007] The present application provides an abnormality analysis method, the method comprising:

[0008] Acquire abnormal data sequences generated by at least two abnormal events;

[0009] Using a preset clustering model to classify the abnormal data sequence to obtain at least two categories of abnormal sequences; the preset clustering model is used to perform clustering processing on the abnormal data sequence;

[0010] Performing association mining on the abnormal sequences of the at least two categories to obtain at least one association rule; the antecedent and the consequent of the association in the association rule correspond to an abnormal event respectively;

[0011] Associating the at least one association rule to construct an abnormal association relationship;

[0012] According to the abnormal correlation relationship, the cause of the current abnormal event is located to obtain the abnormal analysis result.

[0013] In the above solution, before obtaining the abnormal data sequences generated by at least two abnormal events, the method further includes:

[0014] Obtaining original abnormal data generated by the abnormal event;

[0015] Performing vectorization processing on the original abnormal data to obtain an abnormal data vector;

[0016] Feature extraction is performed on the abnormal data vector to obtain the abnormal data sequence.

[0017] In the above solution, before using the preset clustering model to classify the abnormal data sequence to obtain at least two categories of abnormal sequences, the method further includes:

[0018] Get training data samples;

[0019] The training data samples are used to continuously train the initial clustering model using grid search and cross-validation methods until the output training result reaches a preset threshold, thereby obtaining the preset clustering model.

[0020] In the above solution, the association mining is performed on the abnormal sequences of the at least two categories to obtain at least one association rule, including:

[0021] Using at least two preset time windows, dividing the at least two categories of abnormal sequences to obtain at least one abnormal item set;

[0022] Using a preset association rule model, frequent item sets are mined for the at least one abnormal item set to obtain the at least one association rule that meets preset conditions; the preset association rule model is used to obtain frequent item sets from the at least one abnormal item set, and then obtain at least one association rule.

[0023] In the above solution, associating the at least one association rule to construct an abnormal association relationship includes:

[0024] Extracting the antecedent and consequent of each association rule; wherein the antecedent and consequent of each association rule correspond to an anomaly respectively;

[0025] Calculating the first distances between all preceding items and succeeding items of the at least one association rule, and determining the pointing relationship;

[0026] The abnormal association relationship is constructed according to the first distance and the corresponding pointing relationship.

[0027] In the above solution, the cause of the current abnormal event is located according to the abnormal association relationship to obtain the abnormal analysis result, including:

[0028] Reversing the pointing relationship in the abnormal association relationship to obtain a reverse abnormal association relationship;

[0029] Using a sorting algorithm to calculate all anomalies in the reverse anomaly association relationship to obtain a root cause value;

[0030] Determine a second distance between the current anomaly and other anomalies in the reverse anomaly association relationship;

[0031] According to the position of the current abnormality in the reverse abnormality association relationship, the second distance and the root cause value, the cause of the current abnormal event is located to obtain an abnormality analysis result.

[0032] In the above solution, the cause of the current abnormal event is located according to the position of the current abnormality in the reverse abnormality association relationship, the second distance and the root cause value, and the abnormality analysis result is obtained, including:

[0033] If the second distance between the position of the current abnormality and the other abnormalities is one distance unit, then determining the abnormality with the highest root cause value among the other abnormalities as the cause of the current abnormal event, and obtaining an abnormality analysis result;

[0034] If the second distance between the current abnormality and the other abnormalities is one distance unit and the root cause values ​​are all equal, it is determined that the current abnormality itself is the cause of the current abnormal event, and the abnormality analysis result is obtained.

[0035] The present application also provides an abnormality analysis device, the device comprising:

[0036] An acquisition unit, used for acquiring an abnormal data sequence generated by an abnormal event;

[0037] A classification unit, used to classify the abnormal data sequence using a preset clustering model to obtain at least two categories of abnormal sequences; the preset clustering model is used to obtain the abnormal type of the abnormal data sequence;

[0038] A mining unit, used for performing association mining on the at least two categories of abnormal sequences to obtain at least one association rule;

[0039] An association unit, used to associate the at least one association rule to construct an abnormal association relationship;

[0040] The abnormality locating unit is used to locate the cause of the abnormal event according to the abnormal association relationship.

[0041] The embodiment of the present application also provides an abnormality analysis device, the device comprising a processor, a memory and a communication bus;

[0042] The communication bus is used to realize the communication connection between the processor and the memory;

[0043] The processor is used to execute the abnormality analysis control program stored in the memory to implement any step of the above abnormality analysis method.

[0044] An embodiment of the present application further provides a storage medium on which an exception analysis program is stored. When the exception analysis program is executed by a processor, any of the above-mentioned exception analysis methods is implemented.

[0045] The embodiment of the present application provides an abnormal analysis method, device and storage medium, including: obtaining an abnormal data sequence generated by an abnormal event; using a preset clustering model to classify the abnormal data sequence to obtain at least two categories of abnormal sequences; the preset clustering model is used to obtain the abnormal type of the abnormal data sequence; performing association mining on at least two categories of abnormal sequences to obtain at least one association rule; associating at least one association rule to construct an abnormal association relationship; locating the cause of the abnormal event according to the abnormal association relationship. By classifying the abnormalities and mining the association rules of the abnormalities to obtain the association relationship between the abnormalities, the clustering model can be maintained in real time to avoid feature failure. By mining the association relationship between non-propagating abnormalities, in-depth analysis of non-propagating or poorly propagating abnormalities is achieved, the mining effect of non-propagating abnormalities is improved, and the cause of the abnormal event is quickly and accurately located. At the same time, by constructing an abnormal clustering model in the present application, a large number of abnormalities can be automatically labeled, and abnormal association relationships are constructed based on association rules, achieving a more efficient and accurate technical effect of locating the cause of the abnormal event. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 A schematic diagram of a method for analyzing abnormalities provided in an embodiment of the present application Figure 1 ;

[0047] Figure 2 A schematic diagram of a method for analyzing abnormalities provided in an embodiment of the present application Figure 2 ;

[0048] Figure 3 A timing anomaly sequence diagram of an anomaly analysis method provided in an embodiment of the present application;

[0049] Figure 4 A schematic diagram of a method for analyzing abnormalities provided in an embodiment of the present application Figure 3 ;

[0050] Figure 5 An abnormal association based on association rules of an abnormal analysis method provided in an embodiment of the present application Figure 1 ;

[0051] Figure 6 An abnormal association based on association rules of an abnormal analysis method provided in an embodiment of the present application Figure 2 ;

[0052] Figure 7 An abnormal association based on association rules of an abnormal analysis method provided in an embodiment of the present application Figure 3 ;

[0053] Figure 8 A schematic diagram of a method for analyzing abnormalities provided in an embodiment of the present application Figure 4 ;

[0054] Fig. 9 An abnormality association diagram with a default root cause value of an abnormality analysis method provided in an embodiment of the present application;

[0055] Fig.10 An abnormal correlation diagram after the reverse of an abnormal analysis method provided in an embodiment of the present application;

[0056] Fig.11 An abnormality diagnosis association diagram with root cause values ​​for an abnormality analysis method provided in an embodiment of the present application;

[0057] Fig.12 A schematic diagram of a method for analyzing abnormalities provided in an embodiment of the present application Figure 5 ;

[0058] Fig.13 A schematic diagram of an abnormal data preprocessing process of an abnormal analysis method provided in an embodiment of the present application;

[0059] Fig.14 A schematic diagram of a clustering model training process of an abnormality analysis method provided in an embodiment of the present application;

[0060] Fig.15 A schematic diagram of an association rule mining process of an abnormal analysis method provided in an embodiment of the present application;

[0061] Fig.16A schematic diagram of a root cause mining process of an abnormality analysis method provided in an embodiment of the present application;

[0062] Fig.17 A schematic diagram of an abnormality analysis device provided in an embodiment of the present application Figure 1 ;

[0063] Fig.18 A schematic diagram of an abnormality analysis device provided in an embodiment of the present application Figure 2 . DETAILED DESCRIPTION

[0064] The technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application.

[0065] like Figure 1 As shown, the embodiment of the present application provides an abnormality analysis method, including:

[0066] S101. Acquire abnormal data sequences generated by at least two abnormal events.

[0067] The abnormal data analysis method in the embodiment of the present application can be applied to a computer host, a mobile terminal, a server, or other professional devices for detection and analysis, and can monitor abnormal events occurring in the application system. The abnormal data generated when these abnormal events occur include error calls (rates), abnormal response times, system throughput and other abnormal data, wherein the abnormal data sequence is processed vector data with a standard format, and the abnormal data sequence contains data consisting of the above-mentioned abnormal information.

[0068] S102, using a preset clustering model to classify the abnormal data sequence to obtain at least two categories of abnormal sequences; the preset clustering model is used as a model for clustering the abnormal data sequence.

[0069] In the embodiment of the present application, the preset clustering model is used to classify the abnormal data sequence to obtain at least two abnormal categories existing in the abnormal data sequence.

[0070] The clustering model can adopt the K-means algorithm model. The abnormal data sequence is classified by the clustering model, and at least one abnormal label is assigned to each abnormal sequence. The abnormal label is the abnormal category in the abnormal sequence. The abnormal sequence with abnormal label obtained after classification by the clustering model contains information such as Id (serial number), timestamp (timestamp), anomaly (anomaly type), etc.

[0071] It should be noted that the K-means algorithm model is an iterative clustering analysis algorithm. Given a set of data points and the required number of clusters k, k is specified by the user, and the K-means algorithm repeatedly divides the data into k clusters according to a certain distance function. Among them, the preset clustering model is the optimized K-means algorithm model, and its parameters can also be adjusted during the classification process, and real-time maintenance and update can be performed to avoid feature failure.

[0072] S103 , performing association mining on at least two categories of abnormal sequences to obtain at least one association rule; the antecedent and the consequent of the association in the association rule correspond to an abnormal event respectively.

[0073] In the embodiment of the present application, the abnormal class obtained by the abnormal sequence classification through the clustering model may include multiple abnormal situations such as error call (rate), abnormal response time, system throughput, etc., and the association rule is used to represent the interdependence or interrelationship between two or more abnormal events, wherein the antecedent and the consequent in the association rule correspond to an abnormal event respectively, specifically, it can be the relative probability of one abnormal event occurring and another abnormal event occurring, such as the probability of the occurrence of the A2 abnormality when the A1 abnormality occurs, and the support and confidence can be used to measure this relationship. By mining association rules for multiple abnormal sequences, the potential propagation relationship existing in the abnormal sequence is mined, which improves the mining effect of the abnormalities without propagation relationship, and obtains at least one association rule that characterizes the relationship between abnormalities in the abnormal sequence.

[0074] Among them, the steps of association rule mining include: before mining, the original abnormal data needs to be sorted into abnormal sequences, and then the abnormal item sets are obtained according to the abnormal sequences according to the time window; then the frequent item sets in the abnormal item sets are mined, and then rules are generated from the frequent item sets, and association rules are given according to the confidence threshold of each rule.

[0075] S104: Associating at least one association rule to construct an abnormal association relationship.

[0076] In the embodiment of the present application, since one association rule represents the interdependence or correlation of two or more anomalies, associating multiple association rules is to find the interdependence or correlation between multiple anomalies, that is, to find the relationship between multiple anomalies that affect each other's probability of occurrence, and combining all association rules together to obtain the anomaly correlation. The anomaly correlation can be presented in the form of a data chart.

[0077] S105. According to the abnormal correlation relationship, the cause of the current abnormal event is located to obtain an abnormal analysis result.

[0078] In the embodiment of the present application, the abnormal association relationship is an association relationship in which multiple abnormalities potentially exist. By determining the position of the current abnormality in the abnormal association relationship and the relationship between the current abnormality and other abnormalities, the current abnormal event can be analyzed and located to obtain the abnormal analysis result. It should be noted that the relationship between the probability of occurrence of each other, that is, the problem of confidence, must also be considered. Of course, the solution to the confidence can also be converted to the solution of other values. For example, the occurrence of A1 abnormality is often accompanied by the occurrence of A2 or A3 abnormality, and the occurrence of A2 or A3 abnormality has a very high probability of occurrence. If A2 or A3 abnormality occurs currently, it can be determined that A1 is the cause of the current abnormality.

[0079] In the embodiment of the present application, the abnormal data sequence generated by the abnormal event is obtained; the abnormal data sequence is classified using a preset clustering model to obtain at least two categories of abnormal sequences; the preset clustering model is used to obtain the abnormal type of the abnormal data sequence; the abnormal sequences of at least two categories are associated with mining to obtain at least one association rule; at least one association rule is associated to construct an abnormal association relationship; the cause of the abnormal event is located according to the abnormal association relationship. By classifying the anomalies and mining the association rules of the anomalies to obtain the association relationship between the anomalies, the cause of the abnormal event is located, and the clustering model can be maintained in real time to avoid feature failure, which improves the mining effect of anomalies without propagation relationship, and at the same time achieves the technical effect of quickly and accurately locating the cause of the abnormal event.

[0080] In some embodiments of the present application, step S101 further includes:

[0081] S106: Acquire original abnormal data generated by the abnormal event.

[0082] The abnormal data sequence in the embodiment of the present application can also be obtained after the original abnormal data is processed, wherein the original abnormal data is the abnormal data generated in the system, and is the original abnormal data that can be collected by the analysis device. However, most of these original abnormal data exist in the form of characters, texts, etc., and a small amount exists in the form of numerical values, and the abnormal data analysis method in the embodiment of the present application needs to use data in the form of vectors as the analysis object. Therefore, after obtaining these original abnormal data, the analysis device needs to pre-process them to obtain abnormal data sequences in the form of vectors that can be used for analysis.

[0083] S107. Perform vectorization processing on the original abnormal data to obtain an abnormal data vector.

[0084] In an embodiment of the present application, before vectorizing the original abnormal data, it is sometimes necessary to preprocess the original abnormal data in such a way that the first step is to fill in the missing values ​​of the original abnormal data. The original abnormal data collected by the analysis device often contains spaces, NaNs (NotaNumber, a type of value of a numeric data type, indicating an undefined or unrepresentable value), or other placeholders. When using an incomplete data set, a common strategy that needs to be adopted is to discard the entire row or column of data containing missing values. However, this comes at the cost of discarding potentially valuable data (even if the incomplete rows or columns contain some valuable data). A better strategy for handling missing values ​​is to infer the missing values ​​from the existing data. The method used here is to take the average value (mean) of the 6 non-missing values ​​before the current time point where the missing value is located.

[0085] It should be noted that sometimes it is also necessary to perform standardization on the original abnormal data. Data standardization and normalization are a basic work of data mining. Different evaluation indicators often have different dimensions and dimensional units. Such a situation will affect the results of data analysis. In order to eliminate the dimensional influence between indicators, data standardization is required to solve the comparability between data indicators. After data standardization, each indicator can be in the same order of magnitude, which is suitable for comprehensive comparative evaluation. In the embodiment of the present application, due to the different types of original abnormal data, including characters, texts, numerical values ​​and other types, after the original abnormal data is processed for missing values ​​to obtain complete abnormal data, it is necessary to perform standardization on it again, and a unified numerical type can be used for calculation. Commonly used data standardization methods such as min-max standardization (Min-maxnormalization, also known as 0-1 standardization) and z-score standardization (Z standardization) are used.

[0086] Among them, the original abnormal data is processed by text feature vectorization, and the standard abnormal data is converted into an abnormal data vector in vector form, including feature extraction through FeatureHasher (a high-speed, low-storage vectorized class), OneHotEncoder (one-hot encoding) and other methods, and the obtained abnormal data vector is a multi-dimensional vector.

[0087] S108. Perform feature extraction on the abnormal data vector to obtain an abnormal data sequence.

[0088] In an embodiment of the present application, the abnormal data sequence ultimately used for subsequent association rule mining is some abnormal data that is representative of the original abnormal data. By selecting the corresponding representative features of the original abnormal data from the abnormal data vector and reducing the feature dimension, the multi-dimensional abnormal data vector is decomposed into N sequences as the abnormal data sequence to participate in model training.

[0089] It should be noted that the chi-square feature selection method is used for feature selection in the embodiment of the present application. The most basic idea of ​​chi-square feature selection is to determine whether the theory is correct by observing the deviation between the actual value and the theoretical value. When doing it specifically, it is often assumed that the two variables are indeed independent (first assume that they are representative) abnormal data sequences, and then observe the degree of deviation between the actual value and the theoretical value. If the deviation is small enough, we think that the error is a very natural sample error, and then accept the null hypothesis; if the deviation is large enough, making it unlikely that such an error is caused by chance or inaccurate measurement, we think that the two are actually related, that is, the null hypothesis is rejected, and the alternative hypothesis is accepted, so that the abnormal data sequence participating in the subsequent abnormal analysis is representative.

[0090] In some embodiments of the present application, before step S102, a training data sample is obtained; using the training data sample, the initial clustering model is continuously trained using a grid search and cross-validation method until the output training result reaches a preset threshold, thereby obtaining a preset clustering model.

[0091] In the embodiment of the present application, before the K-means clustering model is formally used for classification, the clustering model needs to be trained to ensure the classification accuracy. The training data sample can be the current abnormal sequence or the historical abnormal sequence. The training steps include: creating a clustering model; setting the method of calculating the distance in the Kmeans algorithm to squared Euclidean (Euclidean distance); setting initial parameters, including the selection of evaluation indicators, start and end values, step length, starting K value, etc. The evaluation indicator of the training model in the embodiment of the present application is silhouette (contour coefficient), and the silhouette coefficient corresponding to the best clustering model should be at least greater than 0.8; Substitute the abnormal data sequence into the initial clustering model, and traverse and find the best K value through the GridSearch (grid search) method, wherein the K value corresponding to the minimum Euclidean distance calculated by the distance calculation method is the best K value. After finding the best K value, use the CrossValidation (cross validation) method to continue training the clustering model until the best clustering model that meets the silhouette coefficient requirements is trained as the preset clustering model.

[0092] It should be noted that the silhouette coefficient is a similarity measure and an evaluation index of the density and dispersion of clusters. The value of the silhouette coefficient is between -1 and 1. The closer the value is to 1, the more compact the cluster is and the better the clustering is. When the silhouette coefficient is close to 1, the cluster is compact and far away from other clusters. If the silhouette coefficient is close to 1, it means that the sample clustering is reasonable; if the silhouette coefficient is close to -1, it means that the sample should be classified into another cluster; if the silhouette coefficient is approximately 0, it means that the sample is on the boundary of two clusters. The mean of the silhouette coefficients of all samples is called the clustering result silhouette coefficient, which is a measure of whether the clustering is reasonable and effective.

[0093] Among them, some clustering model training codes are as follows:

[0094] Pipeline pipeline=new Pipeline()

[0095] .setStages(new PipelineStage[]{kmeans});

[0096] / / Create K-means stream pipeline

[0097] ParamMap[]paramGrid=new ParamGridBuilder()

[0098] .addGrid(kmeans.k(),MLCommonUtil.range(start:6,end:26,step:1))

[0099] .build0;

[0100] / / Set the step size

[0101] CrossValidator cv=new CrossValidator()

[0102] .setEstimator(pipeline)

[0103] .setEvaluator(new ClusteringEvaluator().setMetricName("silhouette")

[0104] .setDistanceMeasure("squaredEuclidean"))

[0105] .setEstimatorParamMaps(paranGrid)

[0106] .setNumFo1ds(3)

[0107] .setParallelism(10);

[0108] / / Select parameters, silhouette coefficient, Euclidean distance

[0109] CrossValidatorModel crossValidatorModel = cv.fit(featurized);

[0110] In some embodiments of the present application, as Figure 2 shown, step S103 further includes:

[0111] S1031. Use at least two preset time windows to divide the abnormal sequences of at least two categories to obtain at least one abnormal item set;

[0112] In the embodiments of the present application, as Figure 3 shown, if it is assumed that the abnormal sequence S represents multiple ordered abnormal information, expressed as S=(s, ST, ET), s is the sequence, ST is the start time of the sequence, and ET is the end time of the sequence, then the abnormal sequence s is composed of multiple ordered abnormal items A(t) (where A is the abnormal class monitoring item and t is the time when the abnormality occurs). The abnormal sub-items on the abnormal sequence S=(s, ST, ET) can be expressed as W=(w, st, et), st≤t<et, where t is the time when the abnormality occurs, and w = et–st is called the time window. If a fixed time window w1 is given, the abnormal item set can be divided and obtained. In the association mining process, it is necessary to mine the association rules for the abnormalities in multiple time windows to avoid the situation where the association relationship between abnormalities across time is not mined due to a single time window. If it is assumed that two time windows w1 and w2 are used to divide the abnormal sequence S, then the final abnormal item set can be expressed as AS={(w1, st, et), (w2, st, et)}.

[0113] Suppose there is abnormal data as shown in Table 1,

[0114] Table 1

[0115]

[0116]

[0117] 1). Set the abnormal division time window to 1 minute unit, then the part of the abnormal item set obtained by dividing it is shown in Table 2,

[0118] Table 2

[0119]

[0120] 2) Set the abnormal division time window to 5 minutes, and divide it to obtain the abnormal item set as shown in Table 3.

[0121] Table 3

[0122]

[0123] 3) Combine the abnormal item sets of the above two time windows to obtain the final abnormal item set as shown in Table 4.

[0124] Table 4

[0125] Serial number Abnormal sub-item set 1 1，2，3，0，8，10，4 2 1，12，2，3，0，8 3 5 4 7 5 1，2，3，0，8，10，4，12 6 5 7 7

[0126] S1032. Perform frequent item set mining on at least one abnormal item set using a preset association rule model to obtain at least one association rule that meets preset conditions. The preset association rule model is used to obtain frequent item sets from at least one abnormal item set, and then obtain at least one association rule.

[0127] In the embodiment of the present application, the second step of association mining is to substitute the obtained abnormal item set into the association rule algorithm model for mining, and obtain at least one association rule between abnormal item sets. The association rule algorithm can adopt the FP-growth algorithm (an association analysis algorithm proposed by Han Jiawei et al., which compresses the database providing frequent item sets into a frequent pattern tree, but still retains the item set association information), and part of the code is as follows:

[0128]

[0129]

[0130] When mining strong association rules, the prominent role of strong association rules often results in the masking of favorable secondary strong association rules to be mined and processed. Therefore, the minimum support and minimum confidence set when mining strong association rules can be appropriately lowered to filter out weakly associated rules. The minimum support and minimum confidence thresholds can also be adjusted according to actual conditions. The effectiveness of the final rule can be judged by confidence and lift. Generally speaking, the closer the confidence is to 1, the better; lift greater than 1 indicates a positive correlation, less than 1 indicates a negative correlation, and equal to 1 indicates no correlation. Specifically, in the embodiment of the present application, the minimum support is set to 0.2 and the minimum confidence is set to 0.5 in the FP-growth algorithm model. Based on the implementation method described in the previous step, for example, mining the association rule A1→A2 indicates that after the A1 abnormal event occurs, the A2 abnormal event will also occur, or the cause of the A2 abnormal event is the occurrence of the A1 abnormal event.

[0131] In some embodiments of the present application, Figure 4 As shown, step S104 also includes:

[0132] S1041, extracting the antecedent and consequent of each association rule; the antecedent and consequent of each association rule correspond to an anomaly respectively;

[0133] S1042, calculating the first distances between all antecedents and consequents of at least one association rule, and determining the directional relationship;

[0134] S1043: Construct an abnormal association relationship according to the first distance and the corresponding directional relationship.

[0135] The abnormal association relationship referred to in the embodiments of the present application is a relationship of mutual dependence or mutual association between multiple anomalies, and the abnormal association relationship can be presented in the form of a data chart, such as an abnormal association table or an abnormal association diagram. Based on the mined association rules, the single item sets of the antecedent and consequent of each association rule that meets the preset conditions are extracted and organized into the following format, wherein all association rules can preferably be organized into a format with a common consequent, such as "[A], 1.0", where A is the abnormal class (with uniqueness) and 1.0 is the confidence level. The preset condition refers to the association rule that should meet the preset confidence level.

[0136] Specifically, for example, after the association rules are extracted, an abnormal association table such as Table 5 is obtained.

[0137] Table 5

[0138] [A1]→[A6] 1.0 [A2] → [A6] 1.0 [A5] → [A6] 1.0 [A1]→[A7] 1.0 [A2] → [A7] 1.0 [A3] → [A7] 1.0 [A7] → [A3] 1.0 [A2] → [A3] 1.0 [A5] → [A3] 1.0 [A1]→[A2] 1.0 [A2] → [A3] 1.0 [A3] → [A4] 1.0 [A4] → [A7] 1.0 [A7] → [A5] 1.0 [A7] → [A3] 1.0 [A2] → [A3] 1.0 [A5] → [A3] 1.0 [A1]→[A2] 1.0 [A2] → [A3] 1.0 [A3] → [A4] 1.0 [A4] → [A7] 1.0

[0139] The antecedent and the consequent respectively correspond to an abnormal type, wherein the abnormal association table and the abnormal association graph can be converted to each other. For example, according to [A1]→[A6], 1.0, [A2]→[A6], 1.0, [A5]→[A6], 1.0, it can be known that [A1], [A2], [A5] are respectively "1" away from [A6], or the first distance is one unit, wherein the first distance indicates whether the items in the association rule are reachable. If there are other abnormalities between a certain antecedent and the consequent, the first distance is not "1", and they are not reachable, which is shown in the abnormal association graph as follows Figure 5 As shown, based on [A1]→[A7], 1.0, [A2]→[A7], 1.0, [A3]→[A7], 1.0, the following can be generated: Figure 6 As shown in the association diagram, and so on, according to other mined abnormal association rules, a complex abnormal association map can be established, such as Figure 7 shown.

[0140] It should be noted that the anomaly association graph is composed of nodes and edges, where different nodes represent different types of anomalies in the association rules, and the nodes are connected by edges. Since the association rules are directed, the edges may be directional or non-directional.

[0141] In some embodiments of the present application, Figure 8 As shown, step S105 also includes:

[0142] S1051, reversing the pointing relationship in the abnormal association relationship to obtain a reverse abnormal association relationship;

[0143] In the embodiment of the present application, if it is embodied in the form of an abnormal association table, reversing the directional relationship in the abnormal association relationship means swapping the positions of the previous and next items in the abnormal association table, for example, [A1]→[A6], 1.0 is reversed to [A6]→[A1], 1.0. In the abnormal association graph, the direction of the edges between different nodes on the way is reversed.

[0144] S1052. Calculate all anomalies in the reverse anomaly association relationship using a sorting algorithm to obtain a root cause value;

[0145] In the embodiment of the present application, before calculating the root cause value of all anomalies in the reverse anomaly association relationship, it is also necessary to set the initial default value of each anomaly (point): Generally, if there is an association rule such as A1→A2, from the historical information, it can be seen that the occurrence of A1 anomaly is always accompanied by the occurrence of A2 anomaly, then A1 anomaly can be considered to be the root cause anomaly of A2 anomaly. If A1 and A2 anomalies occur at the same time in the time window, then the root cause of A2 anomaly can be quickly located as A1. In this case, the root cause value of A1 should be higher than A2. However, in order to be able to calculate the root cause value of each abnormal node, the default value of each abnormal node can be set to 1.0 at the beginning, and the following can be obtained: Fig. 9 Anomaly correlation graph with default root cause values ​​shown.

[0146] Then, the abnormal association graph is inverted according to the mutual relationship between the association rules: Since the directional relationship in the abnormal association graph is drawn according to the mutual relationship between the association rules, the process of finding the root cause is a reverse process, so the abnormal association graph needs to be inverted. The reverse abnormal association graph after inversion is as follows: Fig.10 shown.

[0147] S1053, determining a second distance between the current anomaly and other anomalies in the reverse anomaly association relationship;

[0148] S1054. According to the position of the current abnormality in the reverse abnormality association relationship, the second distance and the root cause value, locate the cause of the current abnormal event and obtain the abnormality analysis result.

[0149] In the embodiment of the present application, the second distance between the current anomaly and other anomalies in the reverse anomaly association relationship is only a reference value, such as one unit, separated by one anomaly or node. The calculation method of the anomaly association table and the anomaly association graph is the same, which is used to determine whether the current anomaly and other anomalies have a common anomaly (node) or anomalies (nodes) that are reachable at the same time.

[0150] It should be noted that a sorting algorithm is used to calculate the root cause value of the inverted abnormal association graph and generate a diagnostic model: In the embodiment of the present application, the PageRank (web page ranking is a technology calculated based on the hyperlinks between web pages, and is one of the elements of web page ranking) sorting algorithm is used to calculate the root cause value. The link analysis algorithm proposed by PageRank analyzes the incoming links of all web pages. The web pages with more inlinks and higher quality inlinks are more important. For example, the more times a paper is cited, the more important the paper is; the more important papers cite it, the more important the paper is. The root cause to be found here is exactly the opposite, which is to find nodes with more degrees and better outgoing quality. Therefore, the direction of all edges of the original association graph must be reversed, and then PageRank is used to calculate the root cause value. The diagnostic model finally formed after the root cause calculation by the PageRank algorithm is as follows. Fig.11 As shown, that is, an abnormal diagnosis association diagram with root cause values, through which the diagnosis model can efficiently perform abnormal root cause analysis and quickly locate the abnormality.

[0151] Among them, to locate the cause of the abnormal event according to the abnormal association relationship, it is necessary to first determine the location of the abnormality and the root cause value of the abnormality, and then find the abnormalities that can be reached by the above abnormality and other abnormalities in the diagnosis model, as well as the root cause values ​​of the abnormalities that can be reached by the above abnormality and the diagnosis model. For example, if the A6 and A7 abnormalities occur within a time window, the analysis device first confirms the location of the A6 and A7 abnormalities in the diagnosis model (the above location can be a relative location). If the A6 and A7 abnormalities can reach A5, and the root cause value of A5 is higher than the root cause value of A6 and A7, then A5 is determined to be the root cause of the A6 and A7 abnormalities.

[0152] In some embodiments of the present application, if the second distance between the location of the current abnormality and the locations of other abnormalities is the closest to one distance unit, then the abnormality with the highest root cause value among the other abnormalities is determined to be the cause of the current abnormal event, and the abnormality analysis result is obtained; if the second distance between the current abnormality and the other abnormalities is the closest to one distance unit and the root cause values ​​are equal, then the current abnormality itself is determined to be the cause of the current abnormal event, and the abnormality analysis result is obtained.

[0153] In an embodiment of the present application, the method for determining the cause of an abnormal event specifically includes: confirming whether there are reachable nodes between the current abnormal nodes that have occurred within the time window, confirming the position of the current abnormality in the abnormal diagnosis association diagram or the abnormal diagnosis model, wherein the second distance is "1" or the second distance is one distance unit, indicating that it is reachable, and if there is a reachable node, finding all nodes in the reachable shortest path, and taking the node with the highest root cause value as the root cause abnormality of these nodes (the root cause value is the highest, which may include multiple root causes): for example, Fig.11 As shown, for example, if A1 and A2 anomalies occur within a time window, it can be inferred that A5 is the root cause anomaly; if A6 and A7 anomalies occur, the root cause anomaly A5 can be recommended to check whether A5 anomaly occurs.

[0154] If the abnormal node that has occurred and the nodes in other time windows are unreachable, the node with the highest adjacent root cause value is recommended as the root cause of the abnormality: for example, if abnormalities A3, A4, and A7 occur in the time window, then A4 is the root cause of the abnormality.

[0155] If the node with the highest root cause value is not found in the first two cases (that is, all node root cause values ​​are equal), the abnormal node itself is the root cause abnormality.

[0156] like Fig.12 As shown, the embodiment of the present application also provides an abnormality analysis method, comprising the following steps:

[0157] 1) If Fig.13 As shown, data preprocessing includes:

[0158] a. Missing value processing: The first step of the detection and analysis device to preprocess the original abnormal data is to fill in the missing values ​​of the original abnormal data. Fill in the missing values ​​of the original data. The data contains spaces, NaNs, or other placeholders. A basic strategy for using incomplete data sets is to discard the entire row or column of data containing missing values. However, this comes at the cost of discarding potentially valuable data (even if incomplete). A better strategy for handling missing values ​​is to infer the missing values ​​from the existing data. The method used here is to take the average of the 6 non-missing values ​​before the current time point where the missing value is located.

[0159] b. Normalization: Data standardization and normalization processing are basic tasks of data mining. Different evaluation indicators often have different dimensions and dimensional units, which will affect the results of data analysis. In order to eliminate the dimensional impact between indicators, data standardization is required to solve the comparability between data indicators. After the original data is processed by data standardization, each indicator is at the same order of magnitude, which is suitable for comprehensive comparative evaluation.

[0160] c. Text vectorization: Text feature vectorization is to vectorize the text features in the abnormal information (through FeatureHasher feature extraction, OneHotEncoder and other methods).

[0161] d. Feature selection: Feature selection is to select representative features from sample features to reduce feature dimensions for model training. Here, we use the chi-square feature selection method to select features and finally obtain the abnormal sequence for training.

[0162] 2) Abnormal association mining:

[0163] a. Anomaly classification: The classification and labeling of abnormal sequences requires the use of a clustering model. The clustering model training process is as follows: Fig.14 As shown, including:

[0164] The K-means algorithm model is used for clustering model selection. K-means is generally used in the early stage of data analysis. After selecting an appropriate k, the data is classified, and then the characteristics of the data under different clusters are studied to cluster the common data.

[0165] Set the distance calculation method in the Kmeans algorithm to squared Euclidean (Euclidean distance);

[0166] Use the GridSearch method to traverse and find the best K value;

[0167] The training process uses the CrossValidation method for training;

[0168] The silhouette coefficient is used as the evaluation index for the training model. The model with the best silhouette coefficient is selected from the training, which should be at least greater than 0.8.

[0169] b. The process of association mining is as follows Fig.15 As shown, including:

[0170] Through abnormal clustering processing, the abnormal sequence is clustered into k types of abnormal data;

[0171] Sort the original abnormal data in chronological order, label them according to k categories, and set a fixed time window;

[0172] Based on the setting of time window, the abnormal item set is divided;

[0173] Establish the Fp-growth algorithm model, and set the minimum support of 0.2 and the minimum confidence of 0.5 (used to filter out weakly associated rules, and the threshold can be adjusted according to the actual situation;

[0174] The training model generates strong anomaly association rules;

[0175] Get association rules that meet the confidence and lift requirements.

[0176] c. Association graph construction: Based on the abnormal association rules mined from association rules, extract the antecedent and backward single item sets that meet the confidence and lift. Based on these item sets, the abnormal association relationships are represented by graphs to form an association graph.

[0177] 3) The process of root cause mining is as follows Fig.16 As shown, including:

[0178] According to the abnormal association rules, extract the item sets that meet the confidence and lift conditions, build the abnormal association graph based on the item sets, take the reverse graph of the association graph, use the PageRank algorithm to calculate the root cause value of the reverse association graph, and finally form the root cause diagnosis graph, that is, the root cause diagnosis model, and then find out the abnormality in a certain time window. According to the root cause diagnosis graph, query the root cause in the diagnosis graph to locate the root cause of the current abnormality.

[0179] like Fig.17 As shown, the embodiment of the present application provides an abnormality analysis device 2, comprising:

[0180] An acquisition unit 201 is used to acquire abnormal data sequences generated by at least two abnormal events;

[0181] The classification unit 202 is used to classify the abnormal data sequence using a preset clustering model to obtain at least two categories of abnormal sequences; the preset clustering model is used as a model for clustering the abnormal data sequence;

[0182] A mining unit 203 is used to perform association mining on at least two categories of abnormal sequences to obtain at least one association rule; the antecedent and the consequent of the association in the association rule correspond to an abnormality respectively;

[0183] The association unit 204 is used to associate at least one association rule to construct an abnormal association relationship;

[0184] The abnormality locating unit 205 is used to locate the cause of the current abnormal event according to the abnormal association relationship to obtain the abnormality analysis result.

[0185] In some embodiments of the present application, the abnormality analysis device 2 further includes:

[0186] The acquisition unit 201 is also used to acquire the original abnormal data generated by the abnormal event;

[0187] The classification unit 202 is also used to perform vectorization processing on the original abnormal data to obtain an abnormal data vector;

[0188] The classification unit 202 is also used to extract features from the abnormal data vector to obtain an abnormal data sequence.

[0189] In some embodiments of the present application, the abnormality analysis device 2 further includes:

[0190] The acquisition unit 201 is also used to acquire training data samples;

[0191] The classification unit 202 is also used to adopt training data samples, use grid search and cross-validation methods to continuously train the initial clustering model until the output training result reaches a preset threshold, thereby obtaining a preset clustering model.

[0192] In some embodiments of the present application, the abnormality analysis device 2 further includes:

[0193] The mining unit 203 is further configured to use at least two preset time windows to divide at least two categories of abnormal sequences to obtain at least one abnormal item set;

[0194] The mining unit 203 is also used to perform frequent item set mining on at least one abnormal item set using a preset association rule model to obtain at least one association rule that meets preset conditions; the preset association rule model is used to obtain frequent item sets from at least one abnormal item set, and then obtain at least one association rule.

[0195] In some embodiments of the present application, the abnormality analysis device 2 further includes:

[0196] The association unit 204 is also used to extract the antecedent and consequent of the association of each association rule;

[0197] The association unit 204 is further configured to calculate the first distances between all preceding items and succeeding items of at least one association rule, and determine the pointing relationship;

[0198] The association unit 204 is further configured to construct an abnormal association relationship according to the first distance and the corresponding directional relationship.

[0199] In some embodiments of the present application, the abnormality analysis device 2 further includes:

[0200] The abnormality locating unit 205 is also used to reverse the pointing relationship in the abnormal association relationship to obtain a reverse abnormal association relationship;

[0201] The anomaly locating unit 205 is further configured to calculate all anomalies in the reverse anomaly association relationship using a sorting algorithm to obtain a root cause value;

[0202] The anomaly locating unit 205 is also used to determine a second distance between the current anomaly and other anomalies in the reverse anomaly association relationship;

[0203] The anomaly locating unit 205 is also used to locate the cause of the current abnormal event according to the position of the current abnormality in the reverse abnormality association relationship, the second distance and the root cause value, and obtain the abnormality analysis result.

[0204] In some embodiments of the present application, the abnormality analysis device 2 further includes:

[0205] If the second distance between the location of the current abnormality and the other abnormalities is one distance unit, the abnormality locating unit 205 is further used to determine the abnormality with the highest root cause value as the cause of the current abnormal event to obtain an abnormality analysis result;

[0206] If the second distance between the current anomaly and other anomalies is one distance unit and the root cause values ​​are all equal, the anomaly locating unit 205 is further used to determine that the current anomaly itself is the cause of the current abnormal event, and obtain an anomaly analysis result.

[0207] like Fig.18 As shown, the embodiment of the present application provides a management device 3, including a processor 301, a memory 302 and a communication bus 303;

[0208] The communication bus 303 is used to realize the communication connection between the processor 301 and the memory 302;

[0209] The processor 301 is used to execute the abnormality analysis program stored in the memory to implement any of the above abnormality analysis methods.

[0210] In an embodiment of the present application, the processor 301 may be at least one of an application-specific integrated circuit (ASIC), a digital signal processor (DSP), a digital signal processing device (DSPD), a programmable logic device (PLD), a field programmable gate array (FPGA), a CPU, a controller, a microcontroller, and a microprocessor. It is understandable that for different devices, the electronic device used to implement the function of the processor 301 may also be other, and the embodiment of the present application is not limited. The abnormal analysis device also includes a memory 302, which can be connected to the processor 301. Among them, the memory 302 may include a high-speed RAM memory, and may also include a non-volatile memory, for example, at least two disk memories.

[0211] In practical applications, the memory 302 may be a volatile memory, such as a random access memory (RAM); or a non-volatile memory, such as a read-only memory (ROM), a flash memory, a hard disk drive (HDD) or a solid-state drive (SSD); or a combination of the above types of memories, and provide instructions and data to the processor 301.

[0212] In addition, each functional module in the embodiment of the present application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The above integrated unit can be implemented in the form of hardware or in the form of software functional modules.

[0213] Among them, if the integrated unit is implemented in the form of a software function module and is not sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiment of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, server, or network device, etc.) or a processor to perform all or part of the steps of the method of the embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory, random access memory, disk or optical disk and other media that can store program codes.

[0214] Therefore, an embodiment of the present application further provides a computer-readable storage medium on which a vulnerability scanning program is stored. When the computer program is executed by one or more first processors, a vulnerability scanning method on the management device side is implemented.

[0215] An embodiment of the present application also provides a computer-readable storage medium on which a vulnerability scanning program is stored. When the computer program is executed by one or more second processors, a node-side vulnerability scanning method is implemented.

[0216] The computer-readable storage medium may be a volatile memory, such as a random-access memory (RAM); or a non-volatile memory, such as a read-only memory (ROM), a flash memory, a hard disk drive (HDD) or a solid-state drive (SSD); or it may be a respective device including one or any combination of the above memories, such as a mobile phone, a computer, a tablet device, a personal digital assistant, etc.

[0217] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of hardware embodiments, software embodiments, or embodiments in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage and optical storage, etc.) that contain computer-usable program code.

[0218] The present application is described with reference to implementation flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the process in the flowchart. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0219] These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device, which is implemented in the implementation flow diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0220] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operation steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for executing the steps in the flowchart. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0221] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions that can be easily thought of by any technician familiar with the technical field within the technical scope disclosed in the utility application should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. An abnormality analysis method, characterized in that: The method comprises: Acquire abnormal data sequences generated by at least two abnormal events; Using a preset clustering model to classify the abnormal data sequence to obtain at least two categories of abnormal sequences; the preset clustering model is used to perform clustering processing on the abnormal data sequence; Performing association mining on the abnormal sequences of the at least two categories to obtain at least one association rule; the antecedent and the consequent of the association in the association rule correspond to an abnormal event respectively; The performing association mining on the abnormal sequences of the at least two categories to obtain at least one association rule includes: Using at least two preset time windows, dividing the at least two categories of abnormal sequences to obtain at least one abnormal item set; Using a preset association rule model, performing frequent item set mining on the at least one abnormal item set to obtain the at least one association rule that meets a preset condition; the preset association rule model is used to obtain frequent item sets from the at least one abnormal item set, and then obtain the at least one association rule; Associating the at least one association rule to construct an abnormal association relationship; According to the abnormal correlation relationship, the cause of the current abnormal event is located to obtain the abnormal analysis result.

2. The method according to claim 1, characterized in that The obtaining of abnormal data sequences generated by at least two abnormal events includes: Obtaining original abnormal data generated by the abnormal event; Performing vectorization processing on the original abnormal data to obtain an abnormal data vector; Feature extraction is performed on the abnormal data vector to obtain the abnormal data sequence.

3. The method according to claim 1 or 2, characterized in that: Before the abnormal data sequence is classified using a preset clustering model to obtain at least two categories of abnormal sequences, the method further includes: Get training data samples; The training data samples are used to continuously train the initial clustering model using grid search and cross-validation methods until the output training result reaches a preset threshold, thereby obtaining the preset clustering model.

4. The method according to claim 1, characterized in that: The step of associating the at least one association rule to construct an abnormal association relationship includes: Extract the antecedent and consequent of each association rule; Calculating the first distances between all preceding items and succeeding items of the at least one association rule, and determining the pointing relationship; The abnormal association relationship is constructed according to the first distance and the corresponding pointing relationship.

5. The method according to claim 4, characterized in that The method of locating the cause of the current abnormal event according to the abnormal association relationship to obtain an abnormal analysis result includes: Reversing the pointing relationship in the abnormal association relationship to obtain a reverse abnormal association relationship; Using a sorting algorithm to calculate all anomalies in the reverse anomaly association relationship to obtain a root cause value; Determine a second distance between the current anomaly and other anomalies in the reverse anomaly association relationship; According to the position of the current abnormality in the reverse abnormality association relationship, the second distance and the root cause value, the cause of the current abnormal event is located to obtain an abnormality analysis result.

6. The method according to claim 5, characterized in that The method of locating the cause of the current abnormal event according to the position of the current abnormal event in the reverse abnormal association relationship, the second distance, and the root cause value, and obtaining the abnormality analysis result includes: If the second distance between the position of the current abnormality and the other abnormalities is one distance unit, then determining the abnormality with the highest root cause value among the other abnormalities as the cause of the current abnormal event, and obtaining an abnormality analysis result; If the second distance between the current abnormality and the other abnormalities is one distance unit and the root cause values ​​are all equal, it is determined that the current abnormality itself is the cause of the current abnormal event, and the abnormality analysis result is obtained.

7. An abnormality analysis device, characterized in that: The device comprises: An acquisition unit, used for acquiring abnormal data sequences generated by at least two abnormal events; A classification unit, used to classify the abnormal data sequence using a preset clustering model to obtain abnormal sequences of at least two categories; the preset clustering model is used as a model for clustering the abnormal data sequence; A mining unit is used to divide the abnormal sequences of the at least two categories by using at least two preset time windows to obtain at least one abnormal item set; use a preset association rule model to perform frequent item set mining on the at least one abnormal item set to obtain the at least one association rule that meets the preset conditions; the preset association rule model is used to obtain frequent item sets from the at least one abnormal item set, and then obtain the at least one association rule; the antecedent and the consequent of the association in the association rule respectively correspond to an abnormal event; An association unit, used to associate the at least one association rule to construct an abnormal association relationship; The abnormality locating unit is used to locate the cause of the current abnormal event according to the abnormal association relationship to obtain an abnormality analysis result.

8. An abnormality analysis device, characterized in that: The device includes a processor, a memory, and a communication bus; The communication bus is used to realize the communication connection between the processor and the memory; The processor is used to execute the control program of the abnormality analysis method stored in the memory to implement the method according to any one of claims 1 to 6.

9. A storage medium having an exception analysis program stored thereon, wherein the exception analysis program, when executed by a processor, implements the method according to any one of claims 1 to 6.

Images