Fault detection methods and devices

Abstract

The present application discloses a fault detection method and device, which belongs to the field of data processing technology. The method includes: obtaining the first log data of the target device and the second log data of the associated device; performing word vector conversion processing on the first log data and the second log data respectively, obtaining the first log vector corresponding to the first log data and the second log vector corresponding to the second log data; predicting the log vector of the target device at a preset fault prediction time according to the first log vector and the second log vector, and obtaining the third log vector; obtaining the fault prediction information of the target device according to the third log vector. The method predicts the log vector of the target device according to the log data of the target device itself and the log data of the associated device, which can improve the accuracy of the predicted log vector, thereby obtaining more accurate fault prediction information according to the predicted log vector, so as to timely know the operation status of the system.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular to a fault detection method and device. Background Art

[0002] Operation logs are log information generated during the operation of the system. By analyzing the operation logs, the operation status of the system can be obtained. However, for newly deployed or newly developed systems, due to the short operation time, fewer operation logs are generated. Therefore, it is impossible to fully and accurately understand the operation status of the system, and thus it is impossible to fully and accurately detect system failures. Summary of the invention

[0003] To this end, the present application provides a fault detection method and device to solve the problem that system faults cannot be fully and accurately detected when there is a lack of system operation logs.

[0004] In order to achieve the above object, the first aspect of the present application provides a fault detection method, the method comprising:

[0005] Acquire first log data of a target device and second log data of an associated device, wherein the associated device is a device associated with an operating state of the target device;

[0006] Performing word vector conversion processing on the first log data and the second log data respectively to obtain a first log vector corresponding to the first log data and a second log vector corresponding to the second log data;

[0007] Predicting a log vector of the target device at a preset fault prediction time according to the first log vector and the second log vector to obtain a third log vector;

[0008] Fault prediction information of the target device is obtained according to the third log vector.

[0009] Further, the obtaining of the first log data of the target device and the second log data of the associated device includes:

[0010] Obtaining device topology information corresponding to the target device;

[0011] Determining associated devices of the target device according to the device topology information;

[0012] Determine the log data of the target device at a first preset time, and obtain the first log data;

[0013] The log data of the associated device at a second preset time is determined to obtain the second log data.

[0014] Further, determining the associated devices of the target device according to the device topology information includes:

[0015] According to the device topology information, associated devices of the target device are determined by a breadth search algorithm.

[0016] Further, the performing word vector conversion processing on the first log data and the second log data respectively to obtain a first log vector corresponding to the first log data and a second log vector corresponding to the second log data includes:

[0017] Performing one-hot encoding on the first log data to obtain a set of first one-hot encodings;

[0018] Performing one-hot encoding on the second log data to obtain a set of second one-hot encodings;

[0019] Inputting the first one-hot encoding and the second one-hot encoding into a preset word vector model to obtain a set of first log word vectors and a set of second log word vectors; wherein the word vector model is a model obtained through training and has a function of converting one-hot encoding into word vectors, the first log word vector is a word vector corresponding to the first one-hot encoding, and the second log word vector is a word vector corresponding to the second one-hot encoding;

[0020] Concatenate the first log word vectors to obtain the first log vector;

[0021] The second log word vectors are concatenated to obtain the second log vector.

[0022] Furthermore, the preset fault prediction time and the first preset time are separated by a preset time length.

[0023] Further, obtaining the fault prediction information of the target device according to the third log vector includes:

[0024] Obtaining a predicted device state vector of the target device according to the third log vector;

[0025] Fault prediction information of the target device is determined according to the predicted device state vector.

[0026] Further, obtaining a predicted device state vector of the target device according to the third log vector includes:

[0027] Inputting the third log vector into a preset device state prediction model to obtain a predicted device state vector of the target device;

[0028] The device state prediction model is a model with a predicted device state vector obtained through training.

[0029] Further, after obtaining the fault prediction information of the target device according to the third log vector, the method further includes:

[0030] When the fault prediction information indicates that a fault exists, a fault warning prompt signal is issued.

[0031] In order to achieve the above-mentioned object, the second aspect of the present application provides a fault detection device, which includes:

[0032] a log data acquisition module, configured to acquire first log data of a target device and second log data of an associated device, wherein the associated device is a device associated with an operating state of the target device;

[0033] a log vector acquisition module, configured to perform word vector conversion processing on the first log data and the second log data respectively, to obtain a first log vector corresponding to the first log data and a second log vector corresponding to the second log data;

[0034] a prediction log acquisition module, configured to predict the log vector of the target device at a preset fault prediction time according to the first log vector and the second log vector, and obtain a third log vector;

[0035] The fault prediction module is configured to obtain fault prediction information of the target device according to the third log vector.

[0036] Furthermore, the log vector acquisition module specifically includes:

[0037] an encoding unit configured to perform one-hot encoding on the first log data to obtain a set of first one-hot encodings, and to perform one-hot encoding on the second log data to obtain a set of second one-hot encodings;

[0038] A word vector conversion unit is configured to input the first one-hot encoding and the second one-hot encoding into a preset word vector model to obtain a set of first log word vectors and a set of second log word vectors; wherein the word vector model is a model obtained through training and has a function of converting one-hot encoding into a word vector;

[0039] The concatenation unit is configured to concatenate the first log word vectors to obtain the first log vector, and to concatenate the second log word vectors to obtain the second log vector.

[0040] This application has the following advantages:

[0041] The fault detection method and device provided by the present application obtain the first log data of the target device and the second log data of the associated device, wherein the associated device is a device associated with the operating status of the target device; respectively perform word vector conversion processing on the first log data and the second log data to obtain a first log vector corresponding to the first log data and a second log vector corresponding to the second log data; predict the log vector of the target device at a preset fault prediction time based on the first log vector and the second log vector to obtain a third log vector; obtain fault prediction information of the target device based on the third log vector. The method predicts the log vector of the target device based on the log data of the target device itself and the log data of the associated device, which can improve the accuracy of the predicted log vector, thereby obtaining more accurate fault prediction information based on the predicted log vector, so as to timely know the operating status of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] The accompanying drawings are used to provide further understanding of the present application and constitute a part of the specification. Together with the following specific embodiments, they are used to explain the present application, but do not constitute a limitation to the present application.

[0043] Figure 1 A flowchart of a fault detection method provided in one embodiment of the present application;

[0044] Figure 2 A flowchart of a fault detection method provided in another embodiment of the present application;

[0045] Figure 3 A flowchart of a fault detection method provided in yet another embodiment of the present application;

[0046] Figure 4 A schematic diagram of the structure of a word vector model provided in an embodiment of the present application;

[0047] Figure 5 A flowchart of a fault detection method provided by another embodiment of the present application;

[0048] Figure 6 A block diagram of a fault detection device provided in one embodiment of the present application;

[0049] Figure 7 A block diagram of a fault detection device provided in another embodiment of the present application;

[0050] Figure 8 A schematic diagram of the composition of a fault detection system provided in an embodiment of the present application;

[0051] Fig. 9 A flowchart of a fault detection method provided for an exemplary embodiment of the present application;

[0052] Fig.10 It is a block diagram of an electronic device used to implement the fault detection method of an embodiment of the present application. DETAILED DESCRIPTION

[0053] The specific implementation of the present application is described in detail below in conjunction with the accompanying drawings. It should be understood that the specific implementation described here is only used to illustrate and explain the present application, and is not used to limit the present application.

[0054] With the development of computer technology and network technology, the architecture and application services of various systems are becoming increasingly large, and the user groups are complex and diverse. Therefore, it is very important to ensure the reliable and stable operation of the system. Usually, during the operation process, the system will generate logs, which record detailed operation information of the system. By querying and analyzing the logs, the operation status of the system can be known in a timely manner.

[0055] In the related art, for newly developed or newly deployed systems, due to the short running time and lack of running logs, it is impossible to conduct a comprehensive and accurate analysis of such systems, resulting in an inability to understand the real running status of the system. Moreover, when analyzing the running status of a certain device, usually only the log of the device is analyzed, without considering the impact of the relationship between devices on the running status of the device, resulting in incomplete and inaccurate log analysis results.

[0056] In view of this, an embodiment of the present application provides a fault detection method and device, which can predict the log vector of the target device more comprehensively and accurately based on the log data of the target device itself and the log data of associated devices through a preset vector preset model, and can obtain more accurate fault prediction information based on the predicted log vector, so as to timely know the operation status of the system.

[0057] A first aspect of the present application provides a fault detection method. Figure 1 This is a flow chart of a fault detection method provided by an embodiment of the present application. Figure 1 As shown, the fault detection method includes the following steps:

[0058] Step S110, obtaining first log data of the target device and second log data of the associated device.

[0059] The associated device is a device associated with the operating status of the target device.

[0060] In some embodiments, a device that has a communication connection relationship with the target device is determined as an associated device. For example, if the target device is a router, then other routers cascaded with it belong to the associated devices of the target device. For another example, if the target device is a software defined network (SDN) controller, then the switches within the management scope of the SDN controller belong to the associated devices of the target device. For another example, if the target device is a switch in an SDN network, then the SDN controller connected to the switch and other switches connected to the switch all belong to the associated devices of the target device.

[0061] Log data is a record of events generated when the device is running, which can reflect the running status of the device. In some embodiments, the log data records information such as the user, action, date, time, etc. corresponding to the device.

[0062] In some embodiments, the step of obtaining the first log data of the target device and the second log data of the associated device includes: first, obtaining the device topology information corresponding to the target device, and determining the associated device of the target device according to the device topology information; second, obtaining the log data of the target device at a first preset time through the operation and maintenance system to obtain the first log data, and obtaining the log data of the associated device at a second preset time to obtain the second log data. The first preset time and the second preset time may be the same or different, and the operation and maintenance system is a system that performs operation and maintenance on the system where the target device is located.

[0063] It should be noted that the above method for obtaining log data is only an example, and the log data of the device can also be obtained by other methods, which is not limited in this application.

[0064] Step S120 , performing word vector conversion processing on the first log data and the second log data respectively, to obtain a first log vector corresponding to the first log data and a second log vector corresponding to the second log data.

[0065] Computers and other electronic devices cannot recognize text data. Therefore, before processing text data, it is necessary to digitize the text data and convert it into a language that computers and other electronic devices can recognize. Word vectors are one of the languages ​​that computers can recognize.

[0066] In some embodiments, the words in the text data are mapped to the semantic space, and the vector obtained is the word vector. Therefore, whether the semantic space is reasonable and whether the mapping relationship is accurate will affect the accuracy of the word vector. Generally, in order to obtain accurate word vectors, it is necessary to use a large amount of text data to establish corresponding semantic spaces and mapping relationships. In embodiments of the present application, in scenarios such as system cold start, the log data is less, so it is impossible to directly establish accurate semantic spaces and mapping relationships based on the current log data, and thus it is impossible to obtain accurate word vectors. Considering the same or similar types of systems, there are certain similarities in their log data, therefore, the log data of the same or similar systems can be used to establish semantic spaces and mapping relationships, and the log data of the current system is mapped to the semantic space through the mapping relationship, so as to obtain the word vectors of the log data of the current system.

[0067] In some embodiments, the above process is implemented in a model-based manner. Specifically, the first log data is one-hot encoded to obtain a set of first one-hot encodings; the second log data is one-hot encoded to obtain a set of second one-hot encodings; the first one-hot encodings and the second one-hot encodings are input into a preset word vector model to obtain a set of first log word vectors and a set of second log word vectors; the first log word vectors are concatenated to obtain a first log vector; the second log word vectors are concatenated to obtain a second log vector. Among them, the word vector model is a model obtained through training that has the function of converting one-hot encodings into word vectors, the first log word vector is the word vector corresponding to the first one-hot encoding, and the second log word vector is the word vector corresponding to the second one-hot encoding.

[0068] Step S130 : predicting the log vector of the target device at a preset fault prediction time according to the first log vector and the second log vector to obtain a third log vector.

[0069] The preset fault prediction time is a time that is pre-set according to demand to determine whether a fault occurs.

[0070] In some embodiments, a preset time interval is provided between the preset fault prediction time and the first preset time, and the first preset time is the time corresponding to the first log data.

[0071] For example, if the first preset time is {t0, t1}, the preset duration is △t, then the preset fault prediction time is {(t1+△t), t2}, where t0 and t1 are the start time and end time of the first preset time, t0<t1, △t>0, (t1+△t)<t2.

[0072] In some specific implementations, a third log vector of the target device at a preset fault prediction time is obtained based on a preset vector prediction model, wherein the vector prediction model is a model obtained through training and having a log vector of a predicted device.

[0073] Step S140: Obtain fault prediction information of the target device according to the third log vector.

[0074] In some embodiments, a predicted device state vector of the target device is obtained according to the third log vector, and fault prediction information of the target device is determined according to the predicted device state vector, wherein the fault prediction information includes whether a fault exists or not.

[0075] In some specific implementations, the third log vector is input into a preset device state prediction model to obtain a predicted device state vector of the target device, wherein the device state prediction model is a model with a predicted device state vector obtained through training.

[0076] In this embodiment, the first log data of the target device and the second log data of the associated device are obtained; the first log data and the second log data are respectively converted into word vectors to obtain a first log vector corresponding to the first log data and a second log vector corresponding to the second log data; the log vector of the target device at a preset fault prediction time is predicted based on the first log vector and the second log vector to obtain a third log vector; and the fault prediction information of the target device is obtained based on the third log vector. This method predicts the log vector of the target device based on the log data of the target device itself and the log data of the associated device, which can improve the accuracy of the predicted log vector, thereby obtaining more accurate fault prediction information based on the predicted log vector, so as to timely know the operation status of the system.

[0077] Figure 2 A flowchart of a fault detection method provided by another embodiment of the present application. Figure 2 As shown, the fault detection method includes the following steps:

[0078] Step S211, obtaining device topology information corresponding to the target device.

[0079] The device topology refers to the physical layout of various devices interconnected based on transmission media. Through the device topology, the connection relationship between devices can be known. The device topology information includes a device topology structure diagram and / or information about the device topology structure described in a language.

[0080] In some embodiments, the system topology information of the system where the target device is located is first obtained, and then the device topology information corresponding to the target device is determined from the system topology information, so as to determine the connection relationship between the target device and other devices according to the device topology information corresponding to the target device, and thus determine the associated devices of the target device according to the connection relationship. The system topology information can be obtained according to the system structure design, or it can be determined through the transmission link of the information in the system.

[0081] Step S212: determining the associated devices of the target device according to the device topology information.

[0082] The associated device refers to a device that is associated with the operating status of the target device.

[0083] In some embodiments, the step of determining the associated devices of the target device according to the device topology information includes: determining the associated devices of the target device according to the device topology information by using a breadth search algorithm. The breadth search algorithm refers to traversing layer by layer from the root node of the device topology, and after traversing all nodes of one layer, entering the next layer for traversal to determine the associated devices of the target device.

[0084] It should be noted that the above method for determining associated devices is only an example, and algorithms such as deep search may also be used to determine associated devices, which is not limited in this application.

[0085] Step S213, determining the log data of the target device at a first preset time, and obtaining first log data.

[0086] Generally speaking, the closer the log data is to the time when the fault occurred, the more accurate and comprehensive the information about the fault can be. Therefore, when predicting whether a fault will occur, it is appropriate to use log data from a period of time that is closer to the current time.

[0087] In some embodiments, a period of time close to the current moment is determined as a first preset time, and log data generated by the target device within the first preset time is obtained as the first log data.

[0088] For example, the current time is t0, the log collection duration is determined to be △T, and the first preset time is {t1, t2}, so the log data generated by the target device at {t1, t2} is collected to obtain the first log data. Among them, t1 and t2 are the start time and end time of the first preset time, t2-t1=△T, t2<t0, and the difference between t2 and t0 is small (indicating that t2 is closer to the current time).

[0089] Step S214, determining the log data of the associated device at a second preset time, and obtaining second log data.

[0090] The log data of the associated device can reflect the operating status of the target device to a certain extent. Therefore, the fault information of the target device can be inferred based on the log data of the associated device. Moreover, similar to the collection time of the first log data, when obtaining the second log data, it is appropriate to use the log data of the associated device within a period of time close to the current time as the second log data.

[0091] It should be noted that the second preset time may be the same as or different from the first preset time, and this application does not limit this.

[0092] Step S220 , performing word vector conversion processing on the first log data and the second log data respectively, to obtain a first log vector corresponding to the first log data and a second log vector corresponding to the second log data.

[0093] Step S230 , predicting the log vector of the target device at a preset fault prediction time according to the first log vector and the second log vector, to obtain a third log vector.

[0094] Step S240: Obtain fault prediction information of the target device according to the third log vector.

[0095] Steps S220 to S240 in this embodiment are the same as steps S120 to S140 in an embodiment of the present application, and are not described again herein.

[0096] In this embodiment, log data of the target device and associated devices within a period of time close to the current moment are obtained, and a third log vector is obtained based on these log data. Since these log data can more accurately reflect the operating status of the target device, the third log vector obtained based on these data has high accuracy, so that fault prediction can be accurately performed based on the third log vector.

[0097] Figure 3 A flowchart of a fault detection method provided in yet another embodiment of the present application. Figure 3 As shown, the fault detection method includes the following steps:

[0098] Step S310: acquiring first log data of a target device and second log data of an associated device.

[0099] The content of step S310 in this embodiment is the same as that of step S110 in one embodiment of the present application, and will not be repeated here.

[0100] Step S321, perform one-hot encoding on the first log data to obtain a set of first one-hot encodings.

[0101] Among them, one-hot encoding is also called one-hot encoding, which mainly uses N-bit state registers to encode N states. Each state has an independent register bit, and only one bit is valid at any time, where N is an integer greater than 1. For example, for the device type [control device, switching device], it has only two states, and two-bit encoding is sufficient. The corresponding one-hot encoding can be expressed as [1,0; 0,1], where "1,0" represents a control device and "0,1" represents a switching device.

[0102] Usually, log data includes multiple log records, and each log record may include multiple characters or words. Therefore, before one-hot encoding the log data, it is necessary to first perform word segmentation on the log data to obtain at least one word segmentation, and then perform one-hot encoding on each word segmentation. Among them, word segmentation refers to decomposing paragraphs, sentences, etc. into word units to facilitate subsequent processing.

[0103] In some embodiments, the step of performing one-hot encoding on the first log data to obtain a set of first one-hot encodings includes: first, performing word segmentation processing on the first log data to obtain a set of first word segmentations; second, performing one-hot encoding on each first word segmentation to obtain a first one-hot encoding corresponding to each first word segmentation, and these first one-hot encodings constitute a set of first one-hot encodings.

[0104] For example, the first log data includes "the first event service has been started, and the second event service has been closed", and word segmentation processing is performed to obtain six first word segments, namely "first event", "second event", "service", "already", "started" and "closed". Therefore, a six-bit one-hot encoding is set for the first log data, where the first one-hot encoding corresponding to "first event" is [1,0,0,0,0,0], the first one-hot encoding corresponding to "second event" is [0,1,0,0,0,0], the first one-hot encoding corresponding to "service" is [0,0,1,0,0,0], the first one-hot encoding corresponding to "already" is [0,0,0,1,0,0], the first one-hot encoding corresponding to "started" is [0,0,0,0,1,0], and the first one-hot encoding corresponding to "closed" is [0,0,0,0,0,1].

[0105] Step S322: One-hot encode the second log data to obtain a set of second one-hot codes.

[0106] The method of performing one-hot encoding on the second log data is similar to that of the first log data, and will not be described in detail here.

[0107] Step S323: input the first one-hot encoding and the second one-hot encoding into a preset word vector model to obtain a set of first log word vectors and a set of second log word vectors.

[0108] Among them, the word vector model is a model obtained through training that has the function of converting one-hot encoding into word vectors, the first log word vector is the word vector corresponding to the first one-hot encoding, and the second log word vector is the word vector corresponding to the second one-hot encoding.

[0109] It should be noted that although the one-hot encoding method is simple and convenient, when the log data is large and corresponds to a large number of different segmented words, the number of bits of the encoding will be large, which is not convenient for computer processing. For example, when the log data corresponds to 1000 different segmented words, it is necessary to set a one-hot encoding with a bit number of 1000. Correspondingly, the number of bits of the one-hot encoding corresponding to each segmented word is 1000, and the number of bits of the encoding is too large. Moreover, different one-hot encodings for different segmented words cannot deeply reflect the semantics of the segmented words and the association between the segmented words. For example, the one-hot encoding corresponding to "mobile phone" is [0,1,0,0,0,0], and the one-hot encoding corresponding to "mobile terminal" is [0,0,0,0,1,1]. In some specific scenarios, "mobile phone" and "mobile terminal" can represent the same or similar meanings, but simply through the one-hot encoding corresponding to the mobile phone [0,1,0,0,0,0] and the one-hot encoding corresponding to the mobile terminal [0,0,0,0,1,1], it is impossible to know the potential association between the two. Therefore, the concept of word vector is introduced to determine the association between different word segments based on word vector. Specifically, the above one-hot encoding is mapped to the word vector space (i.e., semantic space), each one-hot encoding corresponds to a vector, and the similarity between vectors can be determined by calculating the distance between different vectors. The association between vectors can also be determined through vector operations.

[0110] In some embodiments, a word vector model having the function of converting one-hot encoding into a word vector is obtained through training, and the first one-hot encoding and the second one-hot encoding are input into the word vector model, so as to obtain a set of first log word vectors and a set of second log word vectors.

[0111] Step S324: concatenate the first log word vectors to obtain a first log vector.

[0112] In some embodiments, the first log word vectors are concatenated according to positions of the first log word vectors in the original first log data, thereby obtaining the first log vector.

[0113] In some other embodiments, according to the type of the first log word vector in the original first log data (for example, time type, date type, action type, etc.), the first log word vector is concatenated to obtain the first log vector.

[0114] It should be noted that the above word vector concatenation method is only an example. In actual applications, the word vectors can be concatenated according to needs or preset configurations, and this application does not limit this.

[0115] Step S325: concatenate the second log word vectors to obtain a second log vector.

[0116] The method of concatenating the second log word vector is similar to that of the first log word vector, and will not be repeated here.

[0117] Step S330 : predicting the log vector of the target device at a preset fault prediction time according to the first log vector and the second log vector to obtain a third log vector.

[0118] Step S340: Obtain fault prediction information of the target device according to the third log vector.

[0119] Steps S330 to S340 in this embodiment are the same as steps S130 to S140 in an embodiment of the present application, and are not described again here.

[0120] It should be noted that in some embodiments, based on the distributional hypothesis theory, a neural network is used to construct an initial word vector model, and the final word vector model is obtained through model training. The distributional hypothesis theory means that words with similar contexts have similar semantics, or that the semantics of a word is determined by its context.

[0121] Figure 4 A schematic diagram of the structure of a word vector model provided in an embodiment of the present application. Figure 4 As shown in the figure, the word vector model includes an input layer, a hidden layer and an output layer.

[0122] During the training process, the training data is first input into the input layer. The training data includes the unique hot encoding of the context segmentation of the central word, specifically {x 1k 、x 2k , …, x ck}, x ik is a one-hot encoding of dimension 1*V, i∈(1,c), and c is an integer greater than 1.

[0123] Second, the input layer converts each x ik With the first matrix W V*N After multiplication, we get each x ik The first intermediate vector corresponding to the first intermediate vector is input into the hidden layer. V*Nis a matrix with a dimension of V*N, and correspondingly, the first intermediate vector is a vector with a dimension of 1*N, where N is the dimension set as needed.

[0124] Again, the hidden layer performs an average operation on the first intermediate vector to obtain a second intermediate vector, and adds the second intermediate vector to the second matrix W′ N*V Multiply them together to obtain the third intermediate vector, and input the third intermediate vector into the output layer. N*V is a matrix with a dimension of N*V, and correspondingly, the third intermediate vector is a vector with a dimension of 1*V.

[0125] Finally, the output layer performs multinomial logistic regression (Multi-nominal LogisticRegression, Softmax) on the third intermediate vector and outputs the corresponding output vector. Specifically, the output vector is a vector with a dimension of 1*V, and each element in the vector corresponds to a probability value, which indicates the matching probability between the central word and the predicted word (the predicted word is a word in the preset word library). Usually, the predicted word corresponding to the maximum probability value is used as the final predicted word, and the final predicted word is compared with the central word. According to the comparison result, the values ​​of each element in the first matrix and the second matrix are adjusted until the preset stop condition is met to obtain a trained word vector model.

[0126] The process of predicting word vectors through the word vector model is similar to the training process and will not be repeated here.

[0127] Figure 5 This is a flow chart of a fault detection method provided by another embodiment of the present application. Figure 5 As shown, the fault detection method includes the following steps:

[0128] Step S510: Acquire first log data of a target device and second log data of an associated device.

[0129] Step S520 , performing word vector conversion processing on the first log data and the second log data respectively, to obtain a first log vector corresponding to the first log data and a second log vector corresponding to the second log data.

[0130] Step S530: predicting the log vector of the target device at a preset fault prediction time according to the first log vector and the second log vector to obtain a third log vector.

[0131] Steps S510 to S530 in this embodiment are the same as steps S110 to S130 in an embodiment of the present application, and are not described again here.

[0132] Step S541: Obtain a predicted device state vector of the target device according to the third log vector.

[0133] Among them, the device state vector is a vector that can reflect the operating status of the device. In some embodiments, the device state vector y={y1,y2,…,yn} is used to reflect the operating status of the target device during the time from t1 to tn. Among them, n is an integer greater than or equal to 1, y1 is the operating status of the device at time t1, y2 is the operating status of the device at time t2, and yn is the operating status of the device at time tn. Specifically, yi∈{0,1}, "0" represents normal operation of the device, and "1" represents abnormal operation of the device.

[0134] The third log vector can reflect the operating state of the target device at the preset fault prediction time to a certain extent. Therefore, the predicted device state vector of the target device can be obtained according to the third log vector.

[0135] In some embodiments, the third log vector is input into a preset device state prediction model to obtain a predicted device state vector of the target device, wherein the device state prediction model is a model with a predicted device state vector obtained through training.

[0136] It should be noted that the equipment status prediction model can adopt a time series model such as a long short-term memory artificial neural network (LSTM) model or an autoregressive integrated moving average model (ARIMA), and this application does not limit this.

[0137] Step S542: Determine the fault prediction information of the target device according to the predicted device state vector.

[0138] In some embodiments, assuming that within the time period from t1 to tn, the predicted device state vector y={0, 0, ..., 0}, it is determined that the target device has no faults.

[0139] In some other embodiments, assuming that within the time period from t1 to tn, the predicted device state vector y={0,0,…,1}, and the value “1” corresponds to the time tn, it is determined that the target device may fail at tn.

[0140] In this embodiment, the predicted device state vector of the target device can be obtained conveniently and accurately through the device state prediction model, so that the fault prediction information of the target device can be determined based on the predicted device state vector, so as to determine whether to adjust the operating state of the target device or perform further detection based on the fault prediction information to improve the operating stability of the system.

[0141] The step division of the above methods is only for clear description. When implemented, they can be combined into one step or some steps can be split and decomposed into multiple steps. As long as they include the same logical relationship, they are all within the scope of protection of this application; adding insignificant modifications to the algorithm or process or introducing insignificant designs without changing the core design of the algorithm and process are all within the scope of protection of this application.

[0142] A second aspect of the present application provides a fault detection device. Figure 6 This is a block diagram of a fault detection device provided in one embodiment of the present application. Figure 6 As shown, the fault detection device 600 includes the following modules:

[0143] The log data acquisition module 610 is configured to acquire first log data of the target device and second log data of the associated device.

[0144] The associated device is a device associated with the operating status of the target device.

[0145] The log vector acquisition module 620 is configured to perform word vector conversion processing on the first log data and the second log data respectively to obtain a first log vector corresponding to the first log data and a second log vector corresponding to the second log data.

[0146] The prediction log acquisition module 630 is configured to predict the log vector of the target device at a preset fault prediction time according to the first log vector and the second log vector to obtain a third log vector.

[0147] The fault prediction module 640 is configured to obtain fault prediction information of the target device according to the third log vector.

[0148] In this embodiment, the log data acquisition module acquires the first log data of the target device and the second log data of the associated device; the log vector acquisition module performs word vector conversion processing on the first log data and the second log data respectively to obtain the first log vector corresponding to the first log data and the second log vector corresponding to the second log data; the prediction log acquisition module predicts the log vector of the target device at the preset fault prediction time according to the first log vector and the second log vector to obtain the third log vector; the fault prediction module obtains the fault prediction information of the target device according to the third log vector. The device predicts the log vector of the target device according to the log data of the target device itself and the log data of the associated device, which can improve the accuracy of the predicted log vector, thereby obtaining more accurate fault prediction information according to the predicted log vector, so as to timely know the operation status of the system.

[0149] Figure 7A block diagram of a fault detection device provided in another embodiment of the present application. Figure 7 As shown, the fault detection device 700 includes the following modules:

[0150] The log data acquisition module 710 is configured to acquire first log data of a target device and second log data of an associated device.

[0151] The associated device is a device associated with the operating status of the target device.

[0152] The log vector acquisition module 720 is configured to perform word vector conversion processing on the first log data and the second log data respectively to obtain a first log vector corresponding to the first log data and a second log vector corresponding to the second log data.

[0153] In some embodiments, the log vector acquisition module 720 specifically includes:

[0154] The encoding unit 721 is configured to perform one-hot encoding on the first log data to obtain a set of first one-hot encodings, and to perform one-hot encoding on the second log data to obtain a set of second one-hot encodings.

[0155] The word vector conversion unit 722 is configured to input the first unique hot encoding and the second unique hot encoding into a preset word vector model to obtain a set of first log word vectors and a set of second log word vectors. The word vector model is a model obtained through training that has the function of converting the unique hot encoding into a word vector.

[0156] The concatenation unit 723 is configured to concatenate the first log word vectors to obtain a first log vector, and to concatenate the second log word vectors to obtain a second log vector.

[0157] The prediction log acquisition module 730 is configured to predict the log vector of the target device at a preset fault prediction time according to the first log vector and the second log vector to obtain a third log vector.

[0158] The fault prediction module 740 is configured to obtain fault prediction information of the target device according to the third log vector.

[0159] In this embodiment, the log vector acquisition module in the fault detection device performs one-hot encoding on the first log data through the encoding unit to obtain a set of first one-hot encodings, and performs one-hot encoding on the second log data to obtain a set of second one-hot encodings; inputs the first one-hot encoding and the second one-hot encoding into a preset word vector model through the word vector conversion unit to obtain a set of first log word vectors and a set of second log word vectors; splices the first log word vectors through the splicing unit to obtain a first log vector, and splices the second log word vectors to obtain a second log vector, so that the prediction log acquisition module obtains a third log vector based on the first log vector and the second log vector, and obtains fault prediction information of the target device based on the third log vector through the fault prediction module.

[0160] Figure 8 A schematic diagram of the composition of a fault detection system provided in an embodiment of the present application. Figure 8 As shown, the fault detection system 800 includes a fault detection device 810 and a system to be detected 820, wherein the fault detection device 810 adopts the fault detection device provided by any embodiment of the present application, and is used to perform fault detection on a target device 821 in the system to be detected 820. The system to be detected 821 is a system composed of multiple devices, specifically including the target device 821, a first associated device 831, a second associated device 832, ..., and an Nth associated device 83N.

[0161] It should be noted that, in addition to the target device 821 and the associated devices associated therewith, the system to be detected 820 may also include other devices not associated with the target device ( Figure 8 The method for performing fault detection on other devices is similar to the method for performing fault detection on the target device, and will not be described in detail here.

[0162] Fig. 9 A flowchart of a fault detection method provided by an exemplary embodiment of the present application, which can be applied to Figure 8 The fault detection system shown in FIG. Fig. 9 As shown, the fault detection method includes the following steps:

[0163] Step S901: Determine the associated devices of the target device 821 according to the device topology information of the system to be detected.

[0164] according to Figure 8 In the fault detection system shown, the associated devices of the target device 821 include a first associated device 831, a second associated device 832, ..., an Nth associated device 83N.

[0165] Step S902 , determining the log data of the target device 821 at a first preset time, and obtaining first log data.

[0166] Step S903: determine the log data of the associated device at a second preset time, and obtain second log data.

[0167] Wherein, for each associated device, the log data of the associated device at a second preset time is determined, thereby obtaining the second log data.

[0168] Step S904: perform word segmentation processing on the first log data to obtain a set of first word segments.

[0169] Step S905 , performing one-hot encoding on each first word segment to obtain a set of first one-hot encodings.

[0170] Step S906: perform word segmentation processing on the second log data to obtain a set of second word segments.

[0171] Step S907: Perform one-hot encoding on each second word segment to obtain a set of second one-hot encodings.

[0172] Step S908: input the first one-hot encoding and the second one-hot encoding into a preset word vector model to obtain a set of first log word vectors and a set of second log word vectors.

[0173] Step S909: concatenate the first log word vector to obtain the first log vector.

[0174] Step S910: concatenate the second log word vectors to obtain a second log vector.

[0175] Step S911: input the first log vector and the second log vector into a preset vector prediction model to predict a third log vector of the target device 821 at a preset fault prediction time.

[0176] Step S912 , inputting the third log vector into a preset device state prediction model to obtain a predicted device state vector of the target device 821 .

[0177] Step S913, determining the fault prediction information of the target device 821 according to the predicted device state vector.

[0178] Step S914, determining whether the fault prediction information indicates that a fault exists.

[0179] Step S915: When the fault prediction information indicates that a fault exists, a fault warning prompt signal is issued.

[0180] It should be noted that, when the fault prediction information indicates that there is no fault, the current fault detection process is terminated.

[0181] Fig.10A block diagram of the composition of an electronic device provided in an embodiment of the present application.

[0182] Fig.10 A schematic block diagram of an example electronic device 1000 that can be used to implement an embodiment of the present application is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workbenches, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present application described and / or required herein.

[0183] like Fig.10 As shown, the device 1000 includes a computing unit 1001, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 1002 or a computer program loaded from a storage unit 1008 into a random access memory (RAM) 1003. In the RAM 1003, various programs and data required for the operation of the device 1000 can also be stored. The computing unit 1001, the ROM 1002, and the RAM 1003 are connected to each other via a bus 1004. An input / output (I / O) interface 1005 is also connected to the bus 1004.

[0184] A number of components in the device 1000 are connected to the I / O interface 1005, including: an input unit 1006, such as a keyboard, a mouse, etc.; an output unit 1007, such as various types of displays, speakers, etc.; a storage unit 1008, such as a disk, an optical disk, etc.; and a communication unit 1009, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 1009 allows the device 1000 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0185] The computing unit 1001 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the computing unit 1001 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The computing unit 1001 performs the various methods and processes described above, such as a fault detection method. For example, in some embodiments, the fault detection method may be implemented as a computer software program, which is tangibly contained in a machine-readable medium, such as a storage unit 1008. In some embodiments, part or all of the computer program may be loaded and / or installed on the device 1000 via ROM 1002 and / or communication unit 1009. When the computer program is loaded into RAM 1003 and executed by the computing unit 1001, one or more steps of the fault detection method described above may be performed. Alternatively, in other embodiments, the computing unit 1001 may be configured to perform the fault detection method in any other appropriate manner (e.g., by means of firmware).

[0186] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0187] The program code for implementing the method of the present application can be written in any combination of one or more programming languages. These program codes can be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that the program code, when executed by the processor or controller, implements the functions / operations specified in the flow chart and / or block diagram. The program code can be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0188] In the context of the present application, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0189] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0190] The systems and techniques described herein may be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), and the Internet.

[0191] A computer system may include clients and servers. Clients and servers are generally remote from each other and usually interact through a communication network. The relationship of client and server is generated by computer programs running on respective computers and having a client-server relationship to each other.

[0192] It is worth mentioning that all modules involved in this embodiment are logic modules. In practical applications, a logic unit can be a physical unit, a part of a physical unit, or a combination of multiple physical units. In addition, in order to highlight the innovative part of this application, this embodiment does not introduce units that are not closely related to solving the technical problems proposed by this application, but this does not mean that there are no other units in this embodiment.

[0193] It is to be understood that the above embodiments are merely exemplary embodiments used to illustrate the principles of the present application, but the present application is not limited thereto. For those skilled in the art, various modifications and improvements can be made without departing from the spirit and substance of the present application, and these modifications and improvements are also considered to be within the scope of protection of the present application.

Claims

1. A fault detection method, characterized in that: include: Acquire first log data of a target device and second log data of an associated device, wherein the associated device is a device associated with an operating state of the target device; Performing word vector conversion processing on the first log data and the second log data respectively to obtain a first log vector corresponding to the first log data and a second log vector corresponding to the second log data; Predicting a log vector of the target device at a preset fault prediction time according to the first log vector and the second log vector to obtain a third log vector; Obtaining fault prediction information of the target device according to the third log vector; The obtaining, according to the third log vector, fault prediction information of the target device includes: Obtaining a predicted device state vector of the target device according to the third log vector; Determining fault prediction information of the target device according to the predicted device state vector; The obtaining, according to the third log vector, a predicted device state vector of the target device includes: Inputting the third log vector into a preset device state prediction model to obtain a predicted device state vector of the target device; The device state prediction model is a model with a predicted device state vector obtained through training.

2. The fault detection method according to claim 1, characterized in that: The obtaining of the first log data of the target device and the second log data of the associated device includes: Obtaining device topology information corresponding to the target device; Determining associated devices of the target device according to the device topology information; Determine the log data of the target device at a first preset time, and obtain the first log data; The log data of the associated device at a second preset time is determined to obtain the second log data.

3. The fault detection method according to claim 2, characterized in that: The step of determining the associated devices of the target device according to the device topology information includes: According to the device topology information, associated devices of the target device are determined by a breadth search algorithm.

4. The fault detection method according to claim 1 or 2, characterized in that: The performing word vector conversion processing on the first log data and the second log data respectively to obtain a first log vector corresponding to the first log data and a second log vector corresponding to the second log data includes: Performing one-hot encoding on the first log data to obtain a set of first one-hot encodings; Performing one-hot encoding on the second log data to obtain a set of second one-hot encodings; Inputting the first one-hot encoding and the second one-hot encoding into a preset word vector model to obtain a set of first log word vectors and a set of second log word vectors; wherein the word vector model is a model obtained through training and has a function of converting one-hot encoding into word vectors, the first log word vector is a word vector corresponding to the first one-hot encoding, and the second log word vector is a word vector corresponding to the second one-hot encoding; Concatenate the first log word vectors to obtain the first log vector; The second log word vectors are concatenated to obtain the second log vector.

5. The fault detection method according to claim 2, characterized in that: The preset fault prediction time and the first preset time are separated by a preset time length.

6. The fault detection method according to claim 1, characterized in that: After obtaining the fault prediction information of the target device according to the third log vector, the method further includes: When the fault prediction information indicates that a fault exists, a fault warning prompt signal is issued.

7. A fault detection device, characterized in that: include: a log data acquisition module, configured to acquire first log data of a target device and second log data of an associated device, wherein the associated device is a device associated with an operating state of the target device; a log vector acquisition module, configured to perform word vector conversion processing on the first log data and the second log data respectively, to obtain a first log vector corresponding to the first log data and a second log vector corresponding to the second log data; a prediction log acquisition module, configured to predict the log vector of the target device at a preset fault prediction time according to the first log vector and the second log vector, and obtain a third log vector; a fault prediction module, configured to obtain fault prediction information of the target device according to the third log vector; The obtaining, according to the third log vector, fault prediction information of the target device includes: Obtaining a predicted device state vector of the target device according to the third log vector; Determining fault prediction information of the target device according to the predicted device state vector; The obtaining, according to the third log vector, a predicted device state vector of the target device includes: Inputting the third log vector into a preset device state prediction model to obtain a predicted device state vector of the target device; The device state prediction model is a model with a predicted device state vector obtained through training.

8. The fault detection device according to claim 7, characterized in that: The log vector acquisition module specifically includes: an encoding unit configured to perform one-hot encoding on the first log data to obtain a set of first one-hot encodings, and to perform one-hot encoding on the second log data to obtain a set of second one-hot encodings; A word vector conversion unit is configured to input the first one-hot encoding and the second one-hot encoding into a preset word vector model to obtain a set of first log word vectors and a set of second log word vectors; wherein the word vector model is a model obtained through training and has a function of converting one-hot encoding into a word vector; The concatenation unit is configured to concatenate the first log word vectors to obtain the first log vector, and to concatenate the second log word vectors to obtain the second log vector.

Images