Data analysis method, device and electronic equipment based on distributed link tracking

Abstract

The embodiment of the application provides a data analysis method and device based on distributed link tracking and electronic equipment, service data of a plurality of service calling nodes in a business transaction process is acquired through a distributed link tracking technology, and a service calling link is generated according to the service data; feature information corresponding to a plurality of service calling links is obtained by performing feature extraction on the service calling links of a plurality of business transactions; business process information is determined according to the feature information; analysis results are obtained by analyzing the business process information, and the analysis results include business transaction abnormalities or business transaction normality. The technical scheme provided by the embodiment of the application can accurately obtain the analysis results of whether the business transaction is abnormal by acquiring data through the distributed link tracking technology, generating the service calling link, and performing feature extraction and analysis on the service calling link, realizes real-time analysis of data in the business transaction process, and effectively improves the efficiency of data analysis.

Description

Technical Field

[0001] This application relates to the field of data processing technology, and in particular to a data analysis method, apparatus and electronic device based on distributed link tracing. Background Technology

[0002] With the continuous development of distributed systems, more and more enterprises, especially financial institutions, are using distributed architectures for their business systems. Distributed architecture business systems rely on the mutual invocation of multiple business services across various systems to collaboratively complete business services between business personnel and users. Therefore, during the business service process, a problem at any node can lead to transaction failure or anomalies. Since the nodes in the entire business service process may reside in different business systems, i.e., deployed on different servers, this presents a significant challenge in troubleshooting abnormal nodes throughout the entire business service process.

[0003] In existing technologies, when a business service encounters an anomaly, technical personnel typically analyze the data corresponding to the business service at each node after the problem occurs, in order to determine whether any node has a problem, thereby identifying the cause of the anomaly.

[0004] However, existing methods can only investigate the cause of an anomaly after it occurs. The cause of the anomaly is determined by technical personnel analyzing the data corresponding to the business service in each node one by one. Since the dependencies between nodes are strong, this increases the difficulty for technical personnel to analyze the data, resulting in low efficiency of data analysis. Summary of the Invention

[0005] This application provides a data analysis method, apparatus, and electronic device based on distributed link tracing, which can effectively improve the accuracy and efficiency of data analysis.

[0006] In a first aspect, embodiments of this application provide a data analysis method based on distributed link tracing, the data analysis method based on distributed link tracing includes:

[0007] Service data of multiple service call nodes in the business transaction process is obtained through distributed tracing technology, and a service call chain is generated based on the service data.

[0008] Feature extraction is performed on the service call links of multiple business transactions to obtain feature information corresponding to the multiple service call links.

[0009] Based on the aforementioned feature information, business process information is determined.

[0010] The business process information is analyzed to obtain analysis results, which include abnormal or normal business transactions.

[0011] Optionally, the feature information is in code format; determining the business process information based on the feature information includes:

[0012] Based on the characteristic information of the code format and the mapping relationship between the pre-stored code and application service information, the application service information corresponding to the characteristic information is obtained.

[0013] Clustering is performed on the application service information corresponding to the feature information to obtain clustering results, which include target application service information.

[0014] Based on the target application service information, determine the business process information.

[0015] Optionally, determining the business process information based on the target application service information includes:

[0016] Based on the mapping relationship between the target application service information and the pre-stored application service information and business process information, the business process information corresponding to the target application service information is obtained.

[0017] Optionally, the business process information includes key business data; the analysis of the business process information to obtain analysis results includes:

[0018] The key business information is compared with preset standard key business data. If the key business information is consistent with the preset standard key business data, the analysis result is determined to include normal business transactions.

[0019] If the key business information is inconsistent with the preset standard key business data, then the analysis results are determined to include abnormal business transactions as well as the abnormal nodes and causes of the abnormal transactions.

[0020] Optionally, the distributed tracing technology includes the Open Tracing protocol; the step of obtaining service data from multiple service call nodes during a business transaction through distributed tracing technology, and generating a service call chain based on the service data, includes:

[0021] The Open Tracing protocol is used to monitor multiple service call nodes during the business transaction process and collect service data generated by each service call node.

[0022] Based on the service data, a link unit is generated, and the link unit includes a link unit identifier and a parent link unit identifier.

[0023] Based on the link unit identifier and the parent link unit identifier of the multiple link units, the corresponding calling order of the multiple link units is obtained.

[0024] Multiple link units are connected according to the calling order to generate a service call link.

[0025] Optionally, the method further includes:

[0026] If the analysis results include abnormal business transactions, an alarm message will be output.

[0027] Secondly, embodiments of this application provide a data analysis device based on distributed link tracing, the data analysis device based on distributed link tracing comprising:

[0028] The generation module is used to obtain service data of multiple service call nodes in the business transaction process through distributed tracing technology, and generate service call links based on the service data.

[0029] The processing module is used to extract features from the service call links of multiple business transactions to obtain feature information corresponding to the multiple service call links.

[0030] The processing module is also used to determine business process information based on the feature information.

[0031] The analysis module is used to analyze the business process information and obtain analysis results, including abnormal or normal business transactions.

[0032] Optionally, the feature information is a code format; the processing module is specifically used to obtain the application service information corresponding to the feature information based on the feature information of the code format and the pre-stored mapping relationship between code and application service information; to cluster the application service information corresponding to the feature information to obtain a clustering result, the clustering result including target application service information; and to determine business process information based on the target application service information.

[0033] Optionally, the processing module is specifically used to obtain the business process information corresponding to the target application service information based on the target application service information and the mapping relationship between the pre-stored application service information and business process information.

[0034] Optionally, the business process information includes key business data; the analysis module is specifically used to compare the key business information with preset standard key business data. If the key business information is consistent with the preset standard key business data, the analysis result is determined to include normal business transactions; if the key business information is inconsistent with the preset standard key business data, the analysis result is determined to include abnormal business transactions as well as the abnormal nodes and causes of the abnormal transactions.

[0035] Optionally, the distributed tracing technology includes the Open Tracing protocol; the generation module is specifically used to monitor multiple service call nodes in the business transaction process through the Open Tracing protocol, and collect service data generated by each service call node; generate link units based on the service data, each link unit including a link unit identifier and a parent link unit identifier; obtain the corresponding call order of multiple link units based on the link unit identifiers and the parent link unit identifiers of multiple link units; and connect multiple link units according to the call order to generate a service call link.

[0036] Optionally, the device further includes an output module, which is used to output alarm information when the analysis results include abnormal business transactions.

[0037] Thirdly, embodiments of this application also provide an electronic device, which includes: a processor and a memory communicatively connected to the processor;

[0038] The memory stores computer-executed instructions;

[0039] The processor executes computer execution instructions stored in the memory to implement the data analysis method based on distributed link tracing as described in any possible implementation of the first aspect above.

[0040] Fourthly, embodiments of this application also provide a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the data analysis method based on distributed link tracing as described in any possible implementation of the first aspect.

[0041] Fifthly, embodiments of this application also provide a computer program product, including a computer program that, when executed by a processor, implements the data analysis method based on distributed link tracing as described in any possible implementation of the first aspect.

[0042] Therefore, this application provides a data analysis method, apparatus, and electronic device based on distributed link tracing. It acquires service data from multiple service call nodes during a business transaction using distributed link tracing technology, and generates service call links based on this data. Features are extracted from the service call links of multiple business transactions to obtain feature information corresponding to each link. Business process information is determined based on the feature information. The business process information is then analyzed to obtain analysis results, including whether the business transaction is abnormal or normal. The technical solution provided by this application can acquire service data generated by business transactions in real time and generate service call links during the business transaction process using distributed link tracing technology. Furthermore, by analyzing the feature information obtained from feature extraction to obtain business process data, manual analysis by technical personnel is eliminated, improving the accuracy of data analysis and reducing the amount of data analyzed. This avoids the problem of technical personnel spending a lot of time analyzing large amounts of service data, thereby greatly improving the efficiency of data analysis. Attached Figure Description

[0043] Figure 1 This application provides an illustration of an application scenario for a data analysis method based on distributed link tracing.

[0044] Figure 2 A flowchart illustrating a data analysis method based on distributed link tracing provided in this application embodiment;

[0045] Figure 3 A flowchart illustrating another data analysis method based on distributed link tracing provided in this application embodiment;

[0046] Figure 4 A schematic diagram of the structure of a data analysis device based on distributed link tracing provided in this application embodiment;

[0047] Figure 5 This is a schematic diagram of an electronic device structure provided in this application.

[0048] The accompanying drawings have illustrated specific embodiments of this disclosure, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concepts of this disclosure to those skilled in the art through reference to particular embodiments. Detailed Implementation

[0049] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numerals in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this disclosure. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this disclosure as detailed in the appended claims.

[0050] In the embodiments of this application, "at least one" refers to one or more, and "more than one" refers to two or more. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, and B existing alone, where A and B can be singular or plural. In the textual description of this application, the character " / " generally indicates that the preceding and following related objects have an "or" relationship.

[0051] The technical solutions provided in this application can be applied to data analysis scenarios in distributed systems. In the financial industry, distributed, microservice architectures are typically used to support the ever-increasing volume of business. However, strong dependencies exist between distributed applications in a distributed system, making it complex to identify business anomalies by analyzing the business relationships between applications.

[0052] In existing technologies, when a business service encounters an anomaly, the data generated by the service experiencing the anomaly is typically analyzed. Specifically, technical personnel analyze the data of each node in the business service according to the call sequence, considering the dependencies between nodes, to identify the node where the abnormal data occurred, thereby determining the cause of the anomaly. For example, a business transaction sequentially completes the front-end interface request, intermediate business flow, and core business processing through systems A, B, and C respectively. When a problem occurs in the business transaction, an exception is returned on the front-end interface through system A. After analysis by the operations and development personnel of system A, it is found that the exception originated from a call to system B. Following further investigation and collaborative analysis by the operations and development personnel of systems B and C, the anomaly node is ultimately determined to be in system C, i.e., the end of the entire business transaction chain.

[0053] However, the dependencies between multiple nodes corresponding to business services increase the difficulty for technical personnel to analyze and determine the cause of anomalies. Furthermore, manual analysis by technical personnel may lead to errors, resulting in low accuracy and efficiency of data analysis.

[0054] To address the issue of low accuracy and efficiency in data analysis caused by manual analysis of business service data by technical personnel, and considering the dependencies between nodes in business services, distributed tracing technology can be used to collect data generated by each calling node during business transactions, generating service call chains. By extracting and analyzing features from these service call chains, the corresponding business processes can be determined, and anomalies can be detected. This allows for the automatic acquisition and real-time analysis of data from each calling node during business service execution, enabling timely identification of anomalies and their causes. This avoids the inefficiency of post-anomaly analysis by technical personnel, effectively improving the accuracy and efficiency of data analysis.

[0055] Figure 1 This diagram illustrates an application scenario for a data analysis method based on distributed link tracing, as provided in an embodiment of this application. In this application, it is possible to... Figure 1 The diagram illustrates the interaction between multiple servers and terminal devices to complete business transactions. For example, during a business transaction, a user can input a business request command through terminal device 101, such as a command to check account balance. Upon receiving the user's business request command, terminal device 101 generates a first call command to invoke server 102. Server 102, based on the received first call command, generates a second call command to invoke server 103. Server 103, based on the received third call command to invoke server 104, can send a third feedback message to server 103. Server 103 then sends a second feedback message to server 102 based on the received third feedback message. Server 102, based on the received second feedback message, sends a first feedback message corresponding to the business request command to terminal device 101. After receiving the first feedback message, terminal device 101 displays it on its display interface, allowing the user to obtain the user's query information through the terminal device 101's display interface. It is understood that... Figure 1 Each server in the system is a service call node.

[0056] For example, during the aforementioned business transactions, distributed tracing technology is used to obtain service data from each service call node, i.e., data generated by each server, such as call commands and feedback information. Based on the data generated by each service call node, a service call chain is generated, which includes the call relationships between each server and the terminal device. After generating the service call chain, feature extraction is performed on the service call chain to obtain the feature information corresponding to the service call chain. The obtained feature information can be analyzed and processed with the feature information corresponding to multiple ongoing business transactions to obtain the corresponding business process information and analyze whether any anomalies have occurred.

[0057] It is understood that the embodiments in this application are only for reference. Figure 1 The examples provided are for illustration only, but do not represent that the embodiments of this application are limited to this.

[0058] The technical solution provided in this application can analyze whether an anomaly occurs in a business transaction during the transaction process, without requiring manual analysis by technical personnel, thereby greatly improving the efficiency of data analysis.

[0059] The data analysis method based on distributed link tracing provided in this application will be described in detail below through specific embodiments. It is understood that the following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments.

[0060] Figure 2 This is a flowchart illustrating a data analysis method based on distributed link tracing, provided as an embodiment of this application. This data analysis method based on distributed link tracing can be executed by software and / or hardware devices. For example, the hardware device can be a data analysis device based on distributed link tracing, which can be a terminal or a processing chip within a terminal. For example, please refer to... Figure 2 As shown, this data analysis method based on distributed link tracing may include:

[0061] S201. Obtain service data of multiple service call nodes in the business transaction process through distributed link tracing technology, and generate service call links based on the service data.

[0062] For example, distributed tracing technology can record the order in which service calls occur between different systems when a business transaction involves service calls from multiple systems. This forms a service call chain for a single business transaction, enabling the tracking of the performance and status of each service call node in a single business transaction.

[0063] For example, distributed tracing technology may include the Open Tracing protocol. When generating a service call chain, the Open Tracing protocol can be used to monitor multiple service call nodes during a business transaction, collecting service data generated by each service call node. Based on the service data, link units are generated, each link unit including a link unit identifier and a parent link unit identifier. Based on the link unit identifiers and parent link unit identifiers of multiple link units, the corresponding call order of the multiple link units is obtained. The multiple link units are then connected according to the call order to generate the service call chain. The service data can be the performance and status data of each service call node; this embodiment does not specifically limit this.

[0064] For example, when connecting multiple link units according to the calling order to generate a service call link, the calling order can be the order in which the link units are called, that is, the order in which the upper-level link unit precedes the lower-level link unit, thus connecting multiple link units to obtain the service call link. This application embodiment only uses the calling order as an example for illustration, but it does not mean that the embodiments of this application are limited to this.

[0065] Understandably, as long as a business transaction occurs, the corresponding service call chain is generated through distributed tracing technology.

[0066] In this embodiment, the corresponding service call chain is generated by distributed link tracing technology, which enables real-time collection of service data during business transactions and can save the dependency relationship between service call nodes. This avoids the need to obtain data for analysis after an anomaly occurs, thereby further improving the efficiency of subsequent analysis of the service call chain.

[0067] S202. Extract features from the service call chain of the business transaction to obtain feature information corresponding to multiple service call chains.

[0068] For example, when extracting features from the service call chain of a business transaction to obtain feature information corresponding to multiple service call chains, the obtained feature information may be the service name, the order of calls, the business field key value of each service call node and the content corresponding to the key value in the service data generated during the business transaction process, or it may include other feature information. This application embodiment is only illustrated by the above example, but it does not mean that this application embodiment is limited to this.

[0069] In this embodiment of the application, by extracting feature information corresponding to multiple service call chains, business transactions can be classified according to the feature information. This avoids useless information in business transactions from affecting data analysis, thereby reducing the computational load of data analysis and further improving the efficiency of data analysis.

[0070] S203. Determine business process information based on feature information.

[0071] For example, when monitoring business transaction processes using distributed tracing technology, technical personnel need to write code to control the monitoring of business processes A and B. Therefore, the information included in the generated service call chain is in code format. In other words, feature extraction is performed on the service call chain of a business transaction, and the feature information corresponding to multiple service call chains is in code format.

[0072] When determining business process information based on feature information, the application service information corresponding to the feature information can be obtained by using the feature information of the code format and the mapping relationship between the pre-stored code and application service information; the application service information corresponding to the feature information is clustered to obtain the clustering results, which include the target application service information; and the business process information is determined based on the target application service information.

[0073] For example, the mapping relationship between pre-stored code and application service information can be pre-written by technical personnel. Through the pre-stored mapping relationship between code and application service information, code can be converted into application service information. This can avoid the problem of not being able to accurately determine the application service information based on the code due to different codes coded by different technical personnel, and can improve the accuracy of data analysis.

[0074] It is understandable that service call chains generated by the same type of business transactions have the same characteristics. For example, the operation of querying the balance of a personal financial account through a website includes the main business process of user login status verification, user personal information verification, user financial account query, and financial account balance reading. Each link of each business process can correspond to different service call nodes. This application embodiment is only used as an example for illustration, but it does not mean that this application embodiment is limited to this.

[0075] For example, by clustering the application service information corresponding to feature information, different business transactions can be classified, achieving the goal of grouping similar types of business transactions into one category. The clustering results include multiple service call link types, i.e., business transaction types. Each service call link type includes its application service information, and the target application service information is the application service information to be analyzed. By clustering the application service information, the business process information of each type of service call link can be determined, which is beneficial for analyzing and processing the business process.

[0076] For example, the types of service call chains may include HTTP calls, internal program calls, database calls, etc. This application is only used as an example for illustration, but it does not mean that the embodiments of this application are limited to this.

[0077] In this embodiment of the application, by converting the feature information of the code format into application service information and clustering the application service information, the business process information corresponding to the business transaction can be accurately obtained, so as to analyze the business process information to determine whether the business transaction has an anomaly, and effectively improve the accuracy of data analysis.

[0078] For example, when determining business process information based on target application service information, the business process information corresponding to the target application service information can be obtained based on the mapping relationship between the target application service information and the pre-stored application service information and business process information.

[0079] For example, based on the target application service information, determining the business process information can realize the logical information of the business transaction business layer. For instance, for the service call chain of service A-service B-service C, after clustering to determine the business process information, it can be transformed into business process information of business process 1-business process 2-business process 3. This application embodiment is only used as an example for illustration, but it does not mean that the embodiment of this application is limited to this.

[0080] Understandably, the target application service information obtained after clustering includes application-layer code logic information; for example, the application service name is actually the service interface name defined in the system code. Therefore, technical personnel need to pre-write the mapping relationship between the pre-defined application service information and business process information into the code.

[0081] In this embodiment of the application, the target application service information is converted into corresponding business process information, which enables direct analysis of the business process, shortens the time for business process analysis, and thus improves the efficiency of data analysis.

[0082] S204. Analyze the business process information to obtain the analysis results, which include whether the business transaction is abnormal or normal.

[0083] For example, business process information includes key business data. When analyzing business process information and obtaining analysis results, the key business information can be compared with preset standard key business data. If the key business information is consistent with the preset standard key business data, the analysis result is determined to include normal business transactions; if the key business information is inconsistent with the preset standard key business data, the analysis result is determined to include abnormal business transactions as well as the abnormal nodes and causes of the abnormalities.

[0084] It is understood that the preset standard business key data are key data during the normal operation of business transactions, such as service call duration and status return code during business transactions. This application embodiment does not limit this in any way.

[0085] For example, calling nodes with business key information that is inconsistent with preset standard business key data are identified as abnormal nodes, and the cause of the abnormality is derived based on the business key information. For example, calling node 1 has a problem with a long response time. This application embodiment does not specifically limit the abnormal problem.

[0086] For example, by analyzing the business process, information such as the transaction volume, average response time, and success rate of the business transactions corresponding to the business process can be obtained. This application embodiment does not impose any limitations on this.

[0087] In this embodiment of the application, by comparing key business information with preset standard key business data, it is possible to determine in a timely manner whether the service call chain is abnormal after the service call chain is generated, that is, whether the business transaction is abnormal, which greatly improves the efficiency of data analysis.

[0088] Therefore, the data analysis method based on distributed link tracing provided in this application obtains service data from multiple service call nodes during a business transaction through distributed link tracing technology, and generates service call links based on the service data; it extracts features from the service call links of multiple business transactions to obtain feature information corresponding to the service call links; it determines business process information based on the feature information; and it analyzes the business process information to obtain analysis results, including whether the business transaction is abnormal or normal. The technical solution provided in this application can generate service call links corresponding to a business transaction process through distributed link tracing technology, and through feature extraction and analysis, transform the feature information into a business process to determine the analysis results. This eliminates the need for manual analysis by technical personnel, improves the accuracy of data analysis, and enables automatic analysis of service call links during business transactions, thereby effectively improving the efficiency of data analysis.

[0089] In another embodiment of this application, to improve the user experience during business transactions, alarm information can be output when the analysis results of business transaction anomalies are obtained. When outputting alarm information, the abnormal node and the cause of the anomaly can be displayed, enabling technical personnel to maintain business transactions promptly based on the alarm information and avoid poor user experience caused by business transaction anomalies.

[0090] For example, alarm information can be output via voice, SMS, or other means, but this application embodiment does not impose any limitations on this.

[0091] In another embodiment of this application, service data of multiple service call nodes in the business transaction process is obtained through distributed link tracing technology, and a service call link is generated. The link unit in the service call link may include link identifier, service name, start time, duration, local information (i.e., the address information of the server to which the link unit belongs), peer information (i.e., the address information of the server to which the upper-level link unit belongs), and at least two of the following custom fields: transaction code, service call date, return code, and error code.

[0092] For example, the information contained in a link unit exists in the form of key-value pairs in distributed link tracing technology. The object relationships between the key-value pairs, the Chinese names of the key-value pairs, and the business meanings represented by the key-value pairs in the link unit can be seen in Table 1:

[0093] Table 1

[0094]

[0095] It is understood that the embodiments of this application are only illustrated using Table 1 as an example, but do not mean that the embodiments of this application are limited to this.

[0096] For example, the custom field contains custom monitoring data written by technicians. These custom fields may be the same or different for different business transactions; this embodiment does not impose any limitations on this. By defining the key-value pairs, content, and format of the data stored in this custom field, data with business meaning can be stored. For example, the correspondence between the key-value pairs and business meanings of the custom field is shown in Table 2:

[0097] Table 2

[0098]

[0099]

[0100] It is understood that the embodiments of this application are only illustrated using Table 2 as an example, but do not mean that the embodiments of this application are limited to this.

[0101] For example, after setting the format of the monitoring data, technicians can write pre-defined standard business key data into the service call chain along the critical path of the program logic.

[0102] To facilitate understanding of the data analysis method based on distributed link tracing provided in the embodiments of this application, the following will be explained through... Figure 3 The technical solutions provided in the embodiments of this application will be described in detail. Figure 3 This is a flowchart illustrating another data analysis method based on distributed link tracing provided in an embodiment of this application. According to... Figure 3 As shown, this data analysis method based on distributed link tracing may include the following steps:

[0103] S301, Single-link unit aggregated restoration service call link.

[0104] For example, single-link unit aggregation and reconstruction can reconstruct the service call chain of each business transaction based on the collected service data of the link units. The service call chain includes...

[0105] S302. Perform feature extraction and clustering based on the service call chain to obtain the clustering results.

[0106] For example, when performing feature extraction based on service call chains, the feature information corresponding to the service call chains can be obtained first. During clustering, the service call chains can be clustered based on feature information such as application identifier, service name, call order, and business information to obtain the clustering results. Specifically, please refer to the above embodiments; the embodiments in this application will not be repeated here.

[0107] S303, Define the meaning of the business.

[0108] For example, developers can define the business characteristics of the clustering results, that is, predefine the mapping relationship between code and application service information, and the mapping relationship between application service information and business process information. For details, please refer to the listed embodiments, which will not be repeated here.

[0109] S304, Business Layer Performance Alarm Analysis.

[0110] For example, the business process obtained from the business layer determines whether there are any anomalies in the business transaction, and outputs alarm information when an anomaly is found. Specifically, please refer to the above embodiments; the embodiments in this application will not be repeated here.

[0111] It is understood that the embodiments of this application do not impose any restrictions on the execution order of the above steps S302 and S303.

[0112] In summary, the technical solution provided in this application, through a distributed tracing protocol with relatively universal application service call collection capabilities, can collect monitoring service data in the same data format across different application systems, i.e., different service call nodes, thereby realizing the interconnection of service call links between applications and generating service call links. By performing feature analysis and clustering processing on the service call links, it enables the analysis of service data from application-layer service call links generated by a large number of business transactions. This allows for efficient and concise interpretation of performance data and business meaning at the business layer, rapid localization of abnormal business transaction issues, and thus improves the efficiency of data analysis.

[0113] Figure 4 A schematic diagram of a data analysis device 40 based on distributed link tracing provided in this application embodiment is shown below. For example, please refer to [link to example]. Figure 4 As shown, the data analysis device 40 based on distributed link tracing may include:

[0114] The generation module 401 is used to obtain service data of multiple service call nodes in the business transaction process through distributed tracing technology, and generate service call links based on the service data.

[0115] The processing module 402 is used to extract features from the service call links of multiple business transactions to obtain feature information corresponding to the multiple service call links.

[0116] The processing module 402 is also used to determine business process information based on the feature information.

[0117] Analysis module 403 is used to analyze business process information and obtain analysis results, including whether the business transaction is abnormal or normal.

[0118] Optionally, the feature information is in code format; the processing module 402 is specifically used to obtain the application service information corresponding to the feature information based on the feature information of the code format and the pre-stored mapping relationship between code and application service information; to cluster the application service information corresponding to the feature information to obtain clustering results, the clustering results including target application service information; and to determine business process information based on the target application service information.

[0119] Optionally, the processing module 402 is specifically used to obtain the business process information corresponding to the target application service information based on the mapping relationship between the target application service information and the pre-stored application service information and business process information.

[0120] Optionally, the business process information includes key business data; the analysis module 403 is specifically used to compare the key business information with preset standard key business data. If the key business information is consistent with the preset standard key business data, the analysis result is determined to include normal business transactions; if the key business information is inconsistent with the preset standard key business data, the analysis result is determined to include abnormal business transactions as well as the abnormal nodes and causes of the abnormality.

[0121] Optionally, the distributed tracing technology includes the Open Tracing protocol; the generation module 401 is specifically used to monitor multiple service call nodes in the business transaction process through the Open Tracing protocol, collect service data generated by each service call node; generate link units based on the service data, each link unit including a link unit identifier and a parent link unit identifier; obtain the corresponding call order of multiple link units based on the link unit identifiers and parent link unit identifiers of multiple link units; and connect multiple link units according to the call order to generate a service call link.

[0122] Optionally, the device also includes an output module 404, which is used to output alarm information when the analysis results include abnormal business transactions.

[0123] The data analysis device based on distributed link tracing provided in this application can execute the technical solution of the data analysis method based on distributed link tracing in any of the above embodiments. Its implementation principle and beneficial effects are similar to those of the data analysis method based on distributed link tracing. Please refer to the implementation principle and beneficial effects of the data analysis method based on distributed link tracing, which will not be repeated here.

[0124] Figure 5 This is a schematic diagram of an electronic device structure provided in this application. Figure 5 As shown, the electronic device 500 may include at least one processor 501 and a memory 502.

[0125] The memory 502 is used to store programs. Specifically, the program may include program code, which includes computer operation instructions.

[0126] The memory 502 may include high-speed RAM memory, and may also include non-volatile memory, such as at least one disk storage device.

[0127] The processor 501 executes computer execution instructions stored in the memory 502 to implement the data analysis method based on distributed link tracing described in the foregoing method embodiments. The processor 501 may be a central processing unit (CPU), an application-specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of this application. Specifically, when implementing the data analysis method based on distributed link tracing described in the foregoing method embodiments, the electronic device may be, for example, a terminal, a server, or other electronic device with processing capabilities.

[0128] Optionally, the electronic device 500 may also include a communication interface 503. In specific implementations, if the communication interface 503, memory 502, and processor 501 are implemented independently, they can be interconnected via a bus to complete communication. The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc., but this does not imply that there is only one bus or one type of bus.

[0129] Optionally, in a specific implementation, if the communication interface 503, memory 502, and processor 501 are integrated on a single chip, then the communication interface 503, memory 502, and processor 501 can communicate through an internal interface.

[0130] This application also provides a computer-readable storage medium, which may include various media capable of storing program code, such as a USB flash drive, a portable hard drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk. Specifically, the computer-readable storage medium stores program instructions, which are used in the methods described in the above embodiments.

[0131] This application also provides a program product including executable instructions stored in a readable storage medium. At least one processor of an electronic device can read the executable instructions from the readable storage medium, and the at least one processor executes the executable instructions to cause the electronic device to implement the distributed link tracing-based data analysis method provided in the various embodiments described above.

[0132] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application.

Claims

1. A method for data analysis based on distributed link tracing, characterized in that, The method comprises the following steps: In the execution process of a business transaction, service data of multiple service calling nodes in the business transaction process is acquired through a distributed link tracking technology; According to the service data, a link unit is generated; the link unit comprises a link unit identifier and a superior link unit identifier; According to the link unit identifiers and the superior link unit identifiers of multiple link units, a corresponding calling sequence of the multiple link units is obtained; The multiple link units are connected according to the calling sequence to generate a service calling link; Feature information corresponding to the service calling link is obtained by performing feature extraction on the service calling link of multiple business transactions; The feature information is in a code format; According to a mapping relationship between the feature information in the code format and pre-stored code and application service information, application service information corresponding to the feature information is obtained; The application service information corresponding to the feature information is clustered to obtain a clustering result, and the clustering result comprises target application service information; Business process information is determined according to the target application service information; An analysis result is obtained by analyzing the business process information, and the analysis result comprises business transaction abnormality or business transaction normality.

2. The method of claim 1, wherein, The determination of the business process information according to the target application service information comprises: According to a mapping relationship between the target application service information and pre-stored application service information and business process information, business process information corresponding to the target application service information is obtained.

3. The method according to any of claims 1-2, characterized in that, The business process information comprises business critical data. The analysis of the business process information to obtain the analysis result comprises: The business critical information is compared with preset standard business critical data; if the business critical information is consistent with the preset standard business critical data, it is determined that the analysis result comprises business transaction normality; If the business critical information is inconsistent with the preset standard business critical data, it is determined that the analysis result comprises business transaction abnormality and an abnormal node and an abnormal reason of the business transaction.

4. The method of claim 3, wherein, The distributed link tracking technology comprises an OpenTracing protocol.

5. The method according to any of claims 1-2, characterized by, The method further comprises: If the analysis result comprises business transaction abnormality, alarm information is output.

6. A data analysis apparatus based on distributed link tracing, characterized by, The method comprises the following steps: A generation module is configured to acquire service data of multiple service calling nodes in a business transaction process through a distributed link tracking technology in an execution process of a business transaction, and generate a service calling link according to the service data; A processing module is configured to perform feature extraction on the service calling link of multiple business transactions to obtain feature information corresponding to the service calling link; The feature information is in a code format; The processing module is further configured to determine business process information according to the feature information; An analysis module is configured to analyze the business process information to obtain an analysis result, and the analysis result comprises business transaction abnormality or business transaction normality; The generation module is specifically configured to generate a link unit according to service data; the link unit comprises a link unit identifier and a superior link unit identifier; According to the link unit identifier and the superior link unit identifier of the plurality of link units, a corresponding calling sequence of the plurality of link units is obtained; the plurality of link units are connected according to the calling sequence, and a service calling link is generated; The processing module is specifically configured to obtain the application service information corresponding to the feature information according to a mapping relationship between the feature information of the code format and the pre-stored code and application service information; The application service information corresponding to the feature information is clustered to obtain a clustering result, and the clustering result includes target application service information; Business process information is determined according to the target application service information.

7. An electronic device comprising: A processor, and a memory connected with the processor in communication; The memory stores computer execution instructions; The processor executes the computer execution instructions stored in the memory to implement the method in any one of claims 1-5.

8. A computer-readable storage medium, characterized in that, The computer readable storage medium stores computer execution instructions, and the computer execution instructions are executed by the processor to implement the method in any one of claims 1-5.

9. A computer program product comprising a computer program, characterized in that, The computer program is executed by the processor to implement the method in any one of claims 1-5.

Images