A method, device and equipment for detecting abnormality in a business system

Abstract

The present application provides a method, device and equipment for detecting abnormalities in a business system, which relates to the field of data verification. The method includes: when detecting a business system version update, obtaining the log information generated when the new business system processes the business; summarizing the log information in the current first summary time period, and determining the first log corresponding to each abnormal business behavior; obtaining the summary results of the log information in the second summary time period of the business system statistics before the update, and determining the second log corresponding to each abnormal business behavior; obtaining the corresponding statistical indicators based on the first log and the second log of the same abnormal business behavior, and when it is determined that the alarm conditions are met based on the changes in the statistical indicators, the abnormal business behavior is marked as an alarm. Through the solution provided by the present application, abnormal business when the new version of the business system is launched can be discovered in time, the time for problem location can be shortened, and the quality of business services can be improved.

Description

Technical Field

[0001] The present invention relates to the field of data verification, and in particular to a method, device and equipment for detecting anomalies in a business system. Background Art

[0002] Generally, large-scale banking systems will standardize the system standards. Transactions in each system are required to record monitoring logs. If a transaction goes wrong, the error code and error information will be output to the monitoring platform. The monitoring platform will usually monitor the success rate of a single transaction. For business errors, the monitoring threshold is relatively low and an alarm will be issued. For technical errors, the monitoring threshold is relatively high and an alarm will be issued. The above alarms are used to prompt operation and maintenance personnel to intervene in a timely manner.

[0003] The above method belongs to routine monitoring and is effective for stable versions. However, when a new version of the system is launched, it is in an unstable state. It is difficult to detect problems in a timely manner by relying solely on the above method.

[0004] 1. In the new version, the problem may not be with the entire transaction, but with a function in the transaction.

[0005] 2. After the version change was completed, it was still early in the morning. As time went by, the business volume gradually increased. Through the above transaction success rate monitoring, it was necessary to wait until the peak trading period to discover the problem. At this time, a large number of customers had complained, and subsequent emergency operations would be very passive.

[0006] 3. The current monitoring methods cannot identify whether this alarm is related to the launch of a new version. Problems that occur after the launch are not necessarily caused by this version, but may also be historical problems. Summary of the invention

[0007] The embodiments of the present application provide a method, device and equipment for detecting anomalies in a business system to solve the problem that business anomalies cannot be discovered in time when a new version of a business system is launched.

[0008] In a first aspect, an embodiment of the present application provides a method for detecting anomalies in a business system, the method comprising:

[0009] When a business system version update is detected, log information generated when the new business system processes business is obtained, and the log information includes business behavior, whether the business is abnormal, and the type of abnormality;

[0010] In response to the data statistics instruction, the log information in the current first summary time period is summarized to determine the first log corresponding to each abnormal business behavior;

[0011] Obtain the summary result of log information in the second summary time period of the business system before the historical update, and determine the second log corresponding to each abnormal business behavior, wherein the second summary time period and the first summary time period are the same time period in different time periods;

[0012] Corresponding statistical indicators are obtained according to the first log and the second log of the same abnormal business behavior. When it is determined that the alarm condition is met according to the change of the statistical indicators, the abnormal business behavior is marked as an alarm.

[0013] In a possible implementation, obtaining corresponding statistical indicators according to the first log and the second log of the same abnormal business behavior, and determining whether the alarm condition is met according to the change of the statistical indicators include:

[0014] It is determined that there is a new abnormal business behavior in the second log that does not appear in the first log, and it is determined that the alarm condition is met.

[0015] In a possible implementation, obtaining corresponding statistical indicators according to the first log and the second log of the same abnormal business behavior, and determining whether the alarm condition is met according to the change of the statistical indicators include:

[0016] When it is determined that the growth rate of the number of times the same abnormal business behavior appears in the first log exceeds the preset first threshold value compared with the number of times it appears in the second log, it is determined that the preset alarm condition is met.

[0017] In a possible implementation, obtaining corresponding statistical indicators according to the first log and the second log of the same abnormal business behavior, and determining whether the alarm condition is met according to the change of the statistical indicators include:

[0018] When it is determined that the number of times the same abnormal business behavior appears in the first log compared to the number of times it appears in the second log within the set number of summary time periods within this time period does not exceed the preset first threshold but exceeds the second preset threshold, it is determined that the alarm condition is met.

[0019] In a possible implementation, the first log / second log corresponding to each abnormal business behavior is determined:

[0020] When it is determined according to the information item of whether the business is abnormal in the log information that the information item indicates that the business is abnormal, the corresponding abnormal business behavior is obtained according to the abnormality type.

[0021] In a possible implementation, obtaining corresponding statistical indicators according to the first log and the second log of the same abnormal business behavior, and determining whether the alarm condition is met according to the change of the statistical indicators include:

[0022] Obtaining a first average processing time of the abnormal business behavior according to the number of times the same abnormal business behavior appears in the first log and the corresponding processing time of each occurrence;

[0023] According to the number of times the same abnormal business behavior appears in the second log and the corresponding processing time of each occurrence, a second average processing time of the abnormal business behavior is obtained;

[0024] When it is determined that the first average processing time is greater than the second average processing time and the difference exceeds a preset threshold, it is determined that an alarm condition is met.

[0025] In a possible implementation manner, after the abnormal business behavior is marked as an alarm, the method further includes:

[0026] Determine the program module corresponding to the abnormal business behavior with the alarm mark;

[0027] According to the program module comparison table of updated versions compared with previous versions, if it is determined that the program module is in the program module comparison table, the program module is marked as a new version program module, otherwise the program module is marked as an old version program module;

[0028] The abnormal business behavior to be identified by the alarm and the corresponding identification result are sent to the corresponding debugging client.

[0029] In a possible implementation, determining a program module corresponding to an abnormal business behavior with an alarm mark includes:

[0030] According to the first log corresponding to each abnormal business behavior, a mapping relationship table between each abnormal business line and the corresponding program module is established;

[0031] From the mapping relationship table, query the program module corresponding to the abnormal business behavior with the alarm mark.

[0032] In a possible implementation, the business includes transaction information, and the log information includes a transaction code identifying the business behavior, an error code identifying whether the business is abnormal and error information describing the error code, a transaction start time, and a transaction end time.

[0033] In a possible implementation, when a business system version update is detected, log information generated when the new business system processes business is obtained, including:

[0034] When the version update is complete, turn on the scheduled analysis switch;

[0035] When it is determined that the timing switch is turned on, the log information generated by each business client when processing the business is obtained through the business client deployed by the business system through the SDK;

[0036] When it is determined that the version has reached a stable operation index after the update, the timing analysis switch is turned off.

[0037] In a possible implementation, the step of aggregating the log information within the current first aggregation time period in response to the data statistics instruction includes:

[0038] Generate data statistics instructions at fixed time intervals T, and determine the time period with a time length of T before the current time as the current first summary time period;

[0039] Summarize the log information within the current first summary time period.

[0040] In a second aspect, an embodiment of the present application provides a device for detecting anomalies in a business system, the device comprising:

[0041] The log data acquisition module is used to acquire the log information generated when the new business system processes the business when the business system version is updated. The log information includes business behavior, whether the business is abnormal, and the abnormal type;

[0042] A data statistics module, configured to summarize the log information within the current first summary time period in response to the data statistics instruction, and determine the first log corresponding to each abnormal business behavior;

[0043] A log aggregation module is used to obtain the summary result of log information in a second summary time period of the business system statistics before the update, and determine the second log corresponding to each abnormal business behavior, wherein the second summary time period and the first summary time period are the same time period in different time periods;

[0044] The alarm identification module is used to obtain corresponding statistical indicators based on the first log and the second log of the same abnormal business behavior, and to identify the abnormal business behavior as an alarm when it is determined that the alarm condition is met based on the change of the statistical indicators.

[0045] In a third aspect, an embodiment of the present application provides a device for detecting anomalies in a business system, the device comprising:

[0046] At least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute a method for detecting anomalies in a business system.

[0047] In a fourth aspect, an embodiment of the present application provides a computer program product, which is used to enable a computer to execute a method in a method for detecting anomalies in a business system.

[0048] In a fifth aspect, an embodiment of the present application provides a computer storage medium, wherein the computer storage medium stores a computer program, and the computer program is used to enable a computer to execute any one of the business system anomaly detection methods.

[0049] The embodiment of the present application provides a method, device and equipment for detecting abnormalities in a business system, by comparing the statistical indicators of the log information of the new version of the business system and the business system before the update in the same time period of different time periods, and determining the change of the statistical indicators to meet the alarm conditions, the abnormal business behavior is marked with an alarm. Using the method provided by the embodiment of the present application, abnormal business when the new version of the business system is launched can be discovered in time, shortening the time for problem location and improving the quality of business services. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] Figure 1 It is a schematic diagram of an architecture diagram corresponding to a business system anomaly detection system according to an exemplary embodiment of the present invention;

[0051] Figure 2 A flowchart of a method for detecting anomalies in a business system according to an exemplary embodiment of the present invention;

[0052] Figure 3 A schematic diagram of a specific process of a method for detecting anomalies in a business system according to an exemplary embodiment of the present invention;

[0053] Figure 4 A schematic diagram of a device for detecting abnormalities in a business system according to an exemplary embodiment of the present invention;

[0054] Figure 5 The figure is a schematic diagram of a device for detecting abnormalities in a business system according to an exemplary embodiment of the present invention. DETAILED DESCRIPTION

[0055] The technical solutions in the embodiments of the present application will be described clearly and in detail below in conjunction with the accompanying drawings. Obviously, the described embodiments are part of the embodiments of the present invention, not all of them. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention. The acquisition, storage, use, and processing of data in the embodiments of the present application comply with the relevant provisions of national laws and regulations.

[0056] The method for detecting business system anomalies provided in this application is applied to the scenario where the monitoring platform server monitors the business system. Figure 1The diagram shows an architecture diagram corresponding to a business system anomaly detection system provided by an embodiment of the present application, which includes a monitoring platform server 101, a database 102, and at least one business system server (business system server 103_1, business system server 103_2, and business system server 103_3 in the example in the figure). The monitoring platform server 101 is used to collect business log data of the business system; the business system server can be a large-scale bank system, including a personal online banking system, a wealth management product sales system, a acquiring system (POS terminal, electronic clearing system), etc., for providing users with various business services; the database 102 is used to store the programs and data required by the monitoring platform server 101 to implement the corresponding functions.

[0057] The present application embodiment is applied to Figure 1 In the scenario shown, a large-scale banking system is taken as an example. Generally, large-scale banking systems will standardize system standards, and transactions in each system are required to record log information. Before the business system version is updated to reach stable operation indicators, the conventional monitoring method cannot meet the monitoring needs of abnormal business. The embodiment of the present application proposes a method for detecting abnormalities in the business system, such as Figure 2 As shown, the method includes:

[0058] S201: When a business system version update is detected, log information generated when the new business system processes business is obtained, where the log information includes business behavior, whether the business is abnormal, and the type of abnormality.

[0059] In a possible implementation, when it is determined that the version update is completed, a timed analysis switch is turned on;

[0060] When it is determined that the timing switch is turned on, the log information generated by each business client when processing the business is obtained through the business client deployed by the business system through the SDK;

[0061] When it is determined that the version has reached a stable operation index after the update, the timing analysis switch is turned off.

[0062] Since the method for detecting anomalies in the business system provided in this embodiment implements highly accurate detection and alarm, it is more costly than traditional detection methods. In view of the fact that when the version is updated to reach the operating stability index, traditional detection can also meet the detection needs, when the version is updated, the timing analysis switch is turned on to use the method provided in the embodiment of the present application to detect anomalies in the business system. Generally, after 3 days, the timing analysis switch is turned off.

[0063] For large-scale banking systems, business systems include various types for implementing various types of businesses. The business system version update of a bank generally refers to a large-scale business system version update, and its update cycle is relatively frequent. In order not to affect the provision of normal business services to users, the business system version update is generally performed in the early hours of Saturday. Due to the small transaction volume on weekends, especially in the early hours of the morning, some abnormal business behaviors may not be discovered in time, making subsequent emergency operations very passive. In response to this problem, the method provided in the embodiment of the present application obtains the log information generated when the new business system processes the business, and analyzes it, thereby solving the above problem.

[0064] In a possible implementation, the business includes transaction information, and the transaction information includes a transaction code identifying the business behavior, an error code identifying whether the business is abnormal and error information describing the error code, a transaction start time, and a transaction end time.

[0065] S202: In response to the data statistics instruction, log information in the current first summary time period is summarized to determine the first log corresponding to each abnormal business behavior.

[0066] In a possible implementation, the step of aggregating the log information within the current first aggregation time period in response to the data statistics instruction includes:

[0067] Generate data statistics instructions at fixed time intervals T, and determine the time period with a time length of T before the current time as the current first summary time period;

[0068] Summarize the log information within the current first summary time period.

[0069] The summary time period is calculated from the time when the business system version is updated. It can be summarized every hour. For example, if the business system version is updated at 2:10, then at 3 o'clock, the log information from 2:10 to 3:00 is summarized, and at 4 o'clock, the log information from 3:00 to 4:00 is summarized. It can also be summarized every hour. For example, if the business system version is updated at 2:10, then at 3:10, the log information from 2:10 to 3:10 is summarized.

[0070] The first log corresponding to the abnormal business behavior is obtained from the log information. In this process, normal business behavior is not counted, that is, successful transactions are not counted. The first log includes the transaction code of the abnormal business behavior after the system version is updated, the error code identifying the abnormal business and the error information describing the error code, the transaction start time and the transaction end time.

[0071] S203: Obtain the summary result of the log information in the second summary time period of the business system statistics before the update, and determine the second log corresponding to each abnormal business behavior, wherein the second summary time period and the first summary time period are the same time period in different time periods.

[0072] In addition to summarizing the log information of the new business system in S202, the log information of the business system before the update is also summarized. The summarization process can be performed when the monitoring platform server records the log information before the new version is launched, or when the log information in the first summary time period is summarized after the new version is launched.

[0073] The second log corresponding to the abnormal business behavior is obtained from the log information of the business system before the update. Similarly, normal business behavior is not counted. The second log includes the transaction code of the abnormal business behavior of the business system before the update, the error code identifying the abnormal business and the error information describing the error code, the transaction start time and the transaction end time.

[0074] The second summary time period is the same time period in a different time period than the first summary time period. The time period can be set according to the needs of the user, and can be a week or other set days. For example, if the first summary time period is 2:10-3:00, 3:00-4:00, then the second time period is 2:10-3:00, 3:00-4:00 one week ago.

[0075] S204: Obtain corresponding statistical indicators based on the first log and the second log of the same abnormal business behavior, and when it is determined that the alarm condition is met based on the change of the statistical indicators, mark the abnormal business behavior as an alarm.

[0076] Compare the first log of the new business system with the second log of the business system before the update. What needs to be compared are the statistical indicators corresponding to the same abnormal business behavior, that is, the statistical indicators corresponding to the same combination of transaction code, error code, and error message.

[0077] In a possible implementation, the first log / second log corresponding to each abnormal business behavior is determined:

[0078] According to the information item of whether the business is abnormal in the log information, the information item of whether the business is abnormal is only when the business is abnormal, and the corresponding abnormal business behavior is obtained according to the abnormal type. The abnormal business behavior is a combination of the transaction code of the business behavior, the error code identifying the business abnormality, and the error information under the abnormality.

[0079] The embodiment of the present application provides a method for detecting abnormalities in a business system, by comparing the statistical indicators of the log information of the new version of the business system and the business system before the update in the same time period of different time periods, and determining that the change in the statistical indicators meets the alarm condition, the abnormal business behavior is marked with an alarm. Using the method provided by the embodiment of the present application, abnormal business when a new version of the business system is launched can be discovered in a timely and proactive manner, shortening the time for locating the problem and minimizing the business impact caused by the problem.

[0080] like Figure 3 As shown, the method for detecting business system anomalies provided in the embodiment of the present application mainly includes two parts: comparative analysis of abnormal business behaviors of a new business system and a business system before update, and program module analysis.

[0081] 1. Comparative analysis of abnormal business behaviors between the new business system and the business system before the update.

[0082] In a possible implementation, obtaining corresponding statistical indicators according to the first log and the second log of the same abnormal business behavior, and determining whether an alarm condition is satisfied according to a change in the statistical indicators include at least one of the following:

[0083] 1) Determine whether there is a new abnormal business behavior in the second log that does not appear in the first log, and determine whether the alarm condition is met.

[0084] When an abnormal business behavior occurs for the first time, for example, the combination of transaction code, error code and error message "A0183A200 YBLA01823135 Incorrect input currency" appears in the first log of the new business system, but has never appeared in the second log of the business system before the update, it is determined that the alarm condition is met and an alarm indicator Y is set for the abnormal business behavior.

[0085] 2) When it is determined that the growth rate of the number of times the same abnormal business behavior appears in the first log exceeds the number of times it appears in the second log, it is determined that the preset alarm condition is met.

[0086] Table 1 is a statistical table of abnormal business behaviors of the new business system. The table only lists different abnormal business behaviors in the same business behavior, and the number of transactions corresponding to each abnormal business behavior.

[0087] Table 1

[0088]

[0089] Taking the first threshold of 30% as an example, the number of times the combination of abnormal business behavior "A0183A200YBLA01823135 Incorrect input currency" appears in the first log of the new business system is 8439 times, and the number of times the same abnormal business behavior "A0183A200YBLA01823135 Incorrect input currency" appears in the second log of the business system before the update is 5430 times. For this abnormal business behavior, the growth rate of the new business system compared to the business system before the update is (8439-5439) / 1439≈55.38%>30%, then it is determined that the alarm condition is met, and the alarm mark Y is set for the abnormal business behavior.

[0090] 3) When it is determined that the number of times the same abnormal business behavior appears in the first log compared to the number of times it appears in the second log within the set number of summary time periods within the current time period does not exceed the preset first threshold but exceeds the second preset threshold, it is determined that the alarm condition is met.

[0091] Taking the first threshold as 30%, the second threshold as 10%, and the set number as 2 as an example, summarize the first logs of the new business system from 2:10-3:00, 3:00-4:00, and 4:00-5:00; summarize the second logs of 2:10-3:00, 3:00-4:00, and 4:00-5:00 a week ago.

[0092] In the time period of 2:10-3:00, the number of times the combination of abnormal business behavior "A0183A200YBLA01823135 incorrect input currency" in the first log of the new business system appeared was 8439 times; the number of times the combination of the same abnormal business behavior "A0183A200YBLA01823135 incorrect input currency" in the second log of the business system before the update appeared was 7430 times. For this abnormal business behavior, the growth rate of the new business system compared with the business system before the update is (8439-7430) / 7430≈13.6%, which is between 10% and 30%, and the accumulation flag is set to 1 (initial 0).

[0093] In the time period of 3:00-4:00, the number of times the combination of abnormal business behavior "A0183A200YBLA01823135 incorrect input currency" appears in the first log of the new business system is 4239 times; the number of times the combination of the same abnormal business behavior "A0183A200YBLA01823135 incorrect input currency" appears in the second log of the business system before the update is 3902 times. For this abnormal business behavior, the growth rate of the new business system compared with the business system before the update is (4392-3902) / 3902≈12.6%, which is between 10% and 30%, and the accumulation flag is set to 2.

[0094] In the time period of 4:10-5:00, the number of times the combination of abnormal business behavior "A0183A200YBLA01823135 incorrect input currency" appears in the first log of the new business system is 7025 times; the number of times the combination of the same abnormal business behavior "A0183A200YBLA01823135 incorrect input currency" appears in the second log of the business system before the update is 5430 times. For this abnormal business behavior, the growth rate of the new business system compared with the business system before the update is (7025-5430) / 5430≈29.4%, which is between 10% and 30%, and the accumulation flag is set to 3.

[0095] If the number of times the same abnormal business behavior appears in the first log is greater than the number of times it appears in the second log in more than two summary time periods within this time period, and the growth rate is between 10% and 30%, that is, the cumulative flag is 3, then it is determined that the alarm condition is met and the alarm flag Y is set for the abnormal business behavior.

[0096] 4) According to the number of times the same abnormal business behavior appears in the first log and the corresponding processing time of each time, obtain the first average processing time of the abnormal business behavior; according to the number of times the same abnormal business behavior appears in the second log and the corresponding processing time of each time, obtain the second average processing time of the abnormal business behavior; when it is determined that the first average processing time is greater than the second average processing time and the difference exceeds a preset threshold, it is determined that the alarm condition is met.

[0097] In the process of aggregating log information, the start time and end time of processing each business will be recorded. In the process of determining the first log / second log corresponding to each abnormal business behavior, the number of times the same abnormal business behavior appears in the first log / second log is counted, and the processing time corresponding to each abnormal business behavior of the same abnormal business behavior in the first log / second log is calculated, that is, the end time of processing the abnormal business behavior minus the start time, the processing time corresponding to each time of the same abnormal business behavior is added and divided by the number of the same abnormal business behavior to obtain the average processing time of the abnormal business behavior.

[0098] Table 2 includes the average processing time corresponding to each abnormal transaction behavior in the first log.

[0099] Table 2

[0100]

[0101] Taking the abnormal transaction behavior "A0183A200 YBLA01823135 incorrect input currency" as an example, the preset threshold is 500ms. The abnormal transaction behavior in the new business system is 534ms, and the abnormal transaction behavior in the business system before the update is 22ms. 534>22, and 534-22=512ms, then it is determined that the alarm condition is met and the alarm flag Y is set for the abnormal business behavior.

[0102] 2. Program module analysis.

[0103] Acquire abnormal business behaviors with alarm marks in all program modules in the business system, and establish a corresponding table of error codes, error messages and program module names, as shown in Table 3.

[0104] Table 3

[0105] Error Code error message Program module name YBLA01823135 The currency entered is incorrect KBSADRW0 YBLA01826734 Incorrect account KBCRTWE1 XDBX00304590 This transaction is not allowed during this period KBCRTWE1

[0106] In a possible implementation, determining a program module corresponding to an abnormal business behavior with an alarm mark includes:

[0107] According to the first log corresponding to each abnormal business behavior, a mapping relationship table between each abnormal business line and the corresponding program module is established;

[0108] From the mapping relationship table, query the program module corresponding to the abnormal business behavior with the alarm mark.

[0109] Here we only count the correspondence between error codes, error messages, and program modules. Since one business behavior may correspond to multiple program modules, the correspondence between transaction codes and program modules is not considered.

[0110] In a possible implementation manner, after the abnormal business behavior is marked as an alarm, the method further includes:

[0111] Determine the program module corresponding to the abnormal business behavior with the alarm mark;

[0112] According to the program module comparison table of the updated version compared with the previous version, if it is determined that the program module is in the program module comparison table, the program module is marked as a new version program module, otherwise the program module is marked as an old version program module;

[0113] The abnormal business behavior to be identified by the alarm and the corresponding identification result are sent to the corresponding debugging client.

[0114] The program module corresponding to the abnormal business behavior with an alarm mark does not necessarily belong to the new business system. It may also be a problem that was not discovered in the business system before the update and was triggered after the version update. Both the program module of the new business system and the program module of the old version need to be debugged by the operation and maintenance personnel.

[0115] The method provided in the embodiment of the present application also includes a function of sending an alarm message. After the above S301 and S302 are completed, the abnormal business behavior with the alarm mark Y and the new version program module or the old version program module corresponding to the abnormal business behavior are determined, and the above content is combined into a text message and sent to the operation and maintenance personnel.

[0116] The above implementation method can distinguish the new version program module from the old version program module, so that the cause of the problem can be quickly obtained, the solution direction of the problem can be clarified, and accurate operation and maintenance can be achieved.

[0117] Based on the same inventive concept, the embodiment of the present application provides a service system detection device 400 such as Figure 4 As shown, the device comprises:

[0118] The log data acquisition module 401 is used to acquire the log information generated when the new business system processes the business when detecting the business system version update, and the log information includes the business behavior, whether the business is abnormal and the abnormal type;

[0119] A data statistics module 402 is used to summarize the log information in the current first summary time period in response to the data statistics instruction, and determine the first log corresponding to each abnormal business behavior;

[0120] The log aggregation module 403 is used to obtain the aggregation result of log information in the second aggregation time period of the business system before the update, and determine the second log corresponding to each abnormal business behavior, wherein the second aggregation time period and the first aggregation time period are the same time period in different time periods;

[0121] The alarm identification module 404 is used to obtain corresponding statistical indicators based on the first log and the second log of the same abnormal business behavior, and to identify the abnormal business behavior as an alarm when it is determined that the alarm condition is met based on the change of the statistical indicators.

[0122] In a possible implementation, the alarm identification module is used to obtain corresponding statistical indicators according to the first log and the second log of the same abnormal business behavior, and determine that the alarm condition is met according to the change of the statistical indicator, including:

[0123] It is determined that there is a new abnormal business behavior in the second log that does not appear in the first log, and it is determined that the alarm condition is met.

[0124] In a possible implementation, the alarm identification module is used to obtain corresponding statistical indicators according to the first log and the second log of the same abnormal business behavior, and determine that the alarm condition is met according to the change of the statistical indicator, including:

[0125] When it is determined that the growth rate of the number of times the same abnormal business behavior appears in the first log exceeds the preset first threshold value compared with the number of times it appears in the second log, it is determined that the preset alarm condition is met.

[0126] In a possible implementation, the alarm identification module is used to obtain corresponding statistical indicators according to the first log and the second log of the same abnormal business behavior, and determine that the alarm condition is met according to the change of the statistical indicator, including:

[0127] When it is determined that the number of times the same abnormal business behavior appears in the first log compared to the number of times it appears in the second log within the set number of summary time periods within this time period does not exceed the preset first threshold but exceeds the second preset threshold, it is determined that the alarm condition is met.

[0128] In a possible implementation, the log aggregation module is used to determine the first log / second log corresponding to each abnormal business behavior:

[0129] When it is determined according to the information item of whether the business is abnormal in the log information that the information item indicates that the business is abnormal, the corresponding abnormal business behavior is obtained according to the abnormality type.

[0130] In a possible implementation, the alarm identification module is used to obtain corresponding statistical indicators according to the first log and the second log of the same abnormal business behavior, and determine that the alarm condition is met according to the change of the statistical indicator, including:

[0131] Obtaining a first average processing time of the abnormal business behavior according to the number of times the same abnormal business behavior appears in the first log and the corresponding processing time of each occurrence;

[0132] According to the number of times the same abnormal business behavior appears in the second log and the corresponding processing time of each occurrence, a second average processing time of the abnormal business behavior is obtained;

[0133] When it is determined that the first average processing time is greater than the second average processing time and the difference exceeds a preset threshold, it is determined that an alarm condition is met.

[0134] In a possible implementation manner, after the alarm information sending module is used to determine that the abnormal business behavior is to be marked as an alarm, the method further includes:

[0135] Determine the program module corresponding to the abnormal business behavior with the alarm mark;

[0136] According to the program module comparison table of updated versions compared with previous versions, if it is determined that the program module is in the program module comparison table, the program module is marked as a new version program module, otherwise the program module is marked as an old version program module;

[0137] The abnormal business behavior to be identified by the alarm and the corresponding identification result are sent to the corresponding debugging client.

[0138] In a possible implementation manner, the alarm information sending module is used to determine the program module corresponding to the abnormal business behavior with the alarm mark, including:

[0139] According to the first log corresponding to each abnormal business behavior, a mapping relationship table between each abnormal business line and the corresponding program module is established;

[0140] From the mapping relationship table, query the program module corresponding to the abnormal business behavior with the alarm mark.

[0141] In one possible implementation, the business acquired by the log data acquisition module includes transaction information, and the log information includes a transaction code identifying the business behavior, an error code identifying whether the business is abnormal and error information identifying the abnormal error code, the transaction start time and the transaction end time.

[0142] In a possible implementation, the log data acquisition module is used to acquire log information generated when the new business system processes business when detecting a business system version update, including:

[0143] When the version update is complete, turn on the scheduled analysis switch;

[0144] When it is determined that the timing switch is turned on, the log information generated by each business client when processing the business is obtained through the business client deployed by the business system through the SDK;

[0145] When it is determined that the version has reached a stable operation index after the update, the timing analysis switch is turned off.

[0146] In a possible implementation, the data statistics module is used to summarize the log information within the current first summary time period in response to the data statistics instruction, including:

[0147] Generate data statistics instructions at fixed time intervals T, and determine the time period with a time length of T before the current time as the current first summary time period;

[0148] Summarize the log information within the current first summary time period.

[0149] Based on the same inventive concept, the present application provides a device for detecting abnormalities in a business system, such as Figure 5 As shown, the device includes at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute any one of the business system anomaly detection methods in the above-mentioned embodiments.

[0150] Refer to the following Figure 5 The electronic device 130 according to this embodiment of the present application is described. Figure 5 The electronic device 130 shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0151] like Figure 5 As shown, the electronic device 130 is in the form of a general electronic device. The components of the electronic device 130 may include but are not limited to: the at least one processor 131, the at least one memory 132, and a bus 133 connecting different system components (including the memory 132 and the processor 131).

[0152] The processor 131 is used to read and execute instructions in the memory 132, so that the at least one processor can execute a method for detecting anomalies in a business system provided in the above embodiment.

[0153] Bus 133 represents one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, a processor, or a local bus using any of a variety of bus architectures.

[0154] The memory 132 may include a readable medium in the form of a volatile memory, such as a random access memory (RAM) 1321 and / or a cache memory 1322 , and may further include a read-only memory (ROM) 1323 .

[0155] The memory 132 may also include a program / utility 1325 having a set (at least one) of program modules 1324, such program modules 1324 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0156] The electronic device 130 may also communicate with one or more external devices 134 (e.g., keyboards, pointing devices, etc.), may also communicate with one or more devices that enable a user to interact with the electronic device 130, and / or communicate with any device that enables the electronic device 130 to communicate with one or more other electronic devices (e.g., routers, modems, etc.). Such communication may be performed via an input / output (I / O) interface 135. Furthermore, the electronic device 130 may also communicate with one or more networks (e.g., a local area network (LAN), a wide area network (WAN), and / or a public network, such as the Internet) via a network adapter 136. As shown, the network adapter 136 communicates with other modules for the electronic device 130 via a bus 133. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device 130, including but not limited to: microcode, device drivers, redundant processors, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0157] In some possible implementations, various aspects of a method for detecting anomalies in a business system provided by the present application may also be implemented in the form of a program product, which includes program code. When the program product is run on a computer device, the program code is used to enable the computer device to execute the steps of a method for detecting anomalies in a business system according to various exemplary implementations of the present application described above in this specification.

[0158] In addition, the present application also provides a computer-readable storage medium, wherein the computer storage medium stores a computer program, wherein the computer program is used to enable a computer to execute any of the methods described in the above embodiments.

[0159] These computer program instructions may be stored in a computer readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0160] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0161] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.

[0162] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A method for detecting anomalies in a business system, characterized in that: The method comprises: When a business system version update is detected, log information generated when the new business system processes business is obtained, and the log information includes business behavior, whether the business is abnormal, and the type of abnormality; In response to the data statistics instruction, the log information in the current first summary time period is summarized to determine the first log corresponding to each abnormal business behavior, where the abnormal business behavior is determined according to the abnormal type when the information item indicating whether the business in the log information is abnormal indicates that the business is abnormal; Obtain the summary result of log information in the second summary time period of the business system before the historical update, and determine the second log corresponding to each abnormal business behavior, wherein the second summary time period and the first summary time period are the same time period in different time periods; Based on the number of times the same abnormal business behavior appears in the first log and the corresponding processing time of each time, a first average processing time of the abnormal business behavior is obtained; based on the number of times the same abnormal business behavior appears in the second log and the corresponding processing time of each time, a second average processing time of the abnormal business behavior is obtained; when it is determined that the first average processing time is greater than the second average processing time and the difference exceeds a preset threshold, an alarm is marked for the abnormal business behavior.

2. The method according to claim 1, characterized in that Obtain corresponding statistical indicators based on the first log and the second log of the same abnormal business behavior, and determine whether an alarm condition is met based on changes in the statistical indicators, including: It is determined that there is a new abnormal business behavior in the second log that does not appear in the first log, and it is determined that the alarm condition is met.

3. The method according to claim 1, characterized in that Obtain corresponding statistical indicators based on the first log and the second log of the same abnormal business behavior, and determine whether an alarm condition is met based on changes in the statistical indicators, including: When it is determined that the growth rate of the number of times the same abnormal business behavior appears in the first log exceeds the preset first threshold value compared with the number of times it appears in the second log, it is determined that the preset alarm condition is met.

4. The method according to claim 1, characterized in that Obtain corresponding statistical indicators based on the first log and the second log of the same abnormal business behavior, and determine whether an alarm condition is met based on changes in the statistical indicators, including: When it is determined that the number of times the same abnormal business behavior appears in the first log compared to the number of times it appears in the second log within the set number of summary time periods within this time period does not exceed the preset first threshold but exceeds the second preset threshold, it is determined that the alarm condition is met.

5. The method according to claim 1, characterized in that After the abnormal business behavior is marked as an alarm, the method further includes: Determine the program module corresponding to the abnormal business behavior with the alarm mark; According to the program module comparison table of updated versions compared with previous versions, if it is determined that the program module is in the program module comparison table, the program module is marked as a new version program module, otherwise the program module is marked as an old version program module; Send abnormal business behaviors with alarm identification and corresponding identification results to the corresponding debugging client.

6. The method according to claim 5, characterized in that Determine the program module corresponding to the abnormal business behavior with the alarm mark, including: According to the first log corresponding to each abnormal business behavior, a mapping relationship table between each abnormal business line and the corresponding program module is established; From the mapping relationship table, query the program module corresponding to the abnormal business behavior with the alarm mark.

7. The method according to claim 1, characterized in that The business includes transaction information, and the transaction information includes a transaction code identifying the business behavior, an error code identifying whether the business is abnormal and error information describing the error code, a transaction start time and a transaction end time.

8. The method according to claim 1, characterized in that When a business system version update is detected, the log information generated when the new business system processes business is obtained, including: When the version update is complete, turn on the scheduled analysis switch; When it is determined that the timing switch is turned on, the log information generated by each business client when processing the business is obtained through the business client deployed by the business system through the SDK; When it is determined that the version has reached a stable operation index after the update, the timing analysis switch is turned off.

9. The method according to claim 1, characterized in that: In response to the data statistics instruction, the log information within the current first summary time period is summarized, including: Generate data statistics instructions at fixed time intervals T, and determine the time period with a time length of T before the current time as the current first summary time period; Summarize the log information within the current first summary time period.

10. A device for detecting abnormalities in a business system, characterized in that: The device comprises: The log data acquisition module is used to acquire the log information generated when the new business system processes the business when the business system version is updated. The log information includes business behavior, whether the business is abnormal, and the abnormal type; A data statistics module, configured to respond to a data statistics instruction, summarize the log information within the current first summary time period, and determine the first log corresponding to each abnormal business behavior, wherein the abnormal business behavior is determined according to the abnormal type when the information item indicating whether the business in the log information is abnormal indicates that the business is abnormal; A log aggregation module is used to obtain the summary result of log information in a second summary time period of the business system statistics before the update, and determine the second log corresponding to each abnormal business behavior, wherein the second summary time period and the first summary time period are the same time period in different time periods; An alarm identification module is used to obtain a first average processing time of the abnormal business behavior based on the number of times the same abnormal business behavior appears in a first log and the corresponding processing time of each time; obtain a second average processing time of the abnormal business behavior based on the number of times the same abnormal business behavior appears in a second log and the corresponding processing time of each time; and when it is determined that the first average processing time is greater than the second average processing time and the difference exceeds a preset threshold, an alarm is identified for the abnormal business behavior.

11. A device for detecting abnormalities in a business system, characterized in that: The device comprises: At least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor so that the at least one processor can execute the method as described in any one of claims 1-9.

12. A computer program product, characterized in that The computer program product is used to make a computer execute the method according to any one of claims 1 to 9.

13. A computer storage medium, characterized in that: The computer storage medium stores a computer program, and the computer program is used to make a computer execute the method according to any one of claims 1 to 9.

Images