Method, device and electronic equipment for intelligent analysis of call chain based on log data

Abstract

The application provides a log data-based call chain intelligent analysis method and device and electronic equipment. In the embodiment, log data-based call chain intelligent analysis is achieved by analyzing log feature vectors corresponding to log data, and there is no need to pre-embed a call chain ID. Furthermore, in the embodiment, log data-based call chain intelligent analysis is achieved based on log feature vectors corresponding to log data, and there is no mandatory requirement and limitation on log formats.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data processing, in particular to a method and device for intelligent analysis of a call chain based on log data and an electronic device. BACKGROUND

[0002] A call chain is formed by organizing a series of methods through a chain. Each call chain has a unique call chain ID. When analyzing log data generated by running the methods in the call chain, the analysis of the call chain is based on the call chain ID carried in the log data.

[0003] The analysis based on the call chain strongly depends on the call chain ID, so the call chain ID is usually pre-embedded during application development to facilitate subsequent analysis of the call chain. However, if some call chain IDs are not pre-embedded, the subsequent analysis of the call chain corresponding to the unembedded call chain ID cannot be performed. SUMMARY

[0004] The present application provides a method and device for intelligent analysis of a call chain based on log data, so as to realize intelligent analysis of the call chain based on the log data without pre-embedding the call chain ID.

[0005] The present application provides a method for intelligent analysis of a call chain based on log data, which is applied to an electronic device and includes the following steps.

[0006] Obtaining original log data generated when a call chain is run, and denoising the obtained original log data to obtain a set of valid log data meeting data requirements;

[0007] Determining a corresponding log feature vector for each valid log data in the set of valid log data;

[0008] Classifying the log feature vectors corresponding to the valid log data to obtain at least one type of log feature vector;

[0009] Dividing the log feature vectors in each type of log feature vector to divide the log feature data belonging to the same call chain in the same call chain.

[0010] The present application provides a device for intelligent analysis of a call chain based on log data, which is applied to an electronic device and includes the following steps.

[0011] A denoising unit is configured to obtain original log data generated when a call chain is run, and denoise the obtained original log data to obtain a set of valid log data meeting data requirements;

[0012] A determining unit is configured to determine a corresponding log feature vector for each valid log data in the set of valid log data.

[0013] a classification unit, configured to classify the log feature vectors corresponding to the valid log data, to obtain at least one category of log feature vectors;

[0014] a division unit, configured to divide the log feature vectors in each category of log feature vectors, to divide the log feature data belonging to the same call chain in the same call chain.

[0015] The embodiment of the present application further provides an electronic device. The electronic device comprises a processor and a machine readable storage medium;

[0016] The machine readable storage medium stores machine executable instructions capable of being executed by the processor;

[0017] The processor is used to execute the machine executable instructions, to realize the steps of the method disclosed above.

[0018] It can be seen from the above technical solution that, in the embodiment, the call chain intelligent analysis based on log data is realized by analyzing the log feature vectors corresponding to the log data, and the call chain ID does not need to be pre-embedded.

[0019] Further, in the embodiment, the call chain intelligent analysis based on log data is realized based on the log feature vectors corresponding to the log data, and there is no mandatory requirement and limitation on the log format. BRIEF DESCRIPTION OF DRAWINGS

[0020] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present disclosure and serve to explain the principles of the present disclosure.

[0021] Figure 1 A method flowchart provided by the embodiment of the present application;

[0022] Figure 2 A step 102 implementation flowchart provided by the embodiment of the present application;

[0023] Figure 3 A step 103 implementation flowchart provided by the embodiment of the present application;

[0024] Figure 4 A step 104 implementation flowchart provided by the embodiment of the present application;

[0025] Figure 5 A method application schematic diagram provided by the embodiment of the present application;

[0026] Figure 6 An apparatus structure diagram provided by the embodiment of the present application;

[0027] Figure 7An electronic device structure diagram provided by the embodiment of the present application. DETAILED DESCRIPTION

[0028] The exemplary embodiments will be described in detail herein below with reference to the drawings. In the following description, the same numbers are used to represent the same elements throughout the drawings. The embodiments described in the following exemplary embodiments do not represent all the embodiments consistent with the present application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of the present application as detailed in the appended claims.

[0029] The terminology used in the present application is for the purpose of describing particular embodiments only and is not intended to be limiting of the present application. As used in the present application and the appended claims, the singular forms "a," "an" and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise.

[0030] In order to make the technical solutions provided by the embodiments of the present application better understood by those skilled in the art, and to make the above-mentioned purposes, features and advantages of the embodiments of the present application more apparent and easy to understand, the technical solutions in the embodiments of the present application are further described in detail below with reference to the drawings.

[0031] Referring to Figure 1 , Figure 1 A method flowchart provided by the embodiment of the present application. The flow is applied to an electronic device. Optionally, in the present embodiment, the electronic device herein can be a front-end device such as a terminal, etc., or a background server, etc., and the present embodiment does not specifically limit it.

[0032] As Figure 1 shown, the flow can include the following steps:

[0033] Step 101, obtaining original log data generated when a running call chain is executed, and denoising the obtained original log data to obtain a valid log data set meeting data requirements.

[0034] As previously described, the running call chain generates corresponding log data (herein referred to as original log data). Based on this, the original log data can be obtained in step 101. Optionally, in the present embodiment, the original log data generated when the running call chain is executed within a preset time window can be obtained in step 101.

[0035] After obtaining the original log data, the original log data is denoised to obtain a valid log data set meeting data requirements, as described in step 101.

[0036] Optionally, in the embodiment, the denoising of the obtained original log data can comprise: for each original log data, identifying, based on the trained log template model, associated word data related to the log template from the original log data, and deleting the identified associated word data from the original log data.

[0037] In one example, the log template model herein is generated by training the commonly used words of the log template by extracting the historical log data into word vectors according to special characters. The log template model herein contains the commonly used words (also called associated words) related to the log template. Based on this, the above-mentioned identification of associated word data related to the log template from the original log data based on the trained log template model can comprise: identifying data existing in the set (i.e., called associated word data related to the log template) from the original log data based on the log template model containing the set of commonly used words (also called associated words) related to the log template.

[0038] By denoising the obtained original log data, the problem of high similarity caused by different original log data carrying the same log template associated word can be solved, and the accuracy of subsequent intelligent analysis of the call chain based on log data can be improved.

[0039] Step 102, determining the corresponding log feature vector for each effective log data in the effective log data set.

[0040] Optionally, in the embodiment, the so-called effective log data refers to data that meets the specific requirements of log data, and here the specific requirements of log data can be set according to actual conditions. As for the data that meets the specific requirements of log data, such as a letter, a punctuation mark, a number, etc., the embodiments of the present application do not consider them.

[0041] As for how to determine the corresponding log feature vector for each effective log data, there are many implementation ways, Figure 2 For example, one of the implementation ways is shown, which is not described here.

[0042] Step 103, classifying the log feature vectors corresponding to each effective log data to obtain at least one type of log feature vector.

[0043] Optionally, in the embodiment, the classification of the log feature vectors corresponding to each effective log data can be realized by improving the conventional mean shift clustering algorithm, Figure 3 For example, one of the implementation ways is shown, which is not described here.

[0044] Step 104, dividing the log feature vectors in each type of log feature vector to divide the log feature data belonging to the same call chain in the same call chain.

[0045] Optionally, in this embodiment, data within the same call chain can be grouped into the same call chain by comparing the feature values ​​of each dimension in the log feature vector. (The following text...) Figure 4 One implementation method is illustrated here, but will not be elaborated upon further.

[0046] This concludes the process. Figure 1 The process is shown below.

[0047] pass Figure 1 As can be seen from the process shown, in this embodiment, intelligent analysis of the call chain based on log data is achieved by analyzing the log feature vector corresponding to the log data, which does not require pre-embedding the call chain ID.

[0048] Furthermore, in this embodiment, the intelligent analysis of the call chain based on log data is performed based on the log feature vector corresponding to the log data, without any mandatory requirements or restrictions on the log format.

[0049] The following is about Figure 2 The process is described as follows:

[0050] See Figure 2 , Figure 2 A flowchart illustrating the implementation of step 102 in an embodiment of this application. Figure 2 As shown, the process may include the following steps:

[0051] Step 201: For each valid log data, perform the following step 202.

[0052] Step 202: Determine the word feature vectors corresponding to the valid words in the valid log data, and determine the word category to which the valid words belong based on the word feature vectors corresponding to the valid words.

[0053] Optionally, in this embodiment, determining the word feature vector corresponding to a valid word in valid log data may include: for each valid log data, converting the string of a valid word in the valid log data into a byte array according to the string-byte array conversion method, determining the feature value in at least one dimension corresponding to the byte array, and combining the determined at least one feature value into the word feature vector corresponding to the word.

[0054] Optionally, in this embodiment, at least one dimension corresponding to the byte array may include: array length, mean, variance, first-order autocorrelation (acf1), number of intersections between the curve and the mean line, trend strength, linearity of the trend, and curvature of the trend.

[0055] Correspondingly, in the embodiment, the feature values in at least one dimension corresponding to the byte array can include: the array length of the byte array, and / or the average value and / or variance and / or first-order autocorrelation of all numerical values in the byte array, and / or the number of intersections of the curve of the byte array with the mean line, and / or the strength and / or linearity and / or curvature of the trend item of the byte array.

[0056] Optionally, in the embodiment, the determination of the word category to which the valid word belongs in the step 202 based on the word feature vector corresponding to the valid word can include:

[0057] The word feature vector corresponding to each valid word in the valid log data is input into the trained K-Means model to obtain the word category to which the valid word belongs.

[0058] In the embodiment, the K-Means model is trained based on the word feature vector corresponding to each valid word in the historical log data.

[0059] In step 203, the valid words in the valid log data are subjected to specified normalization processing to obtain standard word data.

[0060] It should be noted that in the embodiment, the step 202 and the step 203 do not have a fixed time sequence.

[0061] Optionally, in the embodiment, the valid words in the valid log data are subjected to specified normalization processing, such as converting the string of the valid words in the valid log data into Double type characters, etc., which is not specifically limited in the embodiment.

[0062] In step 204, the log feature vector corresponding to the valid log data is generated according to the standard word data under each word category.

[0063] Optionally, in the embodiment, if the K-Means model supports N feature dimensions, each feature dimension corresponds to a word category, based on which, in step 204, for each word category, the feature dimension corresponding to the word category is found in the N feature dimensions, and the standard word data under the word category is sequentially taken as the feature value on the feature dimension. By analogy, finally, the feature values on the N feature dimensions are combined to form the above-mentioned log feature vector according to the arrangement order of the N feature dimensions. That is, in the embodiment, the log feature vector includes the standard word data under each word category, the dimension of the log feature vector is each word category, and the feature value on the feature dimension in the log feature vector is the standard word data under the word category corresponding to the feature dimension.

[0064] Thus far, the process shown in the flowchart is completed. Figure 2 the flowchart is completed.

[0065] By Figure 2 The flow shown in FIG. 3 illustrates how to determine the corresponding log feature vector for each valid log data in the valid log data set. It should be noted that, Figure 2 is only one specific embodiment, and is not intended to limit.

[0066] The following describes the flow shown in FIG. 3: Figure 3

[0067] Referring to Figure 3 , Figure 3 The step 103 provided by the embodiment of the present application implements the flowchart. As shown in FIG. 4, the flow can include the following steps: Figure 3

[0068] Step 301: Select one of the log feature vectors as a center feature vector.

[0069] Optionally, in the embodiment, one of the log feature vectors to be processed can be randomly selected as the center feature vector. Initially, the log feature vectors to be processed can be all the log feature vectors in the flow shown in FIG. 3. In other cases, the log feature vectors to be processed can be defined according to the following, which is not described here. Figure 2

[0070] Step 302: Select a candidate log feature vector that meets the condition from the log feature vectors corresponding to each valid log data, and determine the selected candidate log feature vector that meets the condition as a candidate log feature vector set; the condition refers to that the distance between each candidate log feature vector in the candidate log feature vector set and the center feature vector is less than or equal to a preset distance.

[0071] In the embodiment, the preset distance can be set according to actual needs, and the embodiment of the present application is not specifically limited.

[0072] Step 303: Control the center feature vector to move a target value in the direction of a target offset vector, and the target offset vector is the sum of the offset vectors of each candidate log feature vector in the candidate log feature vector set relative to the center feature vector, and the target value is the modulus of the target offset vector.

[0073] Step 304: Check whether the target value is greater than or equal to a set offset threshold, if not, return to step 303, and if yes, record the position of the center feature vector, classify the center feature vector and other log feature vectors with a distance less than or equal to the preset distance from the center feature vector into the same class of log feature vectors, determine the log feature vectors that have not been classified as log feature vectors to be processed, and return to step 301 for the log feature vectors to be processed, until all the log feature vectors are classified. ​​​

[0074] In the embodiment, the offset threshold can be set according to actual requirements, and the embodiment is not specifically limited.

[0075] At this point, the process shown in Figure 3 is completed.

[0076] The process shown in Figure 3 is implemented to classify the log feature vectors corresponding to each valid log data. It should be noted that Figure 3 is only one specific embodiment, and is not intended to limit.

[0077] The process shown in Figure 4 will be described below:

[0078] Referring to Figure 4 , Figure 4 the steps 104 provided by the embodiment of the present application implement the flowchart. As shown in Figure 4 , the process can include the following steps:

[0079] Step 401, for each log feature vector in each category of log feature vectors, the following step 402 is executed.

[0080] Step 402, for each feature dimension in the log feature vector, the feature values on the feature dimension that meet the similarity condition are classified into the same call chain.

[0081] Optionally, in the embodiment, the same feature values on each feature dimension can be classified into the same call chain.

[0082] Through the process shown in Figure 4 , the call chain to which all feature values on all feature dimensions belong can be finally found.

[0083] At this point, the process shown in Figure 4 is completed.

[0084] It should be noted that in the embodiment, the designed model can be an unsupervised learning model, which does not need to be manually calibrated, saving human work.

[0085] The method provided by the embodiment of the present application is described above. In order to make the above method more easily understood from a global perspective, Figure 5 an example is shown to illustrate the method provided by the embodiment of the present application.

[0086] The device provided by the embodiment of the present application will be described below:

[0087] Referring to Figure 6 , Figure 6 the device structure diagram provided by the embodiment of the present application. The device is applied to an electronic device and includes:

[0088] The denoising unit is used to obtain the raw log data generated during the execution of the call chain, and to denoise the obtained raw log data to obtain a valid set of log data that meets the data requirements.

[0089] The determining unit is used to determine a corresponding log feature vector for each valid log data in the valid log data set;

[0090] The classification unit is used to classify the log feature vectors corresponding to each valid log data to obtain at least one class of log feature vectors;

[0091] The partitioning unit is used to divide the log feature vectors in each type of log feature vector, so that log feature data belonging to the same call chain are grouped into the same call chain.

[0092] Optionally, the denoising unit denoises the obtained raw log data by including:

[0093] For each piece of raw log data, based on the trained log template model, identify related words from the raw log data that are associated with the log template, and then delete the identified related words from the raw log data.

[0094] Optionally, determining the corresponding log feature vector for each valid log data in the valid log data set by the determining unit includes:

[0095] For each valid log data, perform the following steps:

[0096] Determine the word feature vectors corresponding to the valid words in the valid log data, and determine the word category to which the valid words belong based on the word feature vectors corresponding to the valid words;

[0097] The valid words in the valid log data are standardized to obtain standard word data. Log feature vectors are generated based on the standard word data under each word category. The log feature vectors include the standard word data under each word category. The feature dimension of the log feature vector is each word category. The feature value of the feature dimension in the log feature vector is the standard word data under the word category corresponding to that feature dimension.

[0098] Optionally, determining the word feature vectors corresponding to valid words in the valid log data includes:

[0099] For each valid log data, the string of the valid word in the valid log data is converted into a byte array according to the string-byte array conversion method, the feature value of at least one dimension corresponding to the byte array is determined, and the determined feature value is combined into the word feature vector corresponding to the word.

[0100] Wherein, the feature values ​​in at least one dimension include at least: the length of the byte array, and / or the mean and / or variance of all values ​​in the byte array and / or the first-order autocorrelation acf1, and / or the number of intersection points between the curve and the mean line, and / or the strength of the trend term and / or the linearity and / or the curvature.

[0101] Optionally, determining the word category of a valid word based on its corresponding word feature vector includes:

[0102] Input the word feature vectors corresponding to each valid word in the valid log data into the trained K-Means model to obtain the word category to which the valid words belong;

[0103] The K-Means model is trained based on the word feature vectors corresponding to each valid word in historical log data.

[0104] Optionally, the classification unit classifies the log feature vectors corresponding to each valid log data, including:

[0105] Select one of the log feature vectors as the center feature vector; select candidate log feature vectors that meet the conditions from the log feature vectors corresponding to each valid log data, and determine the selected candidate log feature vectors that meet the conditions as the candidate log feature vector set; the condition means that the distance between each candidate log feature vector in the candidate log feature vector set and the center feature vector is less than or equal to a preset distance;

[0106] The central feature vector is controlled to move by a target value along the direction of the target offset vector. The target offset vector is the sum of the offset vectors of each candidate log feature vector in the candidate log feature vector set relative to the central feature vector. The target value is the modulus of the target offset vector.

[0107] Check if the target value is greater than or equal to the set offset threshold. If not, return to select the log feature vector that meets the condition from the log feature vectors corresponding to each valid log data. If yes, record the position of the center feature vector. Classify the center feature vector and other log feature vectors whose distance from the center feature vector is less than or equal to the preset distance into the same type of log feature vector. For log feature vectors that have not been classified, return to the step of selecting one of the log feature vectors as the center feature vector, until all log feature vectors have been classified.

[0108] Optionally, the partitioning unit divides the log feature vectors in each class of log feature vectors into the following categories:

[0109] For each log feature vector in each log feature vector category, perform the following steps:

[0110] For each feature dimension in the log feature vector, feature values ​​that satisfy the similarity condition on that feature dimension are grouped into the same call chain.

[0111] This concludes the process. Figure 6 Structural description of the device shown.

[0112] This application also provides embodiments that... Figure 6 The hardware structure of the device shown. See also Figure 7 , Figure 7 This is a structural diagram of an electronic device provided in an embodiment of this application. Figure 7 As shown, the hardware structure may include: a processor and a machine-readable storage medium, the machine-readable storage medium storing machine-executable instructions that can be executed by the processor; the processor is used to execute the machine-executable instructions to implement the method disclosed in the above example of this application.

[0113] Based on the same application concept as the above method, this application embodiment also provides a machine-readable storage medium storing a plurality of computer instructions, which, when executed by a processor, can implement the method disclosed in the above examples of this application.

[0114] For example, the aforementioned machine-readable storage medium can be any electronic, magnetic, optical, or other physical storage device that can contain or store information such as executable instructions, data, etc. For instance, machine-readable storage media can be: RAM (Random Access Memory), volatile memory, non-volatile memory, flash memory, storage drives (such as hard disk drives), solid-state drives, any type of storage disk (such as optical discs, DVDs, etc.), or similar storage media, or combinations thereof.

[0115] The systems, devices, modules, or units described in the above embodiments can be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer, which can take the form of a personal computer, laptop computer, cellular phone, camera phone, smartphone, personal digital assistant, media player, navigation device, email sending and receiving device, game console, tablet computer, wearable device, or any combination of these devices.

[0116] For ease of description, the above devices are described separately by function as various units. Of course, in implementing this application, the functions of each unit can be implemented in one or more software and / or hardware.

[0117] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, embodiments of this application can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0118] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0119] Furthermore, these computer program instructions can also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in the process. Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0120] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 Figure 1 The steps of the function specified in one or more boxes.

[0121] The above description is merely an embodiment of this application and is not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A method for intelligent analysis of call chains based on log data, characterized in that, This method is applied to electronic devices, including: Obtain the raw log data generated during the execution of the call chain, and remove noise from the obtained raw log data to obtain a valid set of log data that meets the data requirements; For each valid log data in the valid log data set, a corresponding log feature vector is determined; the feature dimension of the log feature vector is each word category; the word category is determined based on the word feature vectors of valid words in the valid log data. Classify the log feature vectors corresponding to each valid log data to obtain at least one class of log feature vectors; For each log feature vector in each log feature vector category, perform the following steps: For each feature dimension in the log feature vector, group the feature values ​​that satisfy the similarity condition on that feature dimension into the same call chain.

2. The method according to claim 1, characterized in that, The noise reduction of the obtained raw log data includes: For each piece of raw log data, based on the trained log template model, identify related words from the raw log data that are associated with the log template, and then delete the identified related words from the raw log data.

3. The method according to claim 1, characterized in that, Determining the corresponding log feature vector for each valid log data in the valid log data set includes: For each valid log data, perform the following steps: Determine the word feature vectors corresponding to the valid words in the valid log data, and determine the word category to which the valid words belong based on the word feature vectors corresponding to the valid words; The valid words in the valid log data are standardized to obtain standard word data. Log feature vectors are generated based on the standard word data under each word category. The log feature vectors include the standard word data under each word category. The feature dimension of the log feature vector is each word category. The feature value of the feature dimension in the log feature vector is the standard word data under the word category corresponding to that feature dimension.

4. The method according to claim 3, characterized in that, The process of determining the word feature vector corresponding to the valid words in the valid log data includes: For each valid log data, the string of the valid word in the valid log data is converted into a byte array according to the string-byte array conversion method, the feature value of at least one dimension corresponding to the byte array is determined, and the determined feature value is combined into the word feature vector corresponding to the word. Wherein, the feature values ​​in at least one dimension include at least: the length of the byte array, and / or the mean and / or variance of all values ​​in the byte array and / or the first-order autocorrelation acf1, and / or the number of intersection points between the curve and the mean line, and / or the strength of the trend term and / or the linearity and / or the curvature.

5. The method according to claim 3, characterized in that, The process of determining the word category of a valid word based on its corresponding word feature vector includes: Input the word feature vectors corresponding to each valid word in the valid log data into the trained K-Means model to obtain the word category to which the valid words belong; The K-Means model is trained based on the word feature vectors corresponding to each valid word in historical log data.

6. The method according to claim 1, characterized in that, The classification of log feature vectors corresponding to each valid log data includes: Select one of the log feature vectors as the center feature vector; select candidate log feature vectors that meet the conditions from the log feature vectors corresponding to each valid log data, and determine the selected candidate log feature vectors that meet the conditions as the candidate log feature vector set; the condition means that the distance between each candidate log feature vector in the candidate log feature vector set and the center feature vector is less than or equal to a preset distance; The central feature vector is controlled to move by a target value along the direction of the target offset vector. The target offset vector is the sum of the offset vectors of each candidate log feature vector in the candidate log feature vector set relative to the central feature vector. The target value is the modulus of the target offset vector. Check if the target value is greater than or equal to the set offset threshold. If not, return to select the log feature vector that meets the condition from the log feature vectors corresponding to each valid log data. If yes, record the position of the center feature vector. Classify the center feature vector and other log feature vectors whose distance from the center feature vector is less than or equal to the preset distance into the same type of log feature vector. For log feature vectors that have not been classified, return to the step of selecting one of the log feature vectors as the center feature vector, until all log feature vectors have been classified.

7. A call chain intelligent analysis device based on log data, characterized in that, This device is used in electronic devices, including: The denoising unit is used to obtain the raw log data generated during the execution of the call chain, and to denoise the obtained raw log data to obtain a valid set of log data that meets the data requirements. A determining unit is used to determine a corresponding log feature vector for each valid log data in the valid log data set; the feature dimension of the log feature vector is each word category; the word category is determined based on the word feature vectors of valid words in the valid log data; The classification unit is used to classify the log feature vectors corresponding to each valid log data to obtain at least one class of log feature vectors; The partitioning unit is used to perform the following steps for each log feature vector in each type of log feature vector: for each feature dimension in the log feature vector, the feature values ​​that meet the similarity conditions on the feature dimension are grouped into the same call chain.

8. The apparatus according to claim 7, characterized in that, The determining unit determines a corresponding log feature vector for each valid log data in the valid log data set, including: For each valid log data, perform the following steps: Determine the word feature vectors corresponding to the valid words in the valid log data, and determine the word category to which the valid words belong based on the word feature vectors corresponding to the valid words; The valid words in the valid log data are standardized to obtain standard word data. Log feature vectors are generated based on the standard word data under each word category. The log feature vectors include the standard word data under each word category. The feature dimension of the log feature vector is each word category. The feature value of the feature dimension in the log feature vector is the standard word data under the word category corresponding to that feature dimension.

9. An electronic device, characterized in that, The electronic device includes: a processor and a machine-readable storage medium; The machine-readable storage medium stores machine-executable instructions that can be executed by the processor; The processor is configured to execute machine-executable instructions to implement the method steps of any one of claims 1-6.

Images