Business system anomaly detection method, device, equipment and storage medium

Abstract

The application provides an abnormality detection method, device and equipment of a business system and a storage medium. The method comprises the following steps: constructing an entity relationship diagram under a multi-layer system architecture for a to-be-detected business system; if it is detected that any current node in the entity relationship diagram is abnormal, then the abnormal information of the current node is transmitted layer by layer upwards according to the hierarchical relationship between the nodes in the entity relationship diagram until the top node in the entity relationship diagram is reached; and the abnormal risk score of the to-be-detected business system is predicted according to the abnormal aggregation information of the top node and the abnormal transmission information between the top neighbor node and the top node. The application realizes cross-layer abnormality detection of the business system under the multi-layer system architecture, breaks the isolation and isolation between the abnormal information of each layer under the multi-layer system architecture, avoids the problem of detection lag when the business system is detected in a single layer, and improves the timeliness and accuracy of the abnormality detection of the business system.

Description

Technical Field

[0001] This application relates to the field of data processing technology, specifically to an anomaly detection method, apparatus, device, and storage medium for a business system. Background Technology

[0002] With the advent of the information age and the application of artificial intelligence technology in various fields, Internet Technology (IT) operations and maintenance (O&M) has also ushered in a new era of intelligent O&M. To ensure the safe and reliable operation of large-scale hardware and software systems, professional O&M personnel are needed to deploy, operate, and maintain various business systems.

[0003] Currently, anomaly detection during the operation of business systems typically employs methods such as pre-defined anomaly detection rules, anomaly statistics from operational data, machine learning, or deep learning. However, for large and complex systems, especially those in multi-layered cloud deployment environments, these methods can only address anomaly detection at a single layer. For example, in a multi-layered cloud deployment environment, business systems may typically run on the platform service layer, which primarily supports these systems by providing basic support services such as caching, databases, and message queues. Then, the platform service layer is deployed on the cloud platform layer, which mainly supports the platform service layer by providing basic software infrastructure management functions, such as managing storage resources, computing resources, and various operating system resources within the cloud environment. Finally, the cloud platform layer runs on the hardware support layer, which primarily provides the hardware resources required for storage and computing, such as CPUs, caches, hard drives, and memory.

[0004] At this point, every layer upon which the business system depends during operation may experience anomalies, and any anomaly in any layer could ultimately lead to system failure and inoperability. However, existing system anomaly detection is deployed for anomaly monitoring of a single-layer network structure, failing to achieve cross-layer anomaly detection for business systems. Furthermore, anomaly monitoring data for each layer is relatively isolated; when anomalies occur in a lower layer of an adjacent layer, the upper layer cannot detect them in advance and continues to operate, resulting in delayed and untimely anomaly detection for the business system. Summary of the Invention

[0005] This application provides an anomaly detection method, apparatus, device, and storage medium for a business system. By utilizing the anomaly propagation between nodes at different layers in the entity relationship diagram under a multi-layer system architecture, it enables cross-layer anomaly detection for business systems in a multi-layer system architecture, breaks down the barriers between anomaly information at different layers under a multi-layer system architecture, and improves the timeliness and accuracy of anomaly detection in the business system.

[0006] In a first aspect, embodiments of this application provide an anomaly detection method for a business system, the method comprising:

[0007] Construct an entity relationship diagram for the business system to be tested under a multi-layer system architecture, wherein the nodes of the entity relationship diagram are the functional entities existing in each layer of the multi-layer system architecture;

[0008] If an anomaly is detected in any current node within the entity relationship graph, the anomaly information of the current node is passed up layer by layer according to the hierarchical relationship between nodes in the entity relationship graph, until it is passed to the top-level node in the entity relationship graph.

[0009] Based on the abnormal aggregation information of the top-level node and the abnormal transmission information from the top-level neighbor nodes to the top-level node, the abnormal risk score of the business system to be detected is predicted.

[0010] Secondly, embodiments of this application provide an anomaly detection device for a business system, the device comprising:

[0011] The entity graph construction module is used to construct an entity relationship graph for the business system to be tested under a multi-layer system architecture. The nodes of the entity relationship graph are the functional entities existing in each layer of the multi-layer system architecture.

[0012] An anomaly propagation module is used to, if an anomaly is detected in any current node in the entity relationship graph, propagate the anomaly information of the current node upwards layer by layer according to the hierarchical relationship between the nodes in the entity relationship graph, until it is propagated to the top-level node in the entity relationship graph.

[0013] The anomaly risk prediction module is used to predict the anomaly risk score of the business system to be detected based on the anomaly aggregation information of the top-level node and the anomaly transmission information from the top-level neighbor node to the top-level node.

[0014] Thirdly, embodiments of this application provide an electronic device, which includes:

[0015] A processor and a memory, wherein the memory is used to store a computer program, and the processor is used to call and run the computer program stored in the memory to execute the anomaly detection method for the business system provided in the first aspect of this application.

[0016] Fourthly, embodiments of this application provide a computer-readable storage medium for storing a computer program that causes a computer to execute an anomaly detection method for a business system as provided in the first aspect of this application.

[0017] Fifthly, embodiments of this application provide a computer program product, including a computer program / instruction, characterized in that, when the computer program / instruction is executed by a processor, it implements the anomaly detection method for a business system as provided in the first aspect of this application.

[0018] This application provides an anomaly detection method, apparatus, device, and storage medium for a business system. It utilizes the functional entities present in each layer of a multi-layered system architecture to which the business system is to be detected, constructing a corresponding entity relationship graph for the business system. When an anomaly is detected at any node within the entity relationship graph, the anomaly information of the current node is passed upwards layer by layer according to the hierarchical relationship between nodes in the entity relationship graph, until it reaches the top-level node. Then, based on the anomaly aggregation information of the top-level node and the anomaly transmission information from the top-level neighbor nodes to the top-level node, the anomaly risk score of the business system to be detected is predicted. This utilizes the anomaly information transmission between nodes in the entity relationship graph of a multi-layered system architecture to achieve cross-layer anomaly detection for the business system in a multi-layered system architecture. It breaks down the isolation and separation between anomaly information at different layers in a multi-layered system architecture, avoiding the detection lag problem in single-layer anomaly detection of the business system, and improving the timeliness and accuracy of anomaly detection in the business system. Attached Figure Description

[0019] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0020] Figure 1 This is a flowchart illustrating an anomaly detection method for a business system according to an embodiment of this application;

[0021] Figure 2 This is a schematic diagram illustrating the principle of the anomaly detection process of a business system as shown in an embodiment of this application;

[0022] Figure 3 This is a flowchart illustrating another anomaly detection method for a business system as shown in an embodiment of this application;

[0023] Figure 4 This is a schematic block diagram of an anomaly detection device for a business system, as shown in an embodiment of this application.

[0024] Figure 5 This is a schematic block diagram of the electronic device provided in the embodiments of this application. Detailed Implementation

[0025] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0026] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or server that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or devices.

[0027] Existing business system anomaly detection technologies typically perform anomaly monitoring and risk analysis on single-layer networks in multi-layer system architectures. However, due to the relative isolation and separation of anomaly information detected at each layer, business system anomaly detection suffers from lag. This fails to meet the business needs of multi-layer system architectures, such as the integration of anomaly monitoring data across layers (platform service layer, cloud platform layer, hardware layer) and real-time risk perception.

[0028] To address the aforementioned technical issues, this application proposes a scheme for cross-layer anomaly detection in business systems operating under multi-layered architectures. This scheme constructs an entity relationship diagram based on the functional entities present in each layer of the business system within the multi-layered architecture. This ensures successful anomaly information transmission between nodes at each layer within the entity relationship diagram, thereby enabling cross-layer anomaly detection in business systems operating under multi-layered architectures. This breaks down the isolation and separation between anomaly information at different layers within the multi-layered architecture, improving the timeliness and accuracy of anomaly detection in business systems.

[0029] Figure 1 This is a flowchart illustrating an anomaly detection method for a business system according to an embodiment of this application. (Refer to...) Figure 1 The method may specifically include the following steps:

[0030] S110 is used to construct an entity relationship diagram for the business system under the multi-layer system architecture.

[0031] Specifically, the business systems under testing are typically deployed in a multi-tiered system architecture within a cloud environment. For example, ... Figure 2As shown, the multi-layered system architecture comprises three layers: a platform service layer, a cloud platform layer, and a hardware support layer. The business system under test runs on the platform service layer, which primarily supports the business system by providing basic support services for application systems, including caching, databases, and message queues. Then, the platform service layer is deployed on the cloud platform layer, which mainly supports the platform service layer, providing basic software infrastructure management functions such as managing storage resources, computing resources, and various operating system resources in the cloud environment. Finally, the cloud platform layer runs on the hardware support layer, which primarily provides the hardware resources required for storage and computing, such as CPUs, caches, hard drives, and memory.

[0032] During the operation of the business system under test, any functional entity involved in the multi-layer system architecture may experience anomalies. In order to achieve cross-layer anomaly detection of the business system, it is first necessary to establish corresponding relationships between the functional entities in each layer of the multi-layer system architecture of the business system under test, so as to overcome the problem of relatively isolated and isolated anomaly detection between layers.

[0033] In this application, based on the various relationships between functional entities within each layer of the multi-layered system architecture of the business system under test, a corresponding entity relationship diagram is constructed for each functional entity. The nodes of the entity relationship diagram are the functional entities within each layer of the multi-layered system architecture; moreover, this entity relationship diagram is a directed graph formed according to the hierarchical relationship between the functional entities, that is, from the bottom layer to the top layer.

[0034] As an optional implementation scheme in this application embodiment, an entity relationship diagram under a multi-layer system architecture is constructed for the business system to be tested. Specifically, the following operations can be performed: extract the corresponding functional entities and the association relationships between functional entities from each layer of the multi-layer system architecture to which the business system to be tested is directed; construct the corresponding entity relationship diagram according to the association relationships between functional entities.

[0035] In other words, the process begins by analyzing the functional entities present in each layer of the multi-layered system architecture of the business system under test. These functional entities can include the functional components, files, classes, functions, etc., required for the normal operation of the business system. Then, based on the role of each functional entity, the relationships between them are analyzed. These relationships can include functional dependencies, function call relationships, etc. Finally, based on the relationships between the functional entities, the corresponding entity relationship graph can be constructed.

[0036] S120, if an anomaly is detected in any current node in the entity relationship diagram, the anomaly information of the current node is passed up layer by layer according to the hierarchical relationship between the nodes in the entity relationship diagram, until it is passed to the top-level node in the entity relationship diagram.

[0037] Optionally, after constructing an entity relationship diagram under a multi-layer system architecture for the business system to be tested, the relationship between the business system to be tested in each layer of the multi-layer system architecture can be determined according to the entity relationship diagram, thereby breaking down the isolation and separation between information in each layer of the multi-layer system architecture.

[0038] Specifically, during the operation of the business system under test, it is necessary to detect in real time whether there are any anomalies in each functional entity in each layer of the multi-layer system architecture, that is, to detect in real time whether there are any anomalies in each node in the entity relationship diagram.

[0039] In this application, if an anomaly is detected in any node within the entity relationship graph, that node is designated as the current node. Then, according to the hierarchical relationship between nodes in the entity relationship graph, other nodes located above and associated with the current node can be identified. Since the operation of these other nodes depends on the normal operation of the current node, it means that when the current node malfunctions, the identified other nodes may also malfunction accordingly. Therefore, the anomaly information of the current node will be transmitted sequentially from the current node to each identified other node according to the corresponding hierarchical relationship, thereby continuously affecting the normal operation of each other node.

[0040] Finally, considering that the functional entities in the lower layers of a multi-layer system architecture are mainly used to support the normal operation of a certain functional entity in the top layer, the abnormal information of the current node will eventually be transmitted to a certain top-level node in the entity relationship diagram according to the hierarchical relationship during the transmission process. Subsequently, by directly analyzing the abnormal information of the top-level node and other nodes directly associated with the top-level node, the abnormal situation of the business system to be detected can be determined.

[0041] S130, based on the abnormal aggregation information of the top-level node and the abnormal transmission information from the top-level neighbor node to the top-level node, predict the abnormal risk score of the business system to be detected.

[0042] Optionally, after passing the anomaly information of the current node layer by layer to a top-level node, it is considered that the top-level node may receive anomaly information from another anomaly node that is not associated with the current node. Therefore, in order to ensure the accuracy of anomaly detection in the business system, this application first needs to aggregate the original anomaly information of the top-level node and the anomaly information passed from each of the top-level node's top-level neighbor nodes, thereby obtaining the anomaly aggregation information of the top-level node. This anomaly aggregation information can accurately represent the final anomaly situation of the top-level node after being affected by anomaly nodes in each layer of the multi-layer system architecture.

[0043] Meanwhile, considering that the transmission of anomaly information from each top-level neighbor node to the top-level node can also affect the anomalies in the business system, this application, in order to ensure the comprehensiveness of anomaly detection in the business system, combines the anomaly aggregation information of the top-level node with the anomaly transmission information from each top-level neighbor node to the top-level node, and comprehensively analyzes the anomaly situation of the business system to be detected, thereby predicting the anomaly risk score of the business system to be detected.

[0044] Furthermore, to accurately analyze the severity of anomalies in the business system under test, this application divides the system into multiple risk levels and sets a matching anomaly risk score range for each risk level. For example, three risk levels—low-risk, medium-risk, and high-risk—are pre-defined, with score ranges set for each risk level as [0, 0.3], (0.3, 0.6], and [0.6, 1], respectively. After predicting the anomaly risk score of the business system under test, the application determines which risk level the anomaly risk score falls within based on the anomaly risk score and the pre-defined score range for each risk level, thus determining the anomaly risk level of the business system under test. Then, corresponding anomaly alarm operations are executed according to the anomaly risk level of the business system under test to ensure timely handling of anomalies in the business system.

[0045] The technical solution provided in this application adopts the functional entities existing in each layer of the multi-layer system architecture facing the business system under test, and constructs a corresponding entity relationship graph for the business system under test. When an anomaly is detected in any node in the entity relationship graph, the anomaly information of the current node is passed up layer by layer according to the hierarchical relationship between the nodes in the entity relationship graph, until it is passed to the top-level node in the entity relationship graph. Then, based on the anomaly aggregation information of the top-level node and the anomaly transmission information from the top-level neighbor node to the top-level node, the anomaly risk score of the business system under test is predicted. Thus, by utilizing the anomaly information transmission between nodes in the entity relationship graph of the multi-layer system architecture, cross-layer anomaly detection of the business system facing the multi-layer system architecture is realized, breaking down the isolation and separation between anomaly information of each layer in the multi-layer system architecture, avoiding the detection lag problem of the business system in single-layer anomaly detection, and improving the timeliness and accuracy of anomaly detection of the business system.

[0046] As an optional implementation scheme in the embodiments of this application, regarding the layer-by-layer transmission process of the abnormal information of the current node in the entity relationship graph, considering that there may be multiple association methods between nodes at different levels in the entity relationship graph, however... Figure 2As shown, after transmission begins from the same node using different association methods, it will eventually reach the same top-level node. Therefore, this application determines the transmission path from the current node to the top-level node according to the hierarchical relationship between nodes in the entity relationship graph. That is, from the multiple paths formed by various association methods between the current node and the top-level node in the entity relationship graph, one path is arbitrarily selected as the transmission path from the current node to the top-level node in this application. Then, following this transmission path, starting from the current node, the exception information of the current node is transmitted upwards layer by layer until it is transmitted to the top-level node in the entity relationship graph.

[0047] Specifically, during the transmission of anomaly information from the current node, it is merged with the anomaly information of each intermediate node before being jointly transmitted to the next node, and this process continues in a loop until it reaches the top-level node. This application provides a detailed description of the actual transmission process of anomaly information from the current node along the transmission path.

[0048] Figure 3 This is a flowchart illustrating another anomaly detection method for a business system, as shown in an embodiment of this application.

[0049] like Figure 3 As shown, the method may specifically include the following steps:

[0050] S310 constructs an entity relationship diagram for the business system to be tested, which is oriented towards a multi-layer system architecture. The nodes of this entity relationship diagram are the functional entities existing in each layer of the multi-layer system architecture.

[0051] S320: If an anomaly is detected in any current node in the entity relationship diagram, the transmission path from the current node to the top-level node is determined according to the hierarchical relationship between the nodes in the entity relationship diagram.

[0052] S330, determine the next node of the current node according to the transmission path.

[0053] After determining the propagation path from the current node to the top-level node, the next node of the current node is first analyzed to ensure that the corresponding exception information is passed to the next node. For example, such as... Figure 2 As shown, when the current node V1 is abnormal, the propagation path from the current node to the top-level node in the entity relationship graph can be determined as: V1->V2->V3->V4->V5->V6->V7, where V7 is the top-level node in the entity relationship graph.

[0054] S340, based on the node embedding vectors of the current node and the next node, determine the abnormal transmission information from the current node to the next node, and update the node embedding vector of the next node.

[0055] In this application, in order to accurately indicate that a certain node in the entity relationship graph has become abnormal, the node's own identification information is transmitted to indicate that the node has become abnormal, and the identification information of each node in the transmission process is affected by the abnormality to obtain new identification information.

[0056] It should be noted that after constructing the corresponding entity relationship graph for the business system to be tested, this application can directly use the conventional representation method of graph embedding to generate the node embedding vector of each node in the entity relationship graph. This allows the transmission of node anomaly information by passing the node embedding vector of the abnormal node. Here, the node embedding vector is a fixed-length string composed of 0s and 1s, used to identify different nodes within the entity relationship graph.

[0057] For example, assuming the entity relationship graph contains 10 nodes, the length of the node embedding vector is 4. At this time, the node embedding vector of each node can be {1000, 1001, 1011, 1111, 0001, 0011, 0111…}.

[0058] At this point, the set of node embedding vectors for each node in this application can be represented as E = {e1, e2, ..., e...} n}, where each element e i This represents the node embedding vector of a node Vi within the entity relationship graph.

[0059] Furthermore, after determining the node embedding vector of each node in the entity relationship graph, when this application transmits the abnormal information of the current node to the next node, it analyzes the abnormal situation of the current node, performs abnormal processing on the node embedding vector of the current node, and takes into account the degree of association between the current node and the next node, thereby transmitting the corresponding abnormal transmission information to the next node. This abnormal transmission information is determined by a combination of the node embedding vector of the current node and the degree of association between the current node and the next node. Then, after transmitting this abnormal transmission information to the next node, this abnormal transmission information will affect the node embedding vector of the next node, thereby updating the node embedding vector of the next node to accurately represent the abnormal impact received by the next node from the current node.

[0060] It should be understood that if the anomaly type of the current node is different, then the degree of anomaly impact of the current node on the next node will also be different, resulting in different anomaly propagation information passed from the current node to the next node. Furthermore, if the degree of association between the current node and the next node is different, then the degree of anomaly impact of the current node on the next node will also be different, resulting in different anomaly propagation information passed from the current node to the next node. Therefore, this application will comprehensively analyze the anomaly propagation information from the current node to the next node from the above two perspectives.

[0061] In this application, for any node in the entity relationship graph that experiences an anomaly, a corresponding anomaly weight can be pre-defined. Subsequently, different anomaly weights under different anomaly types are used to represent the anomaly propagation information from the current node to the next node under varying degrees of impact. For example, the anomaly types in this application may include T = {network failure, server failure, configuration error, defective version release, network overload, server overload, external attack, hardware failure, storage failure, database connection failure}, and based on experience, a weight W is assigned to each anomaly type in T. T = {Network failure: 0.1, Server failure: 0.1, Configuration error: 0.2, Defective version released: 0.2, Network overload: 0.1, Server overload: 0.1, External attack: 0.4, Hardware failure: 0.1, Storage failure: 0.1, Database connection failure: 0.1}. At this point, the anomaly weight of any node in the entity relationship diagram can be determined by the anomaly type of that node.

[0062] Meanwhile, the degree of association between the current node and the next node can be represented by the dot product of the node embedding vector of the current node and the node embedding vector of the next node.

[0063] Therefore, for abnormal transmission information from the current node to the next node, this application can utilize the abnormal weight of the current node to process the node embedding vectors of the current node and the next node to obtain the abnormal transmission information from the current node to the next node.

[0064] For example, using the above method, abnormal transmission information from the current node to the next node can be determined as follows: in, The node embedding vector for the current node. The node embedding vector for the next node. This represents the abnormal weight of the current node.

[0065] Then, this application updates the node embedding vector of the next node, which involves analyzing the abnormal situations of the next node. Considering that the next node may have other neighboring nodes besides the current node, and that these other neighboring nodes may also experience abnormalities, the corresponding abnormality propagation information is passed to the next node in the manner described above. Therefore, the next node will be affected by the abnormalities of each neighboring node. Based on the pre-set fusion weights of each neighboring node, the abnormality propagation information passed from each neighboring node to the next node is fused into the node embedding vector of the next node, resulting in the updated node embedding vector of the next node.

[0066] In this application, considering that the impact of each neighboring node on the next node is different, the application can use an attention mechanism to pre-set the fusion weight of each neighboring node.

[0067] Furthermore, after obtaining the anomaly propagation information from each neighbor node to the next node, the fusion weights of each neighbor node can be used to perform a weighted summation of the anomaly propagation information from each neighbor node to the next node, thus obtaining the comprehensive anomaly information of the next node's neighbors. Then, by adding this comprehensive anomaly information to the original node embedding vector of the next node, the updated node embedding vector of the next node can be obtained.

[0068] For example, the comprehensive neighbor anomaly information received by the next node from each neighbor node can be: in, Indicates the next node v j The set of all neighboring nodes; v x Indicates the next node v j any neighboring node; f(v j ,v x ) indicates the next node v j neighbor node v x The fusion weights; Indicates from neighbor node v x To the next node v j Abnormal information transmission between them.

[0069] Wherein, the next node v j neighbor node v x The fusion weight f(v) j ,v x Using an attention mechanism, it can be represented as in, Indicates the next node v j The number of all neighboring nodes; It is a fixed constant used to limit the size of the vector dot product result.

[0070] Furthermore, after passing the anomaly information from the first-order neighbor node to the next node, the updated node embedding vector of the next node can be... When the next node is a higher-order node, the corresponding recursive process of anomaly information transmission can be analyzed to determine the updated node embedding vector of the next node after the anomaly information is transmitted from the (l-1)th-order neighbor node to the l-th-order next node. The comprehensive information on neighbor anomalies of the next node can be represented as follows:

[0071] S350: Take the next node as the new current node, and continue to update the node embedding vector of the next node of the new current node according to the propagation path, until the node embedding vector of the top-level node is updated.

[0072] After passing the exception information of the current node to the next node, it continues to pass upwards from the next node until it reaches the top-level node. At this point, the next node is taken as the new current node, and then S330 and S340 are executed again according to the passing path, thereby continuing to update the node embedding vector of the next node of the new current node. This process is repeated until the node embedding vector of the top-level node is updated.

[0073] For example, in this application, the updated node embedding vector of the top-level node is: in, This is the original node embedding vector of the top-level node.

[0074] S360 uses the updated node embedding vector of the top-level node as the node aggregation information of the top-level node.

[0075] Optionally, after the anomaly information of the current node is passed up layer by layer to the top-level node, the original node embedding vector of the top-level node will also be aggregated and updated according to the anomaly propagation information passed up by each top-level neighbor node, thus obtaining the updated node embedding vector of the top-level node. Then, the updated node embedding vector of the top-level node is used as the node aggregation information of the top-level node, which facilitates the subsequent analysis of the anomaly risk score of the business system under test directly on the top-level node.

[0076] S370 uses the anomaly weights of each top-level neighbor node to perform a weighted summation of the anomaly transmission information from each top-level neighbor node to the top-level node, thus obtaining the corresponding transmission aggregation information.

[0077] After the top-level node aggregates the abnormal transmission information from each top-level neighbor node and updates its original node embedding vector, in order to ensure the accuracy of anomaly detection in the business system, this application will also use the anomaly weights of each top-level neighbor node to perform a weighted summation of the abnormal transmission information from each top-level neighbor node to the top-level node, so as to analyze the impact of each top-level neighbor node on the anomalies of the business system to be detected and obtain the corresponding transmission aggregation information.

[0078] For example, the aggregation information received by the top-level node in this application is: Among them, w nx Represents the top-level node v n Each top-level neighbor node v x Abnormal weights.

[0079] S380, based on the anomaly weight of the top-level node and the number of top-level neighbor nodes, integrates node aggregation information and transmission aggregation information to obtain the anomaly risk score of the business system to be tested.

[0080] After determining the abnormal aggregation information of the top-level node and the transmitted aggregation information from each top-level neighbor node, the abnormal aggregation information of the top-level node can be processed for abnormality using the abnormal weight of the top-level node, and the transmitted aggregation information received by the top-level node can be processed for abnormality averaging using the number of top-level neighbor nodes. The processed abnormal aggregation information and the transmitted aggregation information are then fused to obtain the abnormal risk score of the business system to be tested.

[0081] For example, the anomaly risk score in this application is:

[0082] The technical solution provided in this application adopts the functional entities existing in each layer of the multi-layer system architecture facing the business system under test, and constructs a corresponding entity relationship graph for the business system under test. When an anomaly is detected in any node in the entity relationship graph, the anomaly information of the current node is passed up layer by layer according to the hierarchical relationship between the nodes in the entity relationship graph, until it is passed to the top-level node in the entity relationship graph. Then, based on the anomaly aggregation information of the top-level node and the anomaly transmission information from the top-level neighbor node to the top-level node, the anomaly risk score of the business system under test is predicted. Thus, by utilizing the anomaly information transmission between nodes in the entity relationship graph of the multi-layer system architecture, cross-layer anomaly detection of the business system facing the multi-layer system architecture is realized, breaking down the isolation and separation between anomaly information of each layer in the multi-layer system architecture, avoiding the detection lag problem of the business system in single-layer anomaly detection, and improving the timeliness and accuracy of anomaly detection of the business system.

[0083] Figure 4 This is a schematic block diagram of an anomaly detection device for a business system, as shown in an embodiment of this application.

[0084] like Figure 4 As shown, the device 400 may include:

[0085] The entity graph construction module 410 is used to construct an entity relationship graph for the business system to be tested under a multi-layer system architecture. The nodes of the entity relationship graph are the functional entities existing in each layer of the multi-layer system architecture.

[0086] The exception transmission module 420 is used to transmit the exception information of any current node in the entity relationship graph upwards layer by layer according to the hierarchical relationship between the nodes in the entity relationship graph if an exception is detected in any current node in the entity relationship graph, until it is transmitted to the top-level node in the entity relationship graph.

[0087] The anomaly risk prediction module 430 is used to predict the anomaly risk score of the business system to be detected based on the anomaly aggregation information of the top-level node and the anomaly transmission information from the top-level neighbor node to the top-level node.

[0088] Furthermore, the exception transmission module 420 may include:

[0089] The transmission path determination unit is used to determine the transmission path from the current node to the top-level node according to the hierarchical relationship between the nodes in the entity relationship diagram;

[0090] An exception transmission unit is used to transmit the exception information of the current node upwards layer by layer according to the transmission path until it is transmitted to the top-level node.

[0091] Furthermore, the exception transmission unit may include:

[0092] The next node determination subunit is used to determine the next node of the current node according to the transmission path;

[0093] An anomaly propagation subunit is used to determine anomaly propagation information from the current node to the next node based on the node embedding vectors of the current node and the next node, and to update the node embedding vector of the next node.

[0094] The loop propagation subunit is used to take the next node as the new current node and continue to update the node embedding vector of the next node of the new current node according to the propagation path until the node embedding vector of the top-level node is updated.

[0095] Furthermore, the exception transmission subunit can be specifically used for:

[0096] By utilizing the anomaly weight of the current node, the node embedding vectors of the current node and the next node are processed to obtain the anomaly transmission information from the current node to the next node;

[0097] The anomaly weight of any node in the entity relationship graph is determined by the anomaly type of that node.

[0098] Furthermore, the exception transmission subunit can also be specifically used for:

[0099] According to the fusion weights set by each neighbor node of the next node, the abnormal transmission information passed from each neighbor node to the next node is fused into the node embedding vector of the next node to obtain the updated node embedding vector of the next node.

[0100] The fusion weights of each neighbor node are set using an attention mechanism.

[0101] Furthermore, the anomaly detection device 400 of the business system may also include:

[0102] The embedding vector generation module is used to generate a node embedding vector for each node in the entity relationship graph based on the entity relationship graph.

[0103] Furthermore, the abnormal risk prediction module 430 can be specifically used for:

[0104] The updated node embedding vector of the top-level node is used as the node aggregation information of the top-level node;

[0105] By using the anomaly weights of each top-level neighbor node, the anomaly transmission information from each top-level neighbor node to the top-level node is weighted and summed to obtain the corresponding transmission aggregation information;

[0106] Based on the anomaly weight of the top-level node and the number of top-level neighbor nodes, the node aggregation information and the transmission aggregation information are fused to obtain the anomaly risk score of the business system to be detected.

[0107] Furthermore, the entity graph construction module 410 can be specifically used for:

[0108] Extract the corresponding functional entities and the relationships between the functional entities from each layer of the multi-layer system architecture that the business system to be tested faces;

[0109] Construct the corresponding entity relationship diagram based on the association relationships between the functional entities.

[0110] Furthermore, the anomaly detection device 400 of the business system may also include:

[0111] The risk level determination module is used to determine the abnormal risk level of the business system to be operated based on the abnormal risk score and the score range set under each risk level.

[0112] In this embodiment, functional entities existing in each layer of the multi-layered system architecture of the business system under test are used to construct a corresponding entity relationship graph for the business system under test. When an anomaly is detected in any node of the entity relationship graph, the anomaly information of the current node is passed up layer by layer according to the hierarchical relationship between the nodes in the entity relationship graph, until it is passed to the top-level node in the entity relationship graph. Then, based on the anomaly aggregation information of the top-level node and the anomaly transmission information from the top-level neighbor node to the top-level node, the anomaly risk score of the business system under test is predicted. Thus, by utilizing the anomaly information transmission between nodes in the entity relationship graph of the multi-layered system architecture, cross-layer anomaly detection of the business system under the multi-layered system architecture is realized. This breaks down the isolation and separation between anomaly information of each layer in the multi-layered system architecture, avoids the problem of detection lag in single-layer anomaly detection of the business system, and improves the timeliness and accuracy of anomaly detection of the business system.

[0113] It should be understood that the device embodiments and method embodiments can correspond to each other, and similar descriptions can be referred to the method embodiments. To avoid repetition, further details will not be provided here. Specifically, Figure 4 The apparatus 400 shown can execute any of the method embodiments provided in this application, and the foregoing and other operations and / or functions of each module in the apparatus 400 are respectively for implementing the corresponding processes in the various methods of the embodiments of this application. For the sake of brevity, they will not be described in detail here.

[0114] The apparatus 400 of this application embodiment has been described above from the perspective of functional modules in conjunction with the accompanying drawings. It should be understood that this functional module can be implemented in hardware, in software instructions, or in a combination of hardware and software modules. Specifically, the steps of the method embodiments in this application can be completed by integrated logic circuits in the processor's hardware and / or by software instructions. The steps of the method disclosed in this application embodiment can be directly manifested as execution by a hardware decoding processor, or by a combination of hardware and software modules in the decoding processor. Optionally, the software module can reside in a mature storage medium in the art, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, or registers. This storage medium is located in memory, and the processor reads information from the memory and, in conjunction with its hardware, completes the steps in the above method embodiments.

[0115] Figure 5 This is a schematic block diagram of the electronic device 500 provided in the embodiments of this application.

[0116] like Figure 5 As shown, the electronic device 500 may include:

[0117] The system includes a memory 510 and a processor 520. The memory 510 stores computer programs and transfers the program code to the processor 520. In other words, the processor 520 can retrieve and run the computer program from the memory 510 to implement the methods described in the embodiments of this application.

[0118] For example, the processor 520 can be used to execute the above-described method embodiments according to instructions in the computer program.

[0119] In some embodiments of this application, the processor 520 may include, but is not limited to:

[0120] General-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc.

[0121] In some embodiments of this application, the memory 510 includes, but is not limited to:

[0122] Volatile memory and / or non-volatile memory. Non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. Volatile memory can be random access memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of RAM are available, such as Static RAM (SRAM), Dynamic RAM (DRAM), Synchronous DRAM (SDRAM), Double Data Rate SDRAM (DDR SDRAM), Enhanced Synchronous DRAM (ESDRAM), Synchronous Link DRAM (SLDRAM), and Direct Rambus RAM (DR RAM).

[0123] In some embodiments of this application, the computer program may be divided into one or more modules, which are stored in the memory 510 and executed by the processor 520 to perform the method provided in this application. The one or more modules may be a series of computer program instruction segments capable of performing a specific function, which describe the execution process of the computer program in the electronic device.

[0124] like Figure 5 As shown, the electronic device may also include:

[0125] Transceiver 530, which can be connected to processor 520 or memory 510.

[0126] The processor 520 can control the transceiver 530 to communicate with other devices; specifically, it can send information or data to other devices or receive information or data sent by other devices. The transceiver 530 may include a transmitter and a receiver. The transceiver 530 may further include antennas, and the number of antennas may be one or more.

[0127] It should be understood that the various components in the electronic device are connected through a bus system, which includes a data bus, a power bus, a control bus, and a status signal bus.

[0128] This application also provides a computer storage medium storing a computer program thereon, which, when executed by a computer, enables the computer to perform the methods of the above-described method embodiments. Alternatively, this application also provides a computer program product containing instructions that, when executed by a computer, cause the computer to perform the methods of the above-described method embodiments.

[0129] When implemented using software, it can be implemented entirely or partially as a computer program product. This computer program product includes one or more computer instructions. When these computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that integrates one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., digital video disc (DVD)), or a semiconductor medium (e.g., solid-state disk (SSD)).

[0130] Those skilled in the art will recognize that the modules and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0131] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of modules is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple modules or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or modules may be electrical, mechanical, or other forms.

[0132] The modules described as separate components may or may not be physically separate. The components shown as modules may or may not be physical modules; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. For example, the functional modules in the various embodiments of this application may be integrated into one processing module, or each module may exist physically separately, or two or more modules may be integrated into one module.

[0133] The above are merely specific embodiments of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. An anomaly detection method for a business system, characterized in that, include: Construct an entity relationship diagram for the business system to be tested under a multi-layer system architecture, wherein the nodes of the entity relationship diagram are the functional entities existing in each layer of the multi-layer system architecture; If an anomaly is detected in any current node within the entity relationship graph, the anomaly information of the current node is passed up layer by layer according to the hierarchical relationship between nodes in the entity relationship graph, until it is passed to the top-level node in the entity relationship graph. Based on the abnormal aggregation information of the top-level node and the abnormal transmission information from the top-level neighbor node to the top-level node, the abnormal risk score of the business system to be detected is predicted. The step of predicting the anomaly risk score of the business system to be detected based on the anomaly aggregation information of the top-level node and the anomaly propagation information from the top-level neighbor nodes to the top-level node includes: The updated node embedding vector of the top-level node is used as the node aggregation information of the top-level node; By using the anomaly weights of each top-level neighbor node, the anomaly transmission information from each top-level neighbor node to the top-level node is weighted and summed to obtain the corresponding transmission aggregation information; Based on the anomaly weight of the top-level node and the number of top-level neighbor nodes, the node aggregation information and the transmission aggregation information are fused to obtain the anomaly risk score of the business system to be detected.

2. The method according to claim 1, characterized in that, The step of passing the abnormal information of the current node upwards layer by layer according to the hierarchical relationship between nodes in the entity relationship graph, until it is passed to the top-level node in the entity relationship graph, includes: Based on the hierarchical relationship between nodes in the entity relationship diagram, determine the transmission path from the current node to the top-level node; The abnormal information of the current node is passed up layer by layer according to the transmission path until it reaches the top-level node.

3. The method according to claim 2, characterized in that, The step of passing the abnormal information of the current node upwards layer by layer according to the transmission path until it reaches the top-level node includes: Determine the next node of the current node according to the transmission path; Based on the node embedding vectors of the current node and the next node, determine the abnormal transmission information between the current node and the next node, and update the node embedding vector of the next node. The next node is taken as the new current node, and the node embedding vector of the next node of the new current node is updated according to the transmission path until the node embedding vector of the top-level node is updated.

4. The method according to claim 3, characterized in that, The step of determining the abnormal transmission information from the current node to the next node based on the node embedding vectors of the current node and the next node includes: By utilizing the anomaly weight of the current node, the node embedding vectors of the current node and the next node are processed to obtain the anomaly transmission information from the current node to the next node; The anomaly weight of any node in the entity relationship graph is determined by the anomaly type of that node.

5. The method according to claim 3, characterized in that, The step of updating the node embedding vector of the next node includes: According to the fusion weights set by each neighbor node of the next node, the abnormal transmission information passed from each neighbor node to the next node is fused into the node embedding vector of the next node to obtain the updated node embedding vector of the next node. The fusion weights of each neighbor node are set using an attention mechanism.

6. The method according to claim 3, characterized in that, After constructing the entity relationship diagram for the business system to be tested under a multi-layered system architecture, the following steps are also included: Based on the entity relationship graph, a node embedding vector is generated for each node in the entity relationship graph.

7. The method according to claim 1, characterized in that, The construction of an entity relationship diagram for the business system to be tested under a multi-layered system architecture includes: Extract the corresponding functional entities and the relationships between the functional entities from each layer of the multi-layer system architecture that the business system to be tested faces; Construct the corresponding entity relationship diagram based on the association relationships between the functional entities.

8. The method according to claim 1, characterized in that, After predicting the anomaly risk score of the business system to be detected based on the anomaly aggregation information of the top-level node and the anomaly propagation information from the top-level neighbor nodes to the top-level node, the method further includes: The abnormal risk level of the business system to be tested is determined based on the abnormal risk score and the score range set for each risk level.

9. An anomaly detection device for a business system, characterized in that, For implementing the method as described in any one of claims 1-8, comprising: The entity graph construction module is used to construct an entity relationship graph for the business system to be tested under a multi-layer system architecture. The nodes of the entity relationship graph are the functional entities existing in each layer of the multi-layer system architecture. An anomaly propagation module is used to, if an anomaly is detected in any current node in the entity relationship graph, propagate the anomaly information of the current node upwards layer by layer according to the hierarchical relationship between the nodes in the entity relationship graph, until it is propagated to the top-level node in the entity relationship graph. The anomaly risk prediction module is used to predict the anomaly risk score of the business system to be detected based on the anomaly aggregation information of the top-level node and the anomaly transmission information from the top-level neighbor node to the top-level node.

10. An electronic device, characterized in that, include: A processor and a memory, the memory being used to store a computer program, the processor being used to call and run the computer program stored in the memory to perform the anomaly detection method of the business system according to any one of claims 1-8.

11. A computer-readable storage medium, characterized in that, Used to store a computer program that causes a computer to execute the anomaly detection method of the business system as described in any one of claims 1-8.

12. A computer program product comprising a computer program / instructions, characterized in that, When the computer program / instruction is executed by the processor, it implements the anomaly detection method of the business system as described in any one of claims 1-8.

Images