Business system failure cause processing method, apparatus, device, and storage medium

Abstract

The application provides a fault cause processing method and device of a business system, electronic equipment and a computer readable storage medium, and relates to intelligent operation and maintenance in artificial intelligence and cloud technology; the method comprises the following steps: acquiring fault alarm logs and rising and falling change information of running indexes of the business system; determining a frequent sequence mode of the running indexes according to the rising and falling change information of the running indexes; marking any two fault alarm logs with a similarity higher than a similarity threshold as the same fault alarm type, and determining a frequent sequence mode of the fault alarm types according to the marked fault alarm types; determining an associated object corresponding to a fault object included in the fault alarm logs according to the frequent sequence mode of the running indexes and the frequent sequence mode of the fault alarm types; and determining a fault cause of the fault object according to a time sequence relationship between the fault object and the associated object. Through the application, the fault detection demand of the dynamic change of the business system can be met, and the accuracy of the fault cause detection is improved.

Description

Technical Field

[0001] This application relates to artificial intelligence and cloud technology, and in particular to a method, apparatus, electronic device and computer storage medium for handling fault causes in a business system. Background Technology

[0002] Artificial Intelligence (AI) is a comprehensive technology in computer science that studies the design principles and implementation methods of various intelligent machines, enabling them to possess the functions of perception, reasoning, and decision-making. With technological advancements, AI will be applied in more fields and play an increasingly important role.

[0003] With the advancement of digital transformation, the various operational metrics and call relationships within business systems are becoming increasingly complex, giving rise to intelligent operation and maintenance (O&M) technologies that combine artificial intelligence. Fault location is a typical application of intelligent O&M technologies. By combining fault detection with cloud technology, faults occurring in business systems can be quickly located, and the causes of the faults can be analyzed rapidly, accurately, and effectively, thereby effectively preventing similar fault events from occurring and reducing the losses caused by faults.

[0004] However, in implementing the embodiments of this application, the applicant found that the current fault cause analysis method relies on the logic of manually locating and judging faults to sort out the correlation between faults. This is not only labor-intensive, but also has low fault coverage, and cannot meet the diagnostic needs of large-scale business systems (such as Internet application operation and maintenance) for efficiency and accuracy. Summary of the Invention

[0005] This application provides a method, apparatus, electronic device, and computer-readable storage medium for handling fault causes in a business system, which can adapt to the dynamically changing fault detection needs of the business system and improve the accuracy and efficiency of fault cause detection.

[0006] The technical solution of this application embodiment is implemented as follows:

[0007] This application provides a method for handling fault causes in a business system, including:

[0008] Obtain fault alarm logs and information on the rise and fall of operational metrics from the business system;

[0009] Based on the rise and fall information of the operating indicators, determine the frequent sequence pattern of the operating indicators;

[0010] Mark any two fault alarm logs with a similarity higher than the similarity threshold as the same fault alarm type, and determine the frequent sequence pattern of fault alarm types based on the marked fault alarm types;

[0011] Based on the frequent sequence pattern of the operating indicators and the frequent sequence pattern of the fault alarm types, determine the associated objects corresponding to the fault objects included in the fault alarm log;

[0012] The cause of the fault in the fault object is determined based on the temporal relationship between the fault object and the associated objects.

[0013] This application provides a fault cause handling device for a business system, including:

[0014] The acquisition module is used to acquire information on the rise and fall of operational metrics and fault alarm logs of the business system;

[0015] The operation indicator module is used to determine the frequent sequence pattern of the operation indicator based on the rise and fall information of the operation indicator;

[0016] The fault alarm type module is used to mark any two fault alarm logs with a similarity higher than the similarity threshold as having the same fault alarm type, and to determine the frequent sequence pattern of fault alarm types based on the marked fault alarm types.

[0017] The filtering module is used to determine the associated objects corresponding to the fault objects included in the fault alarm log based on the frequent sequence patterns of the operating indicators and the frequent sequence patterns of the fault alarm types.

[0018] The identification module is used to determine the cause of the fault of the fault object based on the temporal relationship between the fault object and the associated object.

[0019] In the above scheme, the fault cause processing device of the business system further includes: an association object module, used to determine the object weight of multiple candidate objects in the business system according to the frequent sequence pattern of the operating indicators and the frequent sequence pattern of the fault alarm type; and to filter out the association object corresponding to the fault object included in the fault alarm log from the multiple candidate objects according to the object weight of the multiple candidate objects.

[0020] In the above scheme, the associated object module is further configured to perform the following processing for each of the plurality of candidate objects: determine the indicator sequence pattern support of the candidate object based on the frequent sequence pattern of the running indicator; determine the fault alarm type sequence pattern support of the candidate object based on the frequent sequence pattern of the fault alarm type; and perform weighted summation processing on the indicator sequence pattern support and the alarm type sequence pattern support to obtain the object weight of the candidate object.

[0021] In the above scheme, the associated object module is further configured to determine the frequency of occurrence of the frequent sequence pattern of the operating indicators as the indicator sequence pattern support of the candidate object when the operating indicators of the faulty object and the operating indicators of the candidate object both exist in the frequent sequence pattern of the operating indicators; and to determine the preset minimum support threshold as the indicator sequence pattern support of the candidate object when the operating indicators of the faulty object and the operating indicators of the candidate object do not both exist in the frequent sequence pattern of the operating indicators.

[0022] In the above scheme, the associated object module is further configured to determine the occurrence frequency of the frequent sequence pattern of the fault alarm type as the support of the fault alarm type sequence pattern of the candidate object when the alarm type of the fault object and the alarm type of the candidate object both exist in the frequent sequence pattern of the fault alarm type; and to determine the preset minimum support threshold as the support of the fault alarm type sequence pattern of the candidate object when the alarm type of the fault object and the alarm type of the candidate object do not both exist in the frequent sequence pattern of the fault alarm type.

[0023] In the above scheme, the associated object module is further configured to perform weighted clustering processing on the fault object and the candidate object according to the object weight of the candidate object to obtain multiple clusters; and determine the candidate object that belongs to the same cluster as the fault object as the associated object corresponding to the fault object included in the fault alarm log.

[0024] In the above scheme, the identification module is further configured to determine the associated object that runs first before the faulty object based on the temporal relationship between the faulty object and the associated object; and to determine the associated object that runs first before the faulty object as the cause of the faulty object.

[0025] In the above scheme, before marking any two fault alarm logs with a similarity higher than the similarity threshold as the same fault alarm type, the fault alarm type module is further used to encode the fault alarm logs to obtain the text vector of the fault alarm logs; and determine the similarity between any two fault alarm logs based on the text vector.

[0026] In the above scheme, before marking any two fault alarm logs with a similarity higher than the similarity threshold as the same fault alarm type, the fault alarm type module is further used to perform word segmentation processing on the fault alarm logs, determine the word vector of each word obtained by word segmentation processing, and perform weighted summation processing on the word vector of each word to obtain the text vector of the fault alarm log.

[0027] This application provides a fault cause handling device for a business system, including:

[0028] Memory, used to store executable instructions;

[0029] The processor, when executing executable instructions stored in the memory, implements the fault cause handling method of the business system provided in the embodiments of this application.

[0030] This application provides a computer-readable storage medium storing executable instructions, which, when executed by a processor, implement the fault cause handling method of the business system provided in this application.

[0031] The embodiments of this application have the following beneficial effects:

[0032] By mining frequent sequence patterns of operational metrics and frequent sequence patterns of fault alarm types from alarm logs and operational metrics, and because these frequent sequence patterns of operational metrics and frequent sequence patterns of fault alarm types are synchronized with changes in the operational data of the business system, the sequence patterns can reflect the dynamic changes of faults in the business system in a timely and accurate manner. Therefore, by mining fault objects and fault causes through sequence patterns, it is possible to adapt to the dynamic fault detection needs of the business system and improve the efficiency and accuracy of fault cause detection. Attached Figure Description

[0033] Figure 1 This is a schematic diagram of the fault cause handling system architecture of the business system provided in the embodiments of this application;

[0034] Figure 2 This is a schematic diagram of the structure of the fault cause handling device for the business system provided in the embodiments of this application;

[0035] Figure 3 This is a flowchart illustrating the fault cause handling method for a business system provided in an embodiment of this application;

[0036] Figure 4 This is a flowchart illustrating the fault cause handling method for a business system provided in an embodiment of this application;

[0037] Figure 5 This is a flowchart illustrating the fault cause handling method for a business system provided in an embodiment of this application;

[0038] Figure 6 This is a flowchart illustrating the fault cause handling method for a business system provided in an embodiment of this application. Detailed Implementation

[0039] To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings. The described embodiments should not be regarded as limitations on this application. All other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0040] In the following description, references are made to “some embodiments,” which describe a subset of all possible embodiments. However, it is understood that “some embodiments” may be the same subset or different subsets of all possible embodiments and may be combined with each other without conflict.

[0041] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing embodiments of this application only and is not intended to limit this application.

[0042] In the implementation of this application, the collection and processing of relevant data should strictly comply with the requirements of relevant laws and regulations, obtain the informed consent or separate consent of the personal information subject, and carry out subsequent data use and processing within the scope of laws and regulations and the authorization of the personal information subject.

[0043] Before providing a further detailed description of the embodiments of this application, the nouns and terms involved in the embodiments of this application will be explained, and the nouns and terms involved in the embodiments of this application shall be interpreted as follows.

[0044] 1) Fault Alarm Log: Network devices, systems and service programs can record fault alarm information generated during operation through fault alarm logs. Each fault alarm log can record information such as the date, time, user and related operations of the corresponding fault.

[0045] 2) Operational metrics: These refer to various metrics of the system's hardware and software during operation, such as remaining memory size, disk space, total time spent on background transactions, number of historical failures, number of requests, amount of data sent, callback time, throughput, health status, number of exceptions, and request response time.

[0046] 3) Fault alarm type: The faults included in the fault alarm log belong to specific fault types, such as hardware conflicts, software faults, network faults, etc.

[0047] In implementing the embodiments of this application, the applicant discovered that related fault cause analysis techniques require the introduction of a large amount of prior knowledge and rely on manual fault location and judgment logic. However, since manually formulated rules are not easily extensible and have low flexibility, the rule coverage will significantly decrease after a certain period of operation in complex and ever-changing maintenance environments. This necessitates continuous manual updates to the knowledge base and rule base, resulting in high costs. Recently, there have also been methods based on knowledge graph technology to analyze fault causes. However, graph model technology relies on massive amounts of high-quality data, and the complexity of the graph network increases significantly with the increase of network nodes, leading to increased training time and reduced efficiency in industrial operation and maintenance diagnosis.

[0048] To address this, embodiments of this application provide a method, apparatus, electronic device, and computer-readable storage medium for handling fault causes in a business system. These methods can adapt to the dynamically changing fault detection needs of business systems and improve the accuracy of fault cause detection. The following describes exemplary applications of the fault cause handling device for business systems provided in this application. This device can be implemented as various types of user terminals such as laptops, tablets, desktop computers, and mobile devices. It can also be implemented as a server or server cluster, or in a collaborative manner between user terminals and servers. The following describes an exemplary application when the device is implemented as a server.

[0049] See Figure 1 , Figure 1 This is a schematic diagram of the architecture of a fault cause handling system 100 for a business system provided in this application embodiment. The servers in the business system (servers 400-1 and 400-2 are shown as examples) are connected to server 200 through network 300. Server 200 can also be called a fault analysis server, which is used to implement the fault cause handling method for the business system provided in this application embodiment. Server 200 accesses data by connecting to database 500. Network 300 can be a wide area network or a local area network, or a combination of both.

[0050] For example, the business implemented by the business system can be various Internet services, such as search, navigation, and shopping. The corresponding business system may include backend server clusters, database systems, and distributed storage systems, for example... Figure 1Servers 400-1 and 400-2 are shown in the diagram. During the operation of the business system, various operational metrics will change dynamically. For example, the number of requests, data transmission volume, throughput, and request response time of servers 400-1 and 400-2 will change in real time as the business system operates. When an anomaly or failure occurs in the business system, a fault alarm log will be generated. Server 200 can obtain operational metric data and fault alarm logs from servers 400-1 and 400-2, and combine the operational metric data and fault alarm logs to find the cause of the failure. Subsequently, the fault handling process and cause can be displayed in the human-computer interaction interface with maintenance personnel, or the fault handling process and cause can be sent to maintenance personnel via SMS or email, so that maintenance personnel can quickly understand the fault situation of the business system, locate the cause of the failure, and repair the failure in a timely and efficient manner.

[0051] In some embodiments, server 200 may be an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms. No restrictions are imposed in the embodiments of this application.

[0052] See Figure 2 , Figure 2 This is a schematic diagram of the structure of the fault cause handling server 200 of the business system provided in this application embodiment. Figure 2 The server 200 shown includes at least one processor 210, memory 250, and at least one network interface 220. The various components of server 200 are coupled together via a bus system 240. It is understood that the bus system 240 is used to implement communication between these components. In addition to a data bus, the bus system 240 also includes a power bus, a control bus, and a status signal bus. However, for clarity, ... Figure 2 The general labeled all buses as Bus System 240.

[0053] Processor 210 can be an integrated circuit chip with signal processing capabilities, such as a general-purpose processor, a digital signal processor (DSP), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. Among them, the general-purpose processor can be a microprocessor or any conventional processor, etc.

[0054] The memory 250 may be removable, non-removable, or a combination thereof. Exemplary hardware devices include solid-state storage, hard disk drives, optical disk drives, etc. The memory 250 may optionally include one or more storage devices physically located away from the processor 210.

[0055] The memory 250 may include volatile memory or non-volatile memory, or both. The non-volatile memory may be read-only memory (ROM), and the volatile memory may be random access memory (RAM). The memory 250 described in this application embodiment is intended to include any suitable type of memory.

[0056] In some embodiments, memory 250 is capable of storing data to support various operations, examples of which include programs, modules, and data structures or subsets or supersets thereof, as illustrated below.

[0057] Operating system 251 includes system programs for handling various basic system services and performing hardware-related tasks, such as the framework layer, core library layer, driver layer, etc., for implementing various basic business functions and handling hardware-based tasks;

[0058] The network communication module 252 is used to reach other computing devices via one or more (wired or wireless) network interfaces 220, such as Bluetooth, WiFi, and Universal Serial Bus (USB).

[0059] In some embodiments, the fault cause handling device for the business system provided in this application can be implemented in software. Figure 2 A fault cause processing device 253 for a business system, stored in memory 250, is shown. This device can be software in the form of programs and plug-ins, and includes the following software modules: an acquisition module 2531, an operating indicator module 2532, a fault alarm type module 2533, a filtering module 2534, and an identification module 2535. These modules are logically connected and can therefore be arbitrarily combined or further separated according to their implemented functions. The functions of each module will be described below.

[0060] The method for handling fault causes in the business system provided in this application will be described by referring to the exemplary application and implementation of the server provided in the embodiments of this application.

[0061] See Figure 3 , Figure 3 This is a flowchart illustrating a fault cause handling method for a business system provided in an embodiment of this application, which will be combined with... Figure 3 The steps shown are explained.

[0062] In step 101, the fault alarm logs and the rise and fall information of the operating indicators of the business system are obtained.

[0063] In some embodiments, the indicator values ​​of the business system's operating indicators at multiple sampling points can be obtained; based on the indicator values ​​of the operating indicators at sampling points at preset time intervals, information on the rise and fall of the operating indicators can be obtained.

[0064] Among them, the information on the rise and fall of operating indicators represents the trend of changes in operating indicators within the sampling period.

[0065] For example, to obtain information on the rise and fall of operational indicators, time-series data of the operational indicators of the business system can be collected in real time. Sampling points are set at preset time intervals (e.g., 5 seconds, 5 minutes, 1 hour, etc.) to obtain the indicator values ​​of the business system's operational indicators. Based on the indicator values ​​obtained at adjacent sampling points, the rise and fall of the operational indicator values ​​within each unit time interval is determined, and the time-series rise and fall information is marked to obtain the time-series rise and fall information of the operational indicators. Taking a 1-hour interval as an example, the rise and fall trend changes of each operational indicator are recorded as shown in Table 1. Table 1 is a schematic table of the rise and fall changes of the business system's operational indicators:

[0066] Table 1. Schematic diagram of changes in business system operation indicators

[0067] Time interval Indicator A Indicator B C indicator 0-1 hour reduce increase increase 1-2 o'clock increase reduce increase 2-3 o'clock reduce increase reduce

[0068] As shown in Table 1, indicators A, B, and C are all operational indicators of the business system. When the time interval is 0-1, the time-series change information of the operational indicators is decrease, increase, increase; when the time interval is 1-2, the change information of the operational indicators is increase, decrease, increase; when the time interval is 2-3, the change information of the operational indicators is decrease, increase, decrease.

[0069] The operational metrics of the business system include at least one of the following: remaining memory size, disk space, total time spent on background transactions, number of historical failures, number of requests, amount of data sent, callback time, throughput, health status, number of exceptions, and request response time.

[0070] In some embodiments, the fault alarm logs obtained from the business system may be generated by the business system server based on operating metrics, or they may be generated by an independent monitoring system based on the operating status of the business system.

[0071] In step 102, the frequent sequence pattern of the operating indicators is determined based on the information on the rise and fall of the operating indicators.

[0072] After obtaining the information on the rise and fall of the operational indicators of the business system, the frequent sequence patterns of the operational indicators can be mined through algorithms, that is, the change patterns of the rise and fall information of each operational indicator in various time intervals within a certain period of time can be determined.

[0073] In some embodiments, the Prefixspan algorithm can be used to mine frequent sequence patterns of running metrics. The specific calculation process of the Prefixspan algorithm is as follows: In the sequence set, find a single-unit-length running metric ascending / descending sequence prefix and its corresponding projected dataset; count the frequency of occurrence of the running metric ascending / descending sequence prefix, i.e., the support of the metric ascending / descending sequence; add prefixes with support higher than the minimum support threshold to the dataset to obtain frequent itemset sequence patterns; recursively mine all prefixes of length i (i is an integer) that satisfy the minimum support requirement:

[0074] 1) Mine the projected dataset of the prefix; if the projected data is an empty set, return recursively.

[0075] 2) Calculate the minimum support of each item in the corresponding projected dataset, merge the items that meet the support requirement with the current prefix to obtain a new prefix, and recursively return if the support requirement is not met.

[0076] 3) Let i = i + 1, and let the prefixes be the new prefixes after merging individual items. Recursively execute 3) respectively;

[0077] Return all frequent sequence patterns in the sample set of rising and falling sequences of the running indicator, and use them as frequent sequence patterns of the running indicator.

[0078] The minimum support threshold is calculated as min_sup = a × n, where a is the minimum support rate, which can be adjusted based on the amount of information on the rise and fall of the operational indicators, and n is the number of days for which operational indicator data is collected.

[0079] For example, suppose that based on step 101, the changes in the operational indicators of the business system during 8-9 AM on July 1, 2020 are "A increase - B increase - C increase - D decrease - E increase - F decrease", and the changes during 8-9 AM on July 2, 2020 are "A decrease - B increase - C increase - D decrease - E decrease - F decrease". Here, "A decrease" indicates that the value of operational indicator A decreased during 8-9 AM, and "B increase" indicates that the value of operational indicator B increased during 8-9 AM. Next, based on the Prefixspan algorithm, frequent sequence patterns of the operational indicators are mined. Assuming the minimum support threshold is set to 0.5, the frequency of changes in the operational indicator values ​​is first counted, and the results are as follows:

[0080] A increases by 1; A decreases by 1; B increases by 2; C increases by 2; D decreases by 2; E increases by 1; E decreases by 1; F decreases by 2.

[0081] A prefix that satisfies the minimum support threshold and its corresponding suffix are as follows:

[0082] B increases: C increases - D decreases - E increases - F decreases / C increases - D decreases - E decreases - F decreases;

[0083] C increases: D decreases - E increases - F decreases / D decreases - E decreases - F decreases;

[0084] D decreases: E increases - F decreases / E decreases - F decreases;

[0085] F minus: empty.

[0086] Similarly, the binomial prefix sums that satisfy the minimum support threshold and their corresponding suffixes are as follows:

[0087] B increases - C increases: D decreases - E increases - F decreases / D decreases - E decreases - F decreases;

[0088] C increases - D decreases: E increases - F decreases / E decreases - F decreases;

[0089] D minus F minus: Empty.

[0090] Similarly, the three prefix sums that satisfy the minimum support threshold and their corresponding suffixes are as follows:

[0091] B increases - C increases - D decreases: E increases - F decreases / E decreases - F decreases;

[0092] C increases - D decreases - F decreases: empty.

[0093] Similarly, the four prefix sums that satisfy the minimum support threshold and their corresponding suffixes are:

[0094] B increases - C increases - D decreases - F decreases: empty.

[0095] The longest prefix sequence discovered is used as a frequent sequence pattern for the rise and fall of business system operating indicators, specifically "B increases - C increases - D decreases - F decreases" as the frequent sequence pattern for operating indicators. Furthermore, this pattern changes in real-time with updates to the business system's operating status over a historical period, allowing for real-time mining to reveal the latest trends.

[0096] By setting time intervals to analyze the increase and decrease trends of business system operation indicators, and by mining frequent sequence patterns of operation indicators based on trends, potential causal and correlation relationships between operation indicators are discovered hidden in the rise and fall information of operation indicators.

[0097] In step 103, any two fault alarm logs with a similarity higher than the similarity threshold are marked as having the same fault alarm type. Based on the fault alarm types obtained from the marking, the frequent sequence pattern of fault alarm types is determined.

[0098] In some embodiments, see Figure 4 , Figure 4 The diagram shows a flowchart of a fault cause handling method for a business system provided in an embodiment of this application. Before marking any two fault alarm logs with a similarity higher than the similarity threshold as the same fault alarm type, steps 106-107 are also included, which will be described below.

[0099] In step 106, the fault alarm log is encoded to obtain the text vector of the fault alarm log.

[0100] For example, the fault alarm log is segmented into words to determine the word vector of each word obtained from the segmentation process. The word vectors of each word are then weighted and summed to obtain the text vector of the fault alarm log. Specifically, machine learning algorithms such as Conditional Random Fields (CRF) or Hidden Markov Models (HMMs) can be used for word segmentation. Each word obtained from the segmentation is encoded using the Word2vec word vector model to obtain its word vector. The term frequency-inverse document frequency (TF-IDF) method is then used to calculate the weight of each word in the fault alarm log. After obtaining the word vector and weight of each word in the fault alarm log, the weighted summation of each word yields the text vector of the fault alarm log, completing the text vectorization of the fault alarm log.

[0101] In step 107, the similarity between any two fault alarm logs is determined based on the text vector.

[0102] After obtaining the text vectors of the fault alarm logs, the similarity between any two fault alarm logs can be characterized by calculating the distance between their text vectors. The text vector distance includes at least one of the following: cosine similarity, Manhattan distance, Euclidean distance, and Minkowski distance.

[0103] By calculating the text vectors of fault alarm logs and using the distance between the text vectors to characterize the similarity between any two fault alarm logs, the comparison speed of the similarity between any two fault alarm logs is accelerated, making it easier to determine fault alarm logs belonging to the same type.

[0104] In some embodiments, after the fault alarm type is identified, the frequent sequence pattern of the fault alarm type in the business system can be mined by the algorithm, that is, the change pattern of each fault alarm type frequently occurring in each time interval within a certain period of time can be determined.

[0105] For example, the Prefixspan algorithm can be used to mine frequent sequence patterns of fault alarm types, and the mining method is the same as that for mining frequent sequence patterns of operational indicators. Assuming that after labeling fault alarm types, the fault alarm type sequence of the business system during 8-9 AM on July 1, 2020 is "Type A alarm - Type B alarm - Type C alarm", the fault alarm type sequence during 8-9 AM on July 2, 2020 is "Type A alarm - Type C alarm", and the fault alarm type sequence during 8-9 AM on July 3, 2020 is "Type B alarm - Type E alarm - Type C alarm", and assuming the minimum support threshold is set to 0.5, the frequency of occurrence of each fault alarm type is first calculated, and the results are as follows:

[0106] Type A alarms: 2; Type B alarms: 2; Type C alarms: 3; Type E alarms: 1.

[0107] A prefix that satisfies the minimum support threshold and its corresponding suffix are as follows:

[0108] Type A alarm: Type B alarm - Type C alarm / Type C alarm;

[0109] Type B alarm: Type C alarm;

[0110] Type C alarm: Empty.

[0111] Similarly, the binomial prefix sums that satisfy the minimum support threshold and their corresponding suffixes are as follows:

[0112] Type A alarms - Type C alarms: None;

[0113] Type B alarm - Type C alarm: None.

[0114] The longest prefix sequence discovered is taken as the frequent sequence pattern of the business system's fault alarm type sequence, that is, "Type A alarm - Type C alarm / Type B alarm - Type C alarm" is taken as the frequent sequence pattern of fault alarm types. In addition, this pattern will change with the real-time updates of the business system's operation within the historical time range, and the latest trend will be obtained in real time.

[0115] In step 104, based on the frequent sequence patterns of operating indicators and the frequent sequence patterns of fault alarm types, the associated objects corresponding to the fault objects included in the fault alarm log are determined.

[0116] See Figure 5 , Figure 5 The diagram shown is a flowchart illustrating a fault cause handling method for a business system provided in an embodiment of this application. Figure 3 Step 104 can be implemented by steps 1041-1042, which will be explained in detail below.

[0117] In step 1041, the object weights of multiple candidate objects in the business system are determined based on the frequent sequence patterns of operating indicators and the frequent sequence patterns of fault alarm types.

[0118] In some embodiments, to analyze the cause of a fault, multiple candidate objects related to the fault can be identified in the business system. These candidate objects can be objects in the business system coupled to the faulty object. For each candidate object, the following processing is performed: the support of the candidate object's metric sequence pattern is determined based on frequent sequence patterns of operational metrics; the support of the candidate object's fault alarm type sequence pattern is determined based on frequent sequence patterns of fault alarm types; and a weighted sum of the metric sequence pattern support and the alarm type sequence pattern support is performed to obtain the object weight of the candidate object.

[0119] In order to determine the indicator sequence pattern support of candidate objects, when the operating indicators of the faulty object and the operating indicators of the candidate object both exist in the frequent sequence pattern of operating indicators, the frequency of occurrence of the frequent sequence pattern of operating indicators is determined as the indicator sequence pattern support of the candidate object; when the operating indicators of the faulty object and the operating indicators of the candidate object do not both exist in the frequent sequence pattern of operating indicators, the preset minimum support threshold is determined as the indicator sequence pattern support of the candidate object.

[0120] Continuing with the example above, the frequent sequence pattern of operational indicators determined in step 102 is B increase - C increase - D decrease - F decrease. Assuming the operational indicators of the faulty object include B and C, and the faulty operational indicators of the candidate object include D, this indicates that the operational indicators of both the faulty object and the candidate object exist simultaneously in the frequent sequence pattern of operational indicators. In this case, the frequency of occurrence of the frequent sequence pattern of operational indicators is determined as the support of the indicator sequence pattern of the candidate object, i.e.,

[0121]

[0122] For example, the frequent sequence pattern B increase-C increase-D decrease-F decrease appeared in samples collected between 8:00 and 9:00 on July 1, 2020 and between 8:00 and 9:00 on July 2, 2020. Therefore, the number of samples in which the sequence pattern appeared is 2, and the total number of samples is 2. Thus, the occurrence frequency of the frequent sequence pattern B increase-C increase-D decrease-F decrease is 1, and the support of the indicator sequence pattern of the candidate object is also 1.

[0123] If the operational metrics of the faulty object do not include B, C, D, and F, or the operational metrics of the candidate object do not include B, C, D, and F, it means that the operational metrics of the faulty object and the operational metrics of the candidate object do not exist simultaneously in the frequent sequence pattern of operational metrics. In this case, the preset minimum support threshold is determined as the support of the indicator sequence pattern of the candidate object. For example, in the example above, the minimum support threshold is set to 0.5. Therefore, the support of the indicator sequence pattern of the candidate object is 0.5.

[0124] In order to determine the support of the fault alarm type sequence pattern of the candidate object, when the alarm type of the fault object and the alarm type of the candidate object both exist in the frequent sequence pattern of fault alarm type, the occurrence frequency of the frequent sequence pattern of fault alarm type is determined as the support of the fault alarm type sequence pattern of the candidate object; when the alarm type of the fault object and the alarm type of the candidate object do not both exist in the frequent sequence pattern of fault alarm type, the preset minimum support threshold is determined as the support of the fault alarm type sequence pattern of the candidate object.

[0125] Continuing with the example above, the frequent sequence pattern of fault alarm types determined in step 103 is type A alarm - type C alarm / type B alarm - type C alarm. Assuming the fault alarm type of the fault object is A, and the fault operation indicators of the candidate objects include C, this indicates that both the alarm type of the fault object and the alarm type of the candidate objects exist in the frequent sequence pattern of fault alarm types. In this case, the frequency of occurrence of the frequent sequence pattern of fault alarm types is determined as the support of the fault alarm type sequence pattern of the candidate objects, i.e.,

[0126]

[0127] For example, the frequent sequence pattern type A-type alarm-type C alarm appeared twice in the samples collected on July 1, 2020, from 8:00 to 9:00, July 2, 2020, and July 3, 2020, from 8:00 to 9:00. Therefore, the number of samples with the sequence pattern is 2, and the total number of samples is 3. Thus, the occurrence frequency of the frequent sequence pattern type A-type alarm-type C alarm is 2 / 3, and the index sequence pattern support of the candidate object is also 2 / 3.

[0128] If the operating metrics of the faulty object do not include A and C, or the operating metrics of the candidate object do not include A and C, and the operating metrics of the faulty object do not include B and C, or the operating metrics of the candidate object do not include B and C, then it means that the alarm type of the faulty object and the alarm type of the candidate object do not exist simultaneously in the frequent sequence pattern of fault alarm types. In this case, the preset minimum support threshold is determined as the support of the sequence pattern of fault alarm types of the candidate object. For example, in the example above, the minimum support threshold is set to 0.5. Therefore, the support of the sequence pattern of fault alarm types of the candidate object is 0.5.

[0129] The object weight of a candidate object reflects the strength of the correlation between the candidate object and the faulty object. To obtain the object weight of a candidate object, a weighted summation of the support of the indicator sequence pattern and the support of the alarm type sequence pattern can be performed. Higher indicator sequence pattern support, meaning more frequent occurrences of specific rise and fall patterns in the operating indicators of both the candidate object and the faulty object, indicates a stronger correlation between the two. Similarly, higher alarm type sequence pattern support, meaning more frequent occurrences of fault alarm types in both the candidate object and the faulty object, also indicates a stronger correlation. By performing a weighted summation of the indicator sequence pattern support and the alarm type sequence pattern support, the object weight of a candidate object can be determined by combining the rise and fall information of operating indicators and fault alarm type information, thereby improving the accuracy of finding related objects associated with the faulty object.

[0130] For example, assuming the weight of the indicator sequence pattern support is m1 and the weight of the alarm type sequence pattern support is m2, the object weight of the candidate object is calculated as follows:

[0131] Object weight = m1 * indicator sequence pattern support + m2 * alarm type sequence pattern support

[0132] Where m1+m2=1, the values ​​of m1 and m2 can be set according to the amount and quality of the collected operational indicator change information and fault alarm log data. For example, when the amount and quality of the collected operational indicator change information of the business system are higher than the collected fault alarm log data, m1 can be set to 0.7 and m2 can be set to 0.3.

[0133] In step 1042, based on the object weights of multiple candidate objects, the associated objects corresponding to the fault objects included in the fault alarm log are selected from the multiple candidate objects.

[0134] For example, the fault object and the candidate object are subjected to weighted clustering based on the object weight of the candidate object to obtain multiple clusters; the candidate object that belongs to the same cluster as the fault object is determined as the associated object corresponding to the fault object included in the fault alarm log.

[0135] For example, first construct the object characteristics of each object in the business system, such as memory size, disk space, total background transaction time, historical failure count, number of requests, data sent, callback time, throughput, health status, number of exceptions, and request response time. It should be noted that the object characteristics and the operational metrics of the business system can overlap. Then, use a clustering algorithm to perform weighted clustering based on object weights on the object characteristics of the faulty object and candidate objects, resulting in multiple clusters. Determine the cluster to which the faulty object belongs, and identify candidate objects belonging to the same cluster as the faulty object as associated objects corresponding to the faulty objects included in the fault alarm log.

[0136] By using weighted clustering to obtain associated objects of the faulty object, we can consider not only the similarity of features between the faulty object and the candidate object, but also the correlation between the rise and fall of operating indicators and the implicit relationship in the fault alarm log. This can ensure that the associated objects and the faulty object have a strong correlation, thereby improving the efficiency and accuracy of fault cause analysis.

[0137] In step 105, the cause of the fault in the faulty object is determined based on the temporal relationship between the faulty object and its associated objects.

[0138] Once the associated objects related to the faulty object are identified, the cause of the fault can be determined based on the runtime sequence of the faulty object and its associated objects, thus completing the fault cause analysis.

[0139] In some embodiments, based on the timing relationship between the faulty object and its associated objects, the associated object that runs first before the faulty object is determined; the associated object that runs first before the faulty object is determined as the cause of the faulty object.

[0140] The timing relationships include one of the following: object execution timing, fault alarm timing, and changes in operating indicators timing.

[0141] For example, after step 104, it is determined that objects A and B in the business system have a relationship, that is, object B is the faulty object, and object A is the associated object of object B. Based on the temporal relationship between object A and object B: for example, historical data shows that fault alarms from A were received first, followed by fault alarms from B, or that operational metrics changed first in A and later in B, then object A is determined to be the parent event and object B to be the child event, that is, object A is determined to be the cause of the fault in object B.

[0142] The following will describe an exemplary application of the embodiments of this application in a real-world application scenario.

[0143] For example, the fault handling method for the business system provided in this application embodiment can be integrated into intelligent operation and maintenance software and run on server 200 to target the backend server (e.g., for Internet services such as search, navigation, and shopping) of Internet services. Figure 1 The system analyzes the faults of servers 400-1 and 400-2 during operation and displays the fault handling process and cause in the human-computer interaction interface with maintenance personnel. The fault handling process and cause can also be sent to maintenance personnel via SMS or email so that maintenance personnel can quickly understand the fault situation, locate the fault cause, and carry out timely and efficient repair.

[0144] See Figure 6 , Figure 6 The diagram illustrates a flowchart of a fault cause handling method for a business system provided in this application embodiment. The method includes steps 601, extracting time-series data of operational metrics and fault alarm information; 602, text vectorizing the fault alarm logs; 603, calculating text vector similarity to identify similar fault alarms; 604, mining the sequence patterns hidden in the rise and fall of operational metrics and fault alarm types; and 605, determining the fault cause through weighted clustering of fault candidate associated object features. These steps are described in detail below.

[0145] Step 601: Extract time-series data of operational indicators and fault alarm information. Two parts of data from the business system can be obtained for intelligent cause analysis of fault alarms: one part is the real-time collected time-series information of operational indicators; the other part is the fault alarm information calculated and reported based on operational indicators. The change information of operational indicators requires data processing of the original time-series information, i.e., setting multiple time intervals (e.g., 5s, 5min, 1h, etc.), judging the rise and fall of operational indicator values ​​within each unit time interval, and marking the time-series rise and fall information respectively. Taking a 1-hour interval as an example, the rising and falling trend changes of the business system's operational indicators are recorded as shown in Table 1, and Table 2 is a schematic table of the rise and fall changes of business system indicators:

[0146] Table 2. Schematic diagram of changes in business system indicators

[0147]

[0148]

[0149] Step 602: Vectorize the fault alarm logs into text. Fault alarm logs are semi-structured data, characterized by real-time processing and rich data, which is beneficial for problem discovery and localization. The specific steps for vectorizing the fault alarm log text are as follows: First, perform text segmentation on the text (only for Chinese; English does not require segmentation). Then, use the Word2vec word vector model to train and obtain the word vector for each word in the text. Since fault alarm logs contain many formatted words (designed to standardize alarms), these formatted words will appear in many fault alarm logs. To reduce the impact of these formatted words on the text vectorization feature representation, TF-IDF is used to calculate the feature weight of each word in each fault alarm log.

[0150] The purpose of using TF-IDF to construct feature word weights for each fault alarm log text is: if a word appears frequently in this log text but rarely in other log texts, then it indicates that the word has the ability to distinguish this log text.

[0151] TF stands for Term Frequency, which is the frequency of a word in all texts. IDF stands for Inverse Document Frequency. The formula for calculating TF-IDF is as follows.

[0152]

[0153] TF-IDF = Term Frequency (TF) * Inverse Document Frequency (IDF)

[0154] After obtaining the word vector and word feature weight of each word in the fault alarm log text, the text vector of the fault alarm log text is obtained by weighted summation of each word, thus completing the text vectorization of the fault alarm log.

[0155] Step 603: Text vector similarity calculation to identify similar fault alarms. Based on the text vectors of each fault alarm log text obtained in step 602, the similarity between any two fault alarm logs is obtained by calculating the distance between the text vectors, and fault alarm logs with similarity higher than a set threshold are identified as similar alarms.

[0156] Step 604: Discover the sequence patterns hidden in the rise and fall of operating indicators and fault alarm types.

[0157] The rise and fall of operational indicators often imply potential causal and correlational relationships between them. Therefore, mining the sequence patterns of these changes is essential for fault cause analysis. This application uses the prefixspan algorithm to mine frequent sequence patterns of operational indicator values. Simultaneously, a multiple minimum support strategy is employed, where minimum support min_sup = a*n, where n is the number of days in the time range for collecting operational indicator information, and a is the minimum support rate. The minimum support rate can be adjusted based on the amount of operational indicator information collected.

[0158] The specific steps of the prefixspan algorithm are as follows:

[0159] 1. Find the prefix sum and corresponding projection dataset of the time series ascending / descending sequence of the index with a unit length of 1;

[0160] 2. Statistically measure the frequency of prefixes in time-series ascending and descending sequences, and add prefixes with support higher than the minimum support threshold to the dataset to obtain frequent item set sequence patterns;

[0161] 3. Recursively mine all prefixes of length i that satisfy the minimum support requirement:

[0162] 1) Mine the projected dataset of the prefix; if the projected data is an empty set, return recursively.

[0163] 2) Calculate the minimum support of each item in the corresponding projected dataset, merge the items that meet the support requirement with the current prefix to obtain a new prefix, and recursively return if the support requirement is not met.

[0164] 3) Let i = i + 1, and the prefixes are the new prefixes after merging individual items. Recursively execute step 3. 4. Return all frequent sequence patterns in the index time series ascending and descending sequence sample set.

[0165] The above is a description of the principle of the Prefixspan algorithm. The following examples illustrate the specific methods for mining indicator time-series ascending and descending sequence patterns.

[0166] Based on the obtained information on the rise and fall of operational indicators, which includes the corresponding indicator identifiers, such as "A increase" indicating an increase in indicator A, the results are shown in Table 3:

[0167] Table 3. Schematic diagram of the time-series rise and fall of operating indicators

[0168] Date (days) Time period Indicator Time Series Ascending / Descending Sequence 20200701 8-9 o'clock A increases - B increases - C increases - D decreases - E increases - F decreases 20200702 8-9 o'clock A decreases - B increases - C increases - D decreases - E decreases - F decreases

[0169] Next, based on the Prefixspan algorithm, we will mine the hidden sequence patterns in the time series rise and fall sequences of indicators within different daily time intervals (or different time periods on different days). Assuming that the minimum support threshold is set to 0.5, we will first count the frequency of changes in all indicator values, as shown in Table 4:

[0170] Table 4. Statistics on Changes in Operating Indicators

[0171]

[0172] Table 5 shows the prefixes and corresponding suffixes that satisfy the minimum support threshold:

[0173] Table 5. A table illustrating a prefix and its corresponding suffix.

[0174]

[0175]

[0176] Similarly, the binomial prefixes and corresponding suffixes that satisfy the minimum support threshold are shown in Table 6:

[0177] Table 6. A diagram illustrating the binary prefixes and their corresponding suffixes.

[0178]

[0179] The three prefixes and corresponding suffixes that satisfy the minimum support threshold are shown in Table 7:

[0180] Table 7. A diagram illustrating the three prefixes and their corresponding suffixes.

[0181]

[0182] The four prefixes and corresponding suffixes that satisfy the minimum support threshold are shown in Table 8:

[0183] Table 8. A diagram illustrating the four prefixes and their corresponding suffixes.

[0184] Four prefixes Corresponding suffix B increases - C increases - D decreases - F decreases

[0185] The longest prefix sequence discovered is used as a frequent sequence pattern for business system performance indicators. This pattern updates and changes in real time with the data over the historical time frame, allowing for real-time mining of the latest hidden sequence patterns. The longest prefix sequence is also used as a frequent sequence pattern for the rising and falling sequences of business system performance indicators, specifically "B increases - C increases - D decreases - F decreases". Furthermore, this pattern changes in real time with the real-time updates of the business system's performance over the historical time frame, allowing for real-time mining of the latest trends.

[0186] Correspondingly, the support of the indicator sequence pattern is calculated as follows:

[0187]

[0188] Based on step 603, similar fault alarms are marked to obtain the fault types in the fault alarm log. Frequent sequence patterns of fault alarm types are then mined using the same method as the frequent sequence patterns of the aforementioned operating indicators.

[0189] The following example illustrates the process: Based on the chronological order of fault alarm times within each specified time range, the following fault alarm types are sampled, as shown in Table 9:

[0190] Table 9. Sample Table of Fault Alarm Types

[0191] Type A alarm Type B Alarm Type C alarm Type A alarm Type C alarm Type B Alarm Type E alarm Type C alarm

[0192] Assuming the minimum support threshold is set to 0.5, the frequency of occurrence of all fault alarm types is first calculated, as shown in Table 10:

[0193] Table 10 Statistical Table of Fault Alarm Types

[0194] Fault alarm types Type A alarm Type B Alarm Type C alarm Type E alarm Number of occurrences 2 2 3 1

[0195] Filter out event types that do not meet the minimum support threshold, and perform frequent sequence pattern mining on the remaining event types.

[0196] Table 11 shows a prefix that satisfies the minimum support threshold and its corresponding suffix:

[0197] Table 11 shows a prefix and its corresponding suffix.

[0198]

[0199] Table 12 shows the binomial prefixes and corresponding suffixes that satisfy the minimum support threshold:

[0200] Table 12. A diagram illustrating binomial prefixes and their corresponding suffixes.

[0201] Binomial prefix Corresponding suffix Type A alarm Type C alarm Type B alarms and Type C alarms

[0202] The longest prefix sequence discovered is taken as the frequent sequence pattern of the business system's fault alarm type sequence, that is, "Type A alarm - Type C alarm / Type B alarm - Type C alarm" is taken as the frequent sequence pattern of fault alarm types. Furthermore, this pattern changes with real-time updates to the business system's operational status over a historical timeframe, and the latest trend is obtained through real-time mining. At this point, the frequency of occurrence of the frequent sequence pattern of fault alarm types is determined as the fault alarm type sequence pattern support of the candidate object, calculated in the same way as the indicator sequence pattern support.

[0203] Step 605 involves weighted clustering of the features of candidate fault objects to determine the cause of the fault. Step 605 can be implemented through steps 6051-6053, which will be explained in detail below.

[0204] Step 6051: Construct object characteristics. Object characteristics can be constructed using the attribute characteristics or event characteristics of objects in the business system, such as memory size, disk space, total background transaction time, number of historical failures, number of requests, amount of data sent, callback time, throughput, health status, number of exceptions, request response time, etc.

[0205] Objects in a business system often share common attributes. Taking components within the system as an example, each component has similar attributes such as memory usage, disk space usage, total background transaction time, and historical failure count. Fifty dimensions are selected as features, and these features undergo preprocessing and feature construction. Specific steps include: discarding features with excessive missing values ​​(if the number of missing values ​​for a feature exceeds a threshold, discard that feature and delete single-value features); handling outliers (discarding outliers with excessively large values ​​or a predetermined proportion based on feature distribution, the specific proportion depending on the application scenario); handling missing values ​​(filling continuous features with the mean and discrete features with a constant as a separate category); feature derivation (combining and deriving features through feature transformation, feature squaring, and feature addition / subtraction); and feature processing (binning and discretizing continuous features and one-hot encoding discrete features).

[0206] Step 6052: Determine the weights of the candidate objects. The specific calculation method is as follows:

[0207] Object weight = m1 * indicator sequence pattern support + m2 * alarm type sequence pattern support

[0208] Where m1 + m2 = 1, and m1 and m2 are both set to 0.5, the support of the two patterns is equally weighted. The specific values ​​of m1 and m2 can be adjusted according to the actual scenario. When the indicators of the candidate component and the indicators of the faulty component appear in the sequence pattern at the same time, the indicator sequence pattern support is equal to the sequence pattern support in step 604. For example, assuming the longest prefix sequence mined is ABCD, where A is the indicator of the faulty component and B is the indicator of the candidate component, it can be concluded that indicators A and B have a strong correlation. Therefore, the faulty component and the candidate component also have a strong correlation. Thus, the support of the sequence pattern of the longest prefix sequence is used as the indicator sequence pattern support of the candidate component. When the indicator of the faulty component does not appear in the sequence pattern, the minimum support threshold in step 604 is set (theoretically, it should be less than or equal to the set minimum support threshold). For component samples that do not constitute a sequence pattern, the support is set according to the minimum support threshold in step 604 (theoretically, it should be less than or equal to the set minimum support threshold); the calculation method for the implicit sequence pattern support of alarm types is the same.

[0209] Step 6053, Feature-Weighted Clustering. A weighted clustering algorithm is constructed to cluster the feature vectors. The specific clustering process is as follows: In traditional partition-based clustering algorithms, cluster samples are generally treated equally, such as the K-means algorithm and the EM algorithm. Without considering the weights of the clustered objects, the K-means clustering algorithm terminates clustering when the criterion function converges. The formula for the criterion function is:

[0210]

[0211] Where J represents cohesion, used to measure the clustering effect, k is the total number of clusters, and m... i It is the total number of members in cluster i; It is the j-th member in cluster i; Let i be the center vector of cluster i, and the calculation formula is:

[0212]

[0213] For text Cluster center point The similarity is calculated using the cosine of the angle between the vectors.

[0214] The weighted clustering algorithm considering object weights has the following formula for calculating the criterion function of the weighted clustering:

[0215]

[0216] Where J′ represents cohesion, used to measure the effect of weighted clustering, k is the total number of clusters, and m iIt is the total number of members in cluster i; It is the j-th member in cluster i; The weighted cluster center vector of the clustered samples is calculated using the following formula:

[0217]

[0218] Among them, w j The weight of cluster sample i corresponds to the object weight of the candidate object in step 6052. The clustering result is obtained by weighted clustering.

[0219] Candidate components clustered in the same category as the faulty component are identified as associated components of the faulty component. Furthermore, the parent-child relationship in the fault event is determined based on the fault occurrence time and time sequence, thus completing the fault cause analysis.

[0220] For example, if components A and B are identified as related, based on the timing of their failures and the sequence of metric changes: for instance, if historical data shows that an alarm from component A was received before an alarm from component B, or if a metric change occurred in component A before a metric change occurred in component B, then A is determined to be the parent event and B to be the child event. When multiple components belong to the same cluster, the earlier occurrence of a component is considered the parent event of the later occurrence, and vice versa.

[0221] The following description continues to illustrate the exemplary structure of the fault cause handling device for the business system provided in the embodiments of this application as a software module. In some embodiments, such as... Figure 2 As shown, the software modules in the fault cause processing device 253 of the business system stored in the memory 250 may include:

[0222] The acquisition module 2531 is used to acquire information on the rise and fall of the operating indicators of the business system and fault alarm logs;

[0223] The operation indicator module 2532 is used to determine the frequent sequence pattern of the operation indicator based on the rise and fall information of the operation indicator;

[0224] The fault alarm type module 2533 is used to mark any two fault alarm logs with a similarity higher than the similarity threshold as the same fault alarm type, and to determine the frequent sequence pattern of fault alarm types based on the marked fault alarm types.

[0225] The filtering module 2534 is used to determine the associated object corresponding to the fault object included in the fault alarm log based on the frequent sequence pattern of the operating indicators and the frequent sequence pattern of the fault alarm type.

[0226] The identification module 2535 is used to determine the cause of the fault of the fault object based on the temporal relationship between the fault object and the associated object.

[0227] In some embodiments, the fault cause processing device of the business system further includes: an associated object module, configured to determine the object weights of multiple candidate objects in the business system based on the frequent sequence pattern of the operating indicators and the frequent sequence pattern of the fault alarm types; and to filter out associated objects corresponding to the fault objects included in the fault alarm log from the multiple candidate objects based on the object weights of the multiple candidate objects.

[0228] In some embodiments, the associated object module is further configured to perform the following processing for each of the plurality of candidate objects: determine the indicator sequence pattern support of the candidate object based on the frequent sequence pattern of the running indicator; determine the fault alarm type sequence pattern support of the candidate object based on the frequent sequence pattern of the fault alarm type; and perform a weighted summation of the indicator sequence pattern support and the alarm type sequence pattern support to obtain the object weight of the candidate object.

[0229] In some embodiments, the associated object module is further configured to determine the frequency of occurrence of the frequent sequence pattern of the operating indicators as the indicator sequence pattern support of the candidate object when the operating indicators of the faulty object and the operating indicators of the candidate object both exist in the frequent sequence pattern of the operating indicators; and to determine the preset minimum support threshold as the indicator sequence pattern support of the candidate object when the operating indicators of the faulty object and the operating indicators of the candidate object do not both exist in the frequent sequence pattern of the operating indicators.

[0230] In some embodiments, the associated object module is further configured to: determine the occurrence frequency of the frequent sequence pattern of the fault alarm type as the support of the fault alarm type sequence pattern of the candidate object when the alarm type of the fault object and the alarm type of the candidate object both exist in the frequent sequence pattern of the fault alarm type; and determine a preset minimum support threshold as the support of the fault alarm type sequence pattern of the candidate object when the alarm type of the fault object and the alarm type of the candidate object do not both exist in the frequent sequence pattern of the fault alarm type.

[0231] In some embodiments, the associated object module is further configured to perform weighted clustering processing on the fault object and the candidate object according to the object weight of the candidate object to obtain multiple clusters; and to determine the candidate object that belongs to the same cluster as the fault object as the associated object corresponding to the fault object included in the fault alarm log.

[0232] In some embodiments, the identification module is further configured to determine the associated object that ran first before the faulty object based on the temporal relationship between the faulty object and the associated object; and to determine the associated object that ran first before the faulty object as the cause of the faulty object.

[0233] In some embodiments, before marking any two fault alarm logs with a similarity higher than a similarity threshold as the same fault alarm type, the fault alarm type module is further configured to encode the fault alarm logs to obtain a text vector of the fault alarm logs; and determine the similarity between any two fault alarm logs based on the text vector.

[0234] In some embodiments, before marking any two fault alarm logs with a similarity higher than the similarity threshold as the same fault alarm type, the fault alarm type module is further configured to perform word segmentation processing on the fault alarm logs, determine the word vector of each word obtained from the word segmentation processing, and perform weighted summation processing on the word vector of each word to obtain the text vector of the fault alarm logs.

[0235] This application provides a computer-readable storage medium storing executable instructions, which, when executed by a processor, implement the fault cause handling method of the business system provided in this application.

[0236] In some embodiments, the computer-readable storage medium may be a memory such as FRAM, ROM, PROM, EP ROM, EEPROM, flash memory, magnetic surface memory, optical disk, or CD-ROM; or it may be a variety of devices including one or any combination of the above-mentioned memories.

[0237] In some embodiments, executable instructions may take the form of a program, software, software module, script, or code, written in any form of programming language (including compiled or interpreted languages, or declarative or procedural languages), and may be deployed in any form, including as a standalone program or as a module, component, subroutine, or other unit suitable for use in a computing environment.

[0238] As an example, executable instructions may, but do not necessarily, correspond to files in a file system. They may be stored as part of a file that holds other programs or data, for example, in one or more scripts in a Hyper Text Markup Language (HTML) document, in a single file dedicated to the program in question, or in multiple collaborating files (e.g., a file that stores one or more modules, subroutines, or code sections).

[0239] As an example, executable instructions can be deployed to execute on a single computing device, or on multiple computing devices located in one location, or on multiple computing devices distributed across multiple locations and interconnected via a communication network.

[0240] In summary, the embodiments of this application have the following beneficial technical effects:

[0241] (1) Based on the sequence pattern mining algorithm, the pattern features of operation indicators and fault alarm types are mined. The pattern features will change with the changes of historical data, which adapts to the needs of dynamic operation and maintenance changes.

[0242] (2) Based on the mined indicator time-series rise and fall sequence pattern and the identifier alarm sequence pattern, support-weighted clustering is performed. The entire fault cause analysis process is unsupervised and does not require pre-labeling of fault correlations, saving manpower costs and improving efficiency.

[0243] (3) This application performs support-weighted clustering on the faulty object and its related objects, which can gather the target group closely related to the faulty object to be analyzed together, thereby obtaining the cause of the fault and making the analysis results more accurate.

[0244] The above description is merely an embodiment of this application and is not intended to limit the scope of protection of this application. Any modifications, equivalent substitutions, and improvements made within the spirit and scope of this application are included within the scope of protection of this application.

Claims

1. A method for handling fault causes in a business system, characterized in that, include: Obtain fault alarm logs and information on the rise and fall of operational metrics from the business system; Based on the rise and fall information of the operating indicators, a frequent sequence pattern of the operating indicators is determined, wherein the frequent sequence pattern of the operating indicators is a pattern of change of the rise and fall information of each operating indicator in each time interval within a preset time range. Any two fault alarm logs with a similarity higher than the similarity threshold are marked as the same fault alarm type. Based on the fault alarm types obtained by marking, a frequent sequence pattern of fault alarm types is determined. The frequent sequence pattern of fault alarm types is the change pattern of each fault alarm type in each time interval within the time range. When the operating metrics of the fault object and the operating metrics of the candidate object included in the fault alarm log both exist in the frequent sequence pattern of the operating metrics, the occurrence frequency of the frequent sequence pattern of the operating metrics is determined as the support of the indicator sequence pattern of the candidate object; when the operating metrics of the fault object and the operating metrics of the candidate object do not both exist in the frequent sequence pattern of the operating metrics, the preset minimum support threshold is determined as the support of the indicator sequence pattern of the candidate object. When the alarm type of the faulty object and the alarm type of the candidate object both exist in the frequent sequence pattern of the fault alarm type, the occurrence frequency of the frequent sequence pattern of the fault alarm type is determined as the support of the fault alarm type sequence pattern of the candidate object; when the alarm type of the faulty object and the alarm type of the candidate object do not both exist in the frequent sequence pattern of the fault alarm type, the preset minimum support threshold is determined as the support of the fault alarm type sequence pattern of the candidate object. The object weights of the candidate objects are obtained by performing a weighted summation on the support of the indicator sequence pattern and the support of the fault alarm type sequence pattern. Construct object features for the fault object and the candidate object, wherein the object features are constructed using attribute features or event features of objects in the business system; Based on the object weights of the candidate objects, weighted clustering is performed on the faulty objects and the candidate objects to obtain multiple clusters. The weighted clustering process employs an object weighted clustering algorithm. The criterion function of the weighted clustering algorithm is obtained by calculating the sum of similarities between each member in all clusters and the weighted cluster center vector of the member's cluster. The weighted cluster center vector is obtained by multiplying the weights of all members in the cluster by the member's object feature vector and then summing the products. Candidate objects belonging to the same cluster as the faulty object are identified as associated objects corresponding to the faulty objects included in the fault alarm log; the cause of the faulty object is determined based on the temporal relationship between the faulty object and the associated objects.

2. The method according to claim 1, characterized in that, Determining the cause of the fault in the faulty object based on the temporal relationship between the faulty object and the associated objects includes: Based on the timing relationship between the faulty object and the associated object, determine the associated object that runs first before the faulty object; The associated object that runs first before the faulty object is determined as the cause of the fault.

3. The method according to claim 1 or 2, characterized in that, Before marking any two fault alarm logs with a similarity higher than the similarity threshold as the same fault alarm type, the method further includes: The fault alarm log is encoded to obtain a text vector of the fault alarm log; The similarity between any two fault alarm logs is determined based on the text vector.

4. The method according to claim 3, characterized in that, The encoding process of the fault alarm log to obtain a text vector of the fault alarm log includes: The fault alarm log is segmented into words to determine the word vector of each word obtained from the segmentation process; The word vectors of each word are weighted and summed to obtain the text vector of the fault alarm log.

5. A fault cause handling device for a business system, characterized in that, include: The acquisition module is used to acquire fault alarm logs and changes in operational metrics from the business system. The operation indicator module is used to determine the frequent sequence pattern of the operation indicator based on the rise and fall information of the operation indicator. The frequent sequence pattern of the operation indicator is a pattern of change of the rise and fall information of each operation indicator in each time interval within a preset time range. The fault alarm type module is used to mark any two fault alarm logs with a similarity higher than a similarity threshold as the same fault alarm type, and to determine the frequent sequence pattern of fault alarm types based on the marked fault alarm types. The frequent sequence pattern of fault alarm types is the change pattern of each fault alarm type in each time interval within the time range. The associated object module is used to determine the frequency of occurrence of the frequent sequence pattern of the operating indicators as the indicator sequence pattern support of the candidate object when the operating indicators of the fault object and the candidate object included in the fault alarm log both exist in the frequent sequence pattern of the operating indicators; and to determine the preset minimum support threshold as the indicator sequence pattern support of the candidate object when the operating indicators of the fault object and the candidate object do not both exist in the frequent sequence pattern of the operating indicators. When the alarm type of the faulty object and the alarm type of the candidate object both exist in the frequent sequence pattern of the fault alarm type, the occurrence frequency of the frequent sequence pattern of the fault alarm type is determined as the support of the fault alarm type sequence pattern of the candidate object; when the alarm type of the faulty object and the alarm type of the candidate object do not both exist in the frequent sequence pattern of the fault alarm type, the preset minimum support threshold is determined as the support of the fault alarm type sequence pattern of the candidate object. The associated object module is used to perform a weighted summation of the support of the indicator sequence pattern and the support of the fault alarm type sequence pattern to obtain the object weight of the candidate object. The associated object module is used to construct object features for the fault object and the candidate objects, wherein the object features are constructed using the attribute features or event features of objects in the business system; weighted clustering is performed on the fault object and the candidate objects according to the object weights of the candidate objects to obtain multiple clusters; wherein the weighted clustering process adopts a weighted clustering algorithm based on object weights, and the criterion function of the weighted clustering algorithm is obtained by calculating the sum of similarities between each member in all clusters and the weighted class center vector of the member's cluster; the weighted class center vector is obtained by multiplying the weights of all members in the cluster by the object feature vector of the member and summing the products; the candidate objects that belong to the same cluster as the fault object are determined as associated objects corresponding to the fault objects included in the fault alarm log; The identification module is used to determine the cause of the fault of the fault object based on the temporal relationship between the fault object and the associated object.

6. The apparatus according to claim 5, characterized in that, The identification module is further configured to determine the associated object that runs first before the faulty object based on the temporal relationship between the faulty object and the associated object; The associated object that runs first before the faulty object is determined as the cause of the fault.

7. The apparatus according to claim 5 or 6, characterized in that, The fault alarm type module is also used to encode the fault alarm log to obtain a text vector of the fault alarm log. The similarity between any two fault alarm logs is determined based on the text vector.

8. An electronic device, characterized in that, The electronic device includes: Memory, used to store executable instructions; The processor, when executing executable instructions stored in the memory, implements the fault cause handling method of the business system according to any one of claims 1 to 4.

9. A computer-readable storage medium storing executable instructions, characterized in that, When the executable instructions are executed by the processor, they implement the fault cause handling method of the business system according to any one of claims 1 to 4.

Images