Anomaly detection method and device and anomaly root cause positioning method and device

Abstract

The application discloses an abnormality detection method and device and an abnormality root cause positioning method and device. The existence of an abnormality problem is found through water level change in the initial stage of abnormality diffusion, which provides strong guarantee for preventing abnormality diffusion in time. In the abnormality root cause positioning process, only the parent combination node with the maximum abnormality score, that is, the combination with the highest score of the abnormality, is searched, and other abnormality parent combinations are pruned, so that the complexity of the algorithm is greatly reduced, and the abnormality root cause is accurately positioned.

Description

Technical Field

[0001] This application relates to, but is not limited to, the field of cloud technology, and particularly to an anomaly detection method and apparatus and an anomaly root cause localization method and apparatus. Background Technology

[0002] As business scenarios and the number of servers increase, the complexity of cloud systems gradually rises, with frequent daily releases and changes. When changes encounter problems, they may introduce server performance anomalies, reduce service stability, or even cause downtime. Typically, in the early deployment phase of canary releases, these performance anomalies exist only on a few machines. If they do not cause obvious failures, they will gradually spread and degrade system performance as the release progresses.

[0003] To prevent the spread of abnormal issues, it is crucial to determine whether abnormal spread exists, which is an urgent problem to be solved. Summary of the Invention

[0004] This application provides an anomaly detection method and apparatus, and an anomaly root cause localization method and apparatus, which can promptly detect system anomalies and accurately locate the root cause of anomalies.

[0005] This invention provides an anomaly detection method, including:

[0006] Collect at least one performance data point from each device in the cloud system;

[0007] For each type of performance data, a first-level analysis is performed on each type of equipment. Based on the analysis results, a second-level analysis is performed on combinations of different types of equipment to obtain the analysis results of different performance data for combinations of different types of equipment.

[0008] Based on the analysis results and the thresholds corresponding to different pre-set performance parameters, it is determined whether there are any anomalies in the combination of different types of equipment.

[0009] In one exemplary instance, the at least one performance data includes a preset first number of performance data;

[0010] Before performing the first water level analysis, the following is also included:

[0011] The importance of the different types of performance data collected is analyzed, and a second set of performance data with high importance is selected based on the importance.

[0012] In one exemplary instance, the analysis results of obtaining different performance data for combinations of different types of devices include:

[0013] Water level analysis was performed on each device to obtain the water level analysis results of the performance data in different devices;

[0014] Based on the water level analysis results of the performance data in different devices, water level analysis is performed on combinations of different types of devices to obtain the water level analysis results of the performance data in the cloud system.

[0015] This application also provides a computer-readable storage medium storing computer-executable instructions for performing any of the above-described anomaly detection methods.

[0016] This application embodiment provides an apparatus for implementing anomaly detection, including a memory and a processor, wherein the memory stores the following instructions executable by the processor: steps for performing the anomaly detection method described in any of the above claims.

[0017] This application provides a method for locating the root cause of an anomaly, including:

[0018] Different types of devices are combined as nodes to build a search tree. The number of device types involved in the combination decreases from the bottom to the top of the search tree.

[0019] Perform the anomaly detection method as described above on the entire search tree to obtain results on whether anomalies exist for each device combination;

[0020] For a certain type of performance data, the search tree is searched layer by layer from the bottom to the top along the combination of different types of devices that have anomalies, until all the parent nodes of the currently searched node are normal. This node is then identified as the location of the root cause of the anomaly. If the current searched node has more than two anomaly nodes among its parent nodes, the node with the largest difference from the threshold is selected as the current searched node and the search continues upward.

[0021] In one exemplary instance, it also includes: storing information about the found root causes of the anomalies and displaying the root cause information in a visual form.

[0022] In one exemplary instance, the method further includes: pushing information about the root cause of the anomaly to the business party.

[0023] This application also provides a computer-readable storage medium storing computer-executable instructions for executing any of the above-described root cause localization methods.

[0024] This application embodiment provides an apparatus for implementing anomaly root cause localization, including a memory and a processor, wherein the memory stores the following instructions executable by the processor: for performing the steps of the anomaly root cause localization method described in any of the above claims.

[0025] This application also provides another method for locating the root cause of anomalies, including:

[0026] Different types of devices are combined as nodes to build a search tree. The number of device types involved in the combination decreases from the bottom to the top of the search tree.

[0027] For a certain type of performance data, anomaly detection is performed layer by layer upwards from the bottom of the search tree, along the combination of different types of devices with anomalies, until all parent nodes of the currently searched node are normal. This node is then identified as the location of the root cause of the anomaly. If the current searched node has more than two anomaly nodes among its parent nodes, the node with the largest difference from the threshold is selected as the node to continue searching upwards.

[0028] In one exemplary instance, the anomaly detection includes:

[0029] Collect at least one performance data point for each device in the current device portfolio;

[0030] For each type of performance data, a first-level analysis is performed on each type of equipment. Based on the analysis results, a second-level analysis is performed on combinations of different types of equipment to obtain the analysis results of different performance data for combinations of different types of equipment.

[0031] Based on the analysis results and the thresholds corresponding to different pre-set performance parameters, determine whether there are any anomalies in the current equipment combination.

[0032] In one exemplary instance, it also includes: storing information about the found root causes of the anomalies and displaying the root cause information in a visual form.

[0033] In one exemplary instance, the method further includes: pushing information about the root cause of the anomaly to the business party.

[0034] This application also provides a computer-readable storage medium storing computer-executable instructions for executing another abnormal root cause localization method described in any of the above embodiments.

[0035] This application embodiment provides an apparatus for implementing anomaly root cause localization, including a memory and a processor, wherein the memory stores the following instructions executable by the processor: for performing the steps of another anomaly root cause localization method described in any of the above claims.

[0036] The anomaly detection method provided in this application can detect the existence of anomalies by changes in water level in the early stage of anomaly diffusion, thus providing a strong guarantee for timely prevention of anomaly diffusion.

[0037] The anomaly root cause localization method provided in this application only searches for the parent combination node with the highest anomaly score, i.e., the combination with the highest anomaly score, while pruning other anomaly parent combinations. This greatly reduces the complexity of the algorithm and accurately locates the anomaly root cause.

[0038] Other features and advantages of the invention will be set forth in the description which follows, and will be apparent in part from the description, or may be learned by practicing the invention. The objects and other advantages of the invention may be realized and obtained by means of the structures particularly pointed out in the description, claims, and drawings. Attached Figure Description

[0039] The accompanying drawings are used to provide a further understanding of the technical solutions of this application and constitute a part of the specification. They are used together with the embodiments of this application to explain the technical solutions of this application and do not constitute a limitation on the technical solutions of this application.

[0040] Figure 1 This is a flowchart of the anomaly detection method in the embodiments of this application;

[0041] Figure 2 This is a schematic diagram of an example sample from an embodiment of this application;

[0042] Figure 3 This is a schematic diagram of the composition of the anomaly detection device in the embodiments of this application;

[0043] Figure 4 This is a flowchart of an abnormal root cause localization method in an embodiment of this application;

[0044] Figure 5 This is a schematic diagram of a search tree constructed by combining different types of devices in an embodiment of this application;

[0045] Figure 6 This is a schematic diagram of the composition structure of an abnormal root cause localization device in an embodiment of this application;

[0046] Figure 7 This is a flowchart of another abnormal root cause localization method in the embodiments of this application;

[0047] Figure 8 This is a schematic diagram of the composition of another abnormal root cause localization device in the embodiments of this application. Detailed Implementation

[0048] To make the objectives, technical solutions, and advantages of this application clearer, the embodiments of this application will be described in detail below with reference to the accompanying drawings. It should be noted that, unless otherwise specified, the embodiments and features described in these embodiments can be arbitrarily combined with each other.

[0049] In a typical configuration of this application, the computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0050] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0051] Computer-readable media include both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include non-transitory computer-readable media, such as modulated data signals and carrier waves.

[0052] The steps illustrated in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases the steps shown or described may be performed in a different order than that presented here.

[0053] To prevent the spread of anomalies, it is first necessary to determine whether anomaly propagation has occurred and to identify the root cause of the anomaly in its early stages, so as to roll back and resolve the problem in a timely manner. To this end, this application proposes an anomaly detection method and apparatus, and an anomaly root cause localization method and apparatus.

[0054] Figure 1 This is a flowchart of the anomaly detection method in the embodiments of this application, such as... Figure 1 As shown, it includes:

[0055] Step 100: Collect at least one performance data point for each device in the cloud system.

[0056] In one exemplary instance, step 100 may include:

[0057] A preset first number of performance data can be collected periodically from various components (such as CPU, memory, and processes) in devices (such as servers) in the cloud system through a data acquisition system;

[0058] The collected performance data is cleaned (e.g., removing dirty data, deduplication, and data without reference value), constructed (e.g., unifying the data structure of the cleaned data), and integrated with multiple data sources to improve the accuracy of subsequent anomaly detection and root cause localization while reducing computational complexity.

[0059] For example, considering network bandwidth data over a day, when network-related services are running (e.g., between 5:00 and 9:30), network bandwidth can reach as high as 1.2Gb. When these processes are shut down (e.g., between 15:00 and 24:00), network bandwidth is close to zero. These long periods of no service do not represent the actual network performance of the instance; therefore, these values ​​are not meaningful and should be excluded from statistics.

[0060] In one embodiment, minute-level data from the collected performance data can be exported to a big data computing service for offline batch processing, while other performance data can be delivered to a Simple Log Service (SLS). SLS provides a log processing platform encompassing log collection, filtering, processing, aggregation, and online querying, meeting various log processing and analysis needs.

[0061] For example, if the preset number is 30, then through step 100, 30 types of performance data will be collected for each device in the cloud system.

[0062] It should be noted that this step can be implemented using ordinary data processing methods. The specific implementation is not intended to limit the scope of protection of this application, and will not be elaborated here.

[0063] In one exemplary instance, this step may also include:

[0064] Analyze the importance of the different types of performance data collected, and select a second set of performance data with high importance based on their importance.

[0065] In one embodiment, the importance of a first set of performance data can be analyzed using methods such as random forest decision trees. Then, a second set of performance data can be selected for subsequent analysis, ranked from highest to lowest importance. Since the performance is relatively stable, the importance analysis only needs to be performed once at the beginning.

[0066] For example, if the first number is preset to 30, then through step 100, 30 types of performance data will be collected for each device in the cloud system; if the second number is preset to 10, then through the sorting and processing of importance, the final performance data obtained will be the 10 types of performance data with the highest importance.

[0067] In this embodiment, a random forest decision tree is used to analyze the importance of performance data, filtering out features that are not highly correlated with anomalies and reducing computational complexity.

[0068] Step 101: For each type of performance data, perform a first level analysis for each type of equipment. Based on the analysis results, perform a second level analysis for combinations of different types of equipment to obtain the analysis results of different performance data for combinations of different types of equipment.

[0069] In one exemplary instance, for each type of performance data, step 101 may include:

[0070] Perform water level analysis on each instance (i.e. each device) to obtain the water level analysis results of this performance data in different devices;

[0071] Based on the water level analysis results of this performance data in different devices, water level analysis is performed on combinations of different types of devices to obtain the water level analysis results of this performance data in the entire cloud system.

[0072] The two-step water level analysis method in this step evaluates the performance of different combinations of equipment under each performance data.

[0073] In one exemplary instance, such as Figure 2 The diagram shows all n instances under a given feature combination, where the left (a) bars represent anomalous instances and the right (na) bars represent (na) normal instances. For an instance i (i.e., one bar chart), this instance contains m... i The bar chart shows the sample points sorted from highest to lowest in terms of number of sample points. ij Let represent the value of the j-th sample point of the i-th instance. The highest sample value is s. i The point is a spur, and the lowest sample value is z. i Each point represents a no-service sample. In this embodiment, during the first step of water level analysis calculation, the performance of a single instance is evaluated. The selected quantile parameter is the first quantile parameter p1, which needs to satisfy the formula (1), meaning that the water level needs to be higher than the no-service value:

[0074]

[0075] In this embodiment of the application, in the second step of water level analysis calculation, the overall performance of each instance is evaluated. The quantile parameter selected for analysis is the second quantile parameter p2. The second quantile parameter p2 needs to satisfy the formula (1), that is, it needs to ensure that the water level is lower than the proportion of abnormal instances:

[0076]

[0077] Because of s i <<(m) i -z i And in practical application scenarios Therefore, the selection range of the first quantile parameter p1 and the second quantile parameter p2 in the embodiments of this application is relatively large. In this way, the evaluation results are less affected by spikes, and normal instances will not be mistaken for abnormal ones. Moreover, the evaluation results will not be values ​​of points without business samples, and the evaluation results have reference value.

[0078] Step 101 uses a two-step water level analysis to evaluate the performance of different types of equipment combinations. When evaluating the performance of a combination, water level analysis is first performed on each instance (i.e. each device), and then water level analysis is performed on all instances within different types of equipment combinations (i.e., the same performance data for different devices, i.e., the water level analysis result of this performance data in the whole system). In this way, the interference of noise performance points and noise instance samples on the evaluation results can be ignored.

[0079] Through the calculation in step 101, several analytical results of different performance data for different combinations of different types of equipment can be obtained. For example, if the equipment types include three categories: A, B, and C, and the performance data for each equipment includes two types: a and b, then the several analytical results of different performance data for different combinations of different types of equipment can be obtained as follows: analytical results of performance data a for combination ABC, analytical results of performance data b for combination ABC, analytical results of performance data a for combination AC, analytical results of performance data b for combination AC, analytical results of performance data a for combination AB, analytical results of performance data b for combination AB, analytical results of performance data a for combination BC, analytical results of performance data b for combination BC, analytical results of performance data a for combination A, analytical results of performance data b for combination A, analytical results of performance data a for combination B, analytical results of performance data b for combination B, analytical results of performance data a for combination C, and analytical results of performance data b for combination C. The ABC combination represents the intersection of three categories of devices: A, B, and C (i.e., all devices belonging to categories A, B, and C). For example, if A represents devices within Beijing, B represents Windows devices, and C represents new devices, then the ABC combination represents the intersection of these three categories, which is new Windows devices within Beijing. The AC combination represents new devices within Beijing, but it does not restrict whether they are Windows devices.

[0080] Step 102: Based on the analysis results and the thresholds corresponding to different performance parameters set in advance, determine whether there are any abnormalities in the combination of different types of equipment.

[0081] In one exemplary instance, if the obtained analysis result exceeds a pre-set threshold for the performance parameter of the same category corresponding to the analysis result, that is, the performance value of a certain type of device combination under a certain performance data is unqualified, i.e., there is an anomaly. In one embodiment, the existence of an anomaly for a combination can be determined by calculating the Mann-Kendall score and comparing it with the threshold.

[0082] The anomaly detection method provided in this application's embodiments detects the existence of anomalies through water level changes in the early stages of anomaly spread, providing a strong guarantee for timely prevention of anomaly spread.

[0083] This application also provides a computer-readable storage medium storing computer-executable instructions, the computer-executable instructions being used to perform... Figure 1 Any of the anomaly detection methods described herein.

[0084] This application further provides a device for implementing anomaly detection, including a memory and a processor, wherein the memory stores the following instructions executable by the processor: for executing Figure 1The steps of any of the anomaly detection methods described herein.

[0085] Figure 3 This is a schematic diagram of the composition of the anomaly detection device in the embodiments of this application, such as... Figure 3 As shown, it includes at least: a data acquisition module, an analysis module, and a calculation module; wherein,

[0086] The acquisition module is used to collect at least one performance data point from each device in the cloud system;

[0087] The analysis module is used to perform a first-level analysis on each type of equipment for each type of performance data, and to perform a second-level analysis on combinations of different types of equipment based on the analysis results, so as to obtain the analysis results of different performance data of different combinations of different types of equipment.

[0088] The calculation module is used to determine whether there are any anomalies in the combination of different types of equipment based on the obtained analysis results and the thresholds corresponding to different pre-set performance parameters.

[0089] In one exemplary instance, the analysis module can specifically be used for:

[0090] Perform water level analysis on each instance (i.e. each device) to obtain the water level analysis results of the performance data in different devices; based on the water level analysis results of the performance data in different devices, perform water level analysis on combinations of different types of devices to obtain the water level analysis results of the performance data in the entire cloud system.

[0091] The analysis results obtained through the analysis module evaluate the performance values ​​of different equipment combinations under each performance data. The analysis module evaluates the performance of various equipment combinations. When evaluating the performance of a combination, it first performs a level analysis on each instance (i.e., each device), and then performs a level analysis on all instances within different equipment combinations (i.e., the same performance data for different devices, i.e., the level analysis result of this performance data in the entire system). In this way, the interference of noise performance points and noise instance samples on the evaluation results can be ignored.

[0092] Figure 4 This is a flowchart of the abnormal root cause localization method in the embodiments of this application, such as... Figure 4 As shown, it includes:

[0093] Step 400: Combine different types of devices as nodes to build a search tree. The number of device types involved in the combination decreases from the bottom to the top of the search tree.

[0094] In one exemplary instance, such as Figure 5As shown, in this embodiment, it is assumed that the device types include four categories: A, B, C, and D. The bottom layer of the search tree includes combinations of the four categories of devices (ABCD), the second to last layer includes combinations of three categories of devices (such as ABC combination, ABD combination, etc.), and the top layer includes the four categories of devices (A, B, C, and D).

[0095] Step 401: Perform anomaly detection on the entire search tree to obtain results on whether there are any anomalies for each combination of devices.

[0096] The implementation of this step is as follows: Figure 1 The anomaly detection methods shown will not be elaborated upon here.

[0097] Step 402: For a certain type of performance data, search upwards from the bottom of the search tree along the combination of different types of devices with anomalies, until all parent nodes of the currently searched node are normal. This node is determined to be the location of the root cause of the anomaly. If there are more than two anomaly nodes among the parent nodes of the currently searched node, the node with the largest difference from the threshold is taken as the current search node and the search continues upwards.

[0098] The anomaly root cause localization method provided in this application only searches for the parent combination node with the highest anomaly score, i.e., the combination with the highest anomaly score, while pruning other anomaly parent combinations. This greatly reduces the complexity of the algorithm and accurately locates the anomaly root cause.

[0099] by Figure 5 Taking the search tree shown as an example, for a certain type of performance data, assuming that the ABCD combination is abnormal in the detection results, the search will start from the ABCD combination. First, the four parent nodes of the ABCD combination (i.e., ABC combination, ABD combination, ACD combination, and BCD combination) are evaluated. Assuming that the ABC and ACD combinations are abnormal in the detection results, but the difference between the ABC combination and the threshold is greater than the difference between the ACD combination and the threshold, that is, the score of the ABC combination being abnormal is higher than the score of the ACD combination being abnormal. Therefore, the search continues upward from the ABC combination after the ABCD combination. Next, the three parent nodes of the ABC combination (i.e., AB combination, AC combination, and BC combination) are evaluated. Assuming that the AC combination is abnormal in the detection results, the two parent nodes of the AC combination (i.e., Class A and Class C) are evaluated. Assuming that both Class A and Class B devices are normal in the detection results, the search does not continue, and the AC combination is determined to be the root cause node of the abnormality, and the search is completed.

[0100] In the above embodiment, if the ABCD combination is normal and the ABC combination is abnormal in the detection results, then the search will start from the ABC combination and move upwards.

[0101] In one exemplary instance, the method for locating the root cause of an anomaly in this application may further include:

[0102] Information about the found root causes of anomalies is stored. In one embodiment, minute-level performance data of the root causes is stored in an offline table, while other performance data is stored in SLS.

[0103] Root causes are visualized in FBI reports.

[0104] In one and exemplary instances, it may also include: pushing information about the root cause of the exception to the business party, such as through email or interactive apps, to remind the business party to handle it in a timely manner.

[0105] This application also provides a computer-readable storage medium storing computer-executable instructions, the computer-executable instructions being used to perform... Figure 4 Any of the above-described methods for locating the root cause of anomalies.

[0106] This application further provides a device for implementing root cause localization of anomalies, including a memory and a processor, wherein the memory stores the following instructions executable by the processor: for executing Figure 4 The steps of any of the abnormal root cause localization methods.

[0107] Figure 6 This is a schematic diagram of the structural composition of the abnormal root cause localization device in this application embodiment, including: a first establishment module and a search module, wherein,

[0108] The first module is used to combine different types of devices as nodes to build a search tree. The number of types of devices participating in the combination decreases from the bottom to the top of the search tree.

[0109] The search module is used to search upwards from the bottom of the search tree, layer by layer, along different combinations of devices with anomalies for a certain type of performance data, until all parent nodes of the currently searched node are normal. This node is then identified as the location of the root cause of the anomaly. If the current searched node has more than two anomaly parent nodes, the node with the largest difference from the threshold is selected as the current searched node to continue searching upwards.

[0110] This application Figure 6 The anomaly root cause localization device provided in the embodiment only searches for the parent combination node with the highest anomaly score, i.e., the combination with the highest score where anomalies exist, while pruning the parent combinations of other anomalies. This greatly reduces the complexity of the algorithm and accurately locates the root cause of the anomaly.

[0111] Figure 7 Here is a flowchart of another abnormal root cause localization method in the embodiments of this application, such as Figure 7 As shown, it includes:

[0112] Step 700: Combine different types of devices as nodes to build a search tree. The number of device types involved in the combination decreases from the bottom to the top of the search tree.

[0113] The specific implementation of this step is the same as step 400, and will not be repeated here.

[0114] Step 701: For a certain type of performance data, along the combination of different types of devices with anomalies, perform anomaly detection layer by layer from the bottom of the search tree until all parent nodes of the currently searched node are normal. The node is then determined to be the location of the root cause of the anomaly. If there are more than two anomaly nodes among the parent nodes of the currently searched node, the node with the largest difference from the threshold is selected as the node to continue searching upwards.

[0115] In step 701, anomaly detection of nodes in the search tree is real-time. That is, during the search process, the quantiles of the combinations of nodes forming the search tree are monitored in real-time, i.e., whether there are anomalies in these combinations. When an anomaly is detected, the root cause is searched upwards from the anomaly node. This way, anomaly detection is not required for the parent nodes of nodes without anomalies, further significantly saving computational costs. When no anomalies are detected, the entire search tree is searched periodically according to a pre-set search cycle.

[0116] The anomaly root cause localization method provided in this application only searches for the parent combination node with the highest anomaly score, i.e., the combination with the highest score where anomaly exists, while pruning is performed on the parent combinations of other anomalies. In other words, real-time anomaly detection is not required for the parent nodes of nodes that do not have anomalies or whose anomalies do not have the highest scores, which greatly reduces the complexity of the algorithm, further saves computational costs, and accurately locates the root cause of anomalies.

[0117] In one exemplary instance, the anomaly detection method in step 701 is as follows: Figure 1 Any of the anomaly detection methods shown. In one embodiment, the anomaly detection in step 701 may include:

[0118] Collect at least one performance data point for each device in the current device portfolio;

[0119] For each type of performance data, a first-level analysis is performed on each type of equipment. Based on the analysis results, a second-level analysis is performed on combinations of different types of equipment to obtain the analysis results of different performance data for combinations of different types of equipment.

[0120] Based on the analysis results and the thresholds corresponding to different pre-set performance parameters, determine whether there are any anomalies in the current equipment combination.

[0121] Still with Figure 5 Taking the search tree shown as an example, the search process starts from the bottom layer of the search tree, performing real-time anomaly detection on the ABCD combination. Assuming an anomaly is detected in the ABCD combination, firstly, real-time anomaly detection is performed on the four parent nodes of the ABCD combination (i.e., ABC combination, ABD combination, ACD combination, and BCD combination) to determine if the nodes are abnormal. If no anomaly is found, the search stops, and the root cause of the anomaly lies in the ABCD combination. Suppose that both the ABC and ACD combinations are abnormal in the detection results, but the difference between the ABC combination and the threshold is greater than the difference between the ACD combination and the threshold. That is, the score for the ABC combination being abnormal is higher than the score for the ACD combination being abnormal. Therefore… After the ABCD combination, the search continues upwards from the ABC combination. Next, real-time anomaly detection is performed on the three parent nodes of the ABC combination (i.e., AB combination, AC combination, and BC combination). It can be seen that in this embodiment, the search only continues upwards for the parent node with the highest score indicating anomaly. That is, some node combinations do not require real-time anomaly detection. For example, if the AC combination is found to be anomaly, then real-time anomaly detection is performed on its two parent nodes (i.e., A-class and C-class devices). If both A-class and B-class devices are found to be normal, the search stops, and the AC combination is identified as the root cause node of the anomaly, completing the search. This embodiment does not require anomaly detection for the parent nodes of nodes without anomalies, further significantly reducing computational costs.

[0122] The search only considers the parent node with the highest score that is considered abnormal. Therefore, starting from ABCD, the search begins with the parent node ABC, which has the highest score, and then proceeds to search node AC. Since all parent nodes of node AC are normal, AC is determined to be an abnormal node, and the search is complete.

[0123] In one exemplary instance, the method for locating the root cause of an anomaly in this application may further include:

[0124] In one embodiment, the root cause identified is stored by storing minute-level performance data of the root cause in an offline table, while other performance data is stored in SLS.

[0125] Root causes are visualized in FBI reports.

[0126] In one and exemplary instances, it may also include: pushing root cause information to business entities, such as via email or interactive apps, to remind them to take timely action.

[0127] This application also provides a computer-readable storage medium storing computer-executable instructions, the computer-executable instructions being used to perform... Figure 7 Any of the above-described methods for locating the root cause of anomalies.

[0128] This application further provides a device for implementing root cause localization of anomalies, including a memory and a processor, wherein the memory stores the following instructions executable by the processor: for executing Figure 7 The steps of any of the abnormal root cause localization methods.

[0129] Figure 8 This is a schematic diagram of the composition of another abnormal root cause localization device in the embodiments of this application, such as... Figure 8 As shown, it includes: a second establishment module and a search and detection module, wherein,

[0130] The second module is used to combine different types of devices as nodes to build a search tree. The number of types of devices participating in the combination decreases from the bottom to the top of the search tree.

[0131] The search detection module is used to perform anomaly detection layer by layer upwards from the bottom of the search tree for a certain type of performance data, along the combination of different types of devices with anomalies, until all parent nodes of the currently searched node are normal. The node is then determined to be the location of the root cause of the anomaly. If the current searched node has more than two anomaly nodes among its parent nodes, the node with the largest difference from the threshold is selected as the current searched node to continue searching upwards.

[0132] In one exemplary instance, anomaly detection in the search detection module includes:

[0133] Collect at least one performance data point for each device in the current device portfolio;

[0134] For each type of performance data, a first-level analysis is performed on each type of equipment. Based on the analysis results, a second-level analysis is performed on combinations of different types of equipment to obtain the analysis results of different performance data for combinations of different types of equipment.

[0135] Based on the analysis results and the thresholds corresponding to different pre-set performance parameters, determine whether there are any anomalies in the current equipment combination.

[0136] This application Figure 8The anomaly root cause localization device provided in the embodiment only searches for the parent combination node with the highest anomaly score, i.e., the combination with the highest score where anomaly exists, while pruning is performed on the parent combinations of other anomalies. In other words, real-time anomaly detection is not required for the parent nodes of nodes that do not have anomalies or whose anomalies do not have the highest scores, which greatly reduces the complexity of the algorithm, further saves computational costs, and accurately locates the root cause of anomalies.

[0137] Although the embodiments disclosed in this application are as described above, the content described is merely for the purpose of understanding this application and is not intended to limit this application. Any person skilled in the art to which this application pertains may make any modifications and changes in the form and details of the implementation without departing from the spirit and scope disclosed in this application; however, the scope of patent protection of this application shall still be determined by the scope defined in the appended claims.

Claims

1. An anomaly detection method, comprising: Collect at least one performance data point from each device in the cloud system; For each type of performance data, a first water level analysis is performed on each device to obtain the analysis results of the performance data in different devices; Based on the analysis results of the performance data in different devices, a second water level analysis is performed on the combination of different types of devices to obtain the analysis results of different performance data of different combinations of devices. Based on the analysis results and the thresholds corresponding to different pre-set performance parameters, it is determined whether there are any anomalies in the combination of different types of equipment.

2. The anomaly detection method according to claim 1, wherein, The at least one performance data includes a preset first number of performance data; Before performing the first water level analysis, the following is also included: The importance of the different types of performance data collected is analyzed, and a second set of performance data with high importance is selected based on the importance.

3. A computer-readable storage medium storing computer-executable instructions for performing the anomaly detection method of claim 1 or claim 2.

4. A device for implementing anomaly detection, comprising a memory and a processor, wherein, The memory stores the following instructions that can be executed by a processor: for performing the steps of the anomaly detection method according to any one of claims 1 or 2.

5. A method for locating the root cause of an anomaly, comprising: Different types of devices are combined as nodes to build a search tree. The number of device types involved in the combination decreases from the bottom to the top of the search tree. Perform the anomaly detection method as described in any one of claims 1 to 3 on the entire search tree to obtain results on whether an anomaly exists for each device combination; For a certain type of performance data, the search tree is searched layer by layer from the bottom to the top along the combination of different types of devices that have anomalies, until all the parent nodes of the currently searched node are normal. This node is then identified as the location of the root cause of the anomaly. If the current searched node has more than two anomaly nodes among its parent nodes, the node with the largest difference from the threshold is selected as the current searched node and the search continues upward.

6. The abnormal root cause localization method according to claim 5 further includes: Store information about the root causes of the anomalies found and display the root cause information in a visual form.

7. The abnormal root cause localization method according to claim 5 or 6 further includes: The information about the root cause of the anomaly is pushed to the business side.

8. A method for locating the root cause of an anomaly, comprising: Different types of devices are combined as nodes to build a search tree. The number of device types involved in the combination decreases from the bottom to the top of the search tree. For a certain type of performance data, anomaly detection is performed layer by layer upwards from the bottom of the search tree, along the combination of different types of devices with anomalies, until all parent nodes of the currently searched node are normal. This node is then identified as the location of the root cause of the anomaly. If the current searched node has more than two anomaly nodes among its parent nodes, the node with the largest difference from the threshold is selected as the node to continue searching upwards.

9. The abnormal root cause localization method according to claim 8, wherein, The anomaly detection includes: Collect at least one performance data point for each device in the current device portfolio; For each type of performance data, a first water level analysis is performed on each device to obtain the analysis results of the performance data in different devices; Based on the analysis results of the performance data in different devices, a second water level analysis is performed on the combination of different types of devices to obtain the analysis results of different performance data of different combinations of devices. Based on the analysis results and the thresholds corresponding to different pre-set performance parameters, determine whether there are any anomalies in the current equipment combination.

10. The abnormal root cause localization method according to claim 8, further comprising: Store information about the root causes of the anomalies found and display the root cause information in a visual form.

11. The abnormal root cause localization method according to claim 8 or 10, further comprising: The information about the root cause of the anomaly is pushed to the business side.

12. A computer-readable storage medium storing computer-executable instructions, the computer-executable instructions being configured to perform the anomaly root cause localization method according to any one of claims 5 to 7, or the computer-executable instructions being configured to perform the anomaly root cause localization method according to any one of claims 8 to 11.

13. A device for implementing root cause localization of anomalies, comprising a memory and a processor, wherein, The memory stores the following instructions that can be executed by a processor: for performing the steps of the abnormal root cause localization method according to any one of claims 5 to 7, or for performing the steps of the abnormal root cause localization method according to any one of claims 8 to 11.

Images