Abnormal root cause positioning method and device, electronic equipment and storage medium

Abstract

The present disclosure relates to an abnormal root cause positioning method, device, electronic equipment and storage medium. The abnormal root cause positioning method comprises: when it is determined that an index of a multimedia resource is abnormal, determining an actual index result and a reference index result of the index, and actual attribute results and reference attribute results of each target attribute under a dimension of the index; determining a dimension evaluation result of the dimension according to the actual index result and the reference index result of the index, and the actual attribute results and the reference attribute results of each target attribute; determining a dimension that meets a preset condition from the dimension evaluation results, taking the dimension that meets the preset condition as a target dimension; and determining a root cause that causes the index to be abnormal from the target dimension. According to the abnormal root cause positioning method, device, electronic equipment and storage medium of the present disclosure, by performing dimension screening, the search range of the abnormal root cause can be reduced, and the search speed of the abnormal root cause is improved.

Description

Technical Field

[0001] This disclosure relates to the field of data processing, and more specifically, to a method, apparatus, electronic device, and storage medium for locating the root cause of an anomaly. Background Technology

[0002] In the operation and maintenance (O&M) of audio and video systems, O&M personnel face numerous anomalies and malfunctions daily. They must promptly identify the root causes of these anomalies or malfunctions to guide timely mitigation measures and ensure a positive user experience. O&M work involves various types of metrics, each encompassing numerous dimensions. O&M personnel must identify the root causes of anomalies across these diverse dimensions.

[0003] Several root cause localization methods are already in use in production environments. For example, one method optimizes the root cause score based on chain reaction and uses heuristic strategies to speed up the search. However, there is still much room for improvement in the search speed of these methods. Summary of the Invention

[0004] This disclosure provides a method, apparatus, electronic device, and storage medium for locating the root cause of anomalies, in order to at least solve the problems in the aforementioned related technologies.

[0005] According to a first aspect of the present disclosure, an anomaly root cause localization method is provided, comprising: when it is determined that an indicator of a multimedia resource is abnormal, determining the actual indicator result and reference indicator result of the indicator, and the actual attribute result and reference attribute result of each target attribute under the dimension of the indicator; determining the dimension evaluation result of the dimension based on the actual indicator result and reference indicator result of the indicator, and the actual attribute result and reference attribute result of each target attribute; determining the dimension whose dimension evaluation result meets preset conditions, and taking the dimension that meets the preset conditions as the target dimension; and determining the root cause causing the indicator to be abnormal from the target dimension.

[0006] Optionally, determining the dimensional evaluation result of the dimension based on the actual and reference indicator results of the indicator, and the actual and reference attribute results of each of the target attributes, includes: determining a first indicator change based on the actual and reference indicator results; determining a first attribute change for each of the target attributes based on the actual and reference attribute results of each of the target attributes under the dimension; determining the actual weight of the actual attribute result of each of the target attributes relative to the actual indicator result, and the reference weight of the reference attribute result of each of the target attributes relative to the reference indicator result; and determining the dimensional evaluation result of the dimension based on the first indicator change, and the first attribute change, actual weight, and reference weight of each of the target attributes under the dimension.

[0007] Optionally, determining the dimension evaluation result based on the change in the first indicator and the change in the first attribute, actual weight, and reference weight of each target attribute under the dimension includes: determining a first relative relationship between the change in the first attribute and the change in the first indicator for each target attribute under the dimension, and determining a first degree of difference between the number of attributes whose first relative relationship conforms to a preset relationship and the total number of attributes; determining a second degree of difference between the actual weight of each target attribute and the reference weight; and generating the dimension evaluation result based on the first degree of difference and the second degree of difference.

[0008] Optionally, the method further includes: determining a second attribute change between the actual attribute result and the reference attribute result of each attribute under the dimension; determining a second indicator change between the actual indicator result and the reference indicator result; and determining the target attribute from multiple attributes corresponding to the dimension based on a second relative relationship between the second attribute change and the second indicator change, and / or a third relative relationship between the actual attribute result and the actual indicator result of each attribute.

[0009] Optionally, determining the target attribute from multiple attributes corresponding to the dimension based on the second relative relationship between the change in the second attribute and the change in the second indicator, and the third relative relationship between the actual attribute result and the actual indicator result of each attribute, includes: taking the attribute as the target attribute when any one or more of the following conditions occur: the change in the second attribute of the attribute is greater than or equal to the product of the change in the second indicator and the second adjustment parameter; the actual attribute result of the attribute is greater than or equal to the product of the actual indicator result and the first adjustment parameter.

[0010] Optionally, the indicator is a rate-value indicator, which includes a numerator indicator and a denominator indicator; determining the root cause of the abnormality of the indicator from the target dimension includes: determining the denominator deviation degree of the leaf node and the numerator deviation degree of the leaf node; determining abnormal leaf nodes from the target dimension based on the numerator and denominator deviation degrees of the leaf nodes, wherein the leaf nodes are nodes obtained by combining attributes under the target dimension; clustering the abnormal leaf nodes to obtain at least one abnormal node class; and performing root cause search on each abnormal node class to obtain the root cause of the abnormality of the indicator.

[0011] Optionally, the root cause search for each of the abnormal node classes to obtain the root cause causing the abnormality of the indicator includes: for each of the abnormal node classes, performing the following operations: determining the abnormal impact parameters of the attributes and attribute combinations corresponding to the abnormal leaf nodes in the abnormal node class, wherein the abnormal impact parameters are obtained based on the actual attribute results and reference attribute results of the attributes and attribute combinations corresponding to the abnormal leaf nodes in the abnormal node class; determining multiple candidate root causes based on the abnormal impact parameters, wherein the candidate root causes include at least one of the attributes and attribute combinations corresponding to the abnormal leaf nodes in the abnormal node class; determining the evaluation result of each candidate root cause, wherein the evaluation result characterizes the degree of closeness between the actual indicator result and the reference indicator result after removing the candidate root cause; and determining the root cause causing the abnormality of the indicator in the abnormal node class from the multiple candidate root causes based on the evaluation result.

[0012] Optionally, determining the evaluation result of each candidate root cause includes: for each candidate root cause, performing the following operations: determining an inferred indicator result based on the actual indicator result, the actual attribute result of the candidate root cause, and the reference attribute result; and determining the evaluation result of the candidate root cause based on the inferred indicator result, the actual indicator result, and the reference indicator result.

[0013] Optionally, clustering the abnormal leaf nodes to obtain at least one abnormal node class includes: using the numerator and denominator deviations of the abnormal leaf nodes as two-dimensional features in the clustering process, and clustering the two-dimensional features using a preset clustering method to obtain the at least one abnormal node class.

[0014] According to a second aspect of the present disclosure, an anomaly root cause localization device is provided, comprising: a parameter determination unit configured to: when it is determined that an indicator of a multimedia resource is abnormal, determine the actual indicator result and reference indicator result of the indicator, and the actual attribute result and reference attribute result of each target attribute under the dimension of the indicator; a dimension evaluation result determination unit configured to: determine the dimension evaluation result of the dimension based on the actual indicator result and reference indicator result of the indicator, and the actual attribute result and reference attribute result of each target attribute; a target dimension determination unit configured to: determine the dimension whose dimension evaluation result meets preset conditions, and take the dimension that meets the preset conditions as the target dimension; and an anomaly root cause determination unit configured to: determine the root cause that caused the indicator to be abnormal from the target dimension.

[0015] Optionally, the determination of the dimension evaluation result is configured to: determine the change in a first indicator based on the actual indicator result and the reference indicator result; determine the change in a first attribute of each target attribute based on the actual attribute result and the reference attribute result of each target attribute under the dimension; determine the actual weight of the actual attribute result of each target attribute relative to the actual indicator result, and the reference weight of the reference attribute result of each target attribute relative to the reference indicator result; and determine the dimension evaluation result of the dimension based on the change in the first indicator, and the change in the first attribute, the actual weight, and the reference weight of each target attribute under the dimension.

[0016] Optionally, the dimension evaluation result determination unit is configured to: determine a first relative relationship between the change in the first attribute and the change in the first indicator for each of the target attributes under the dimension, and determine a first degree of difference between the number of attributes whose first relative relationship conforms to a preset relationship and the total number of attributes; determine a second degree of difference between the actual weight of each of the target attributes and the reference weight; and generate the dimension evaluation result based on the first degree of difference and the second degree of difference.

[0017] Optionally, the anomaly root cause localization device further includes a target attribute determination unit, which can be configured to: determine a second attribute change between the actual attribute result and the reference attribute result of each attribute under the dimension; determine a second index change between the actual index result and the reference index result; and determine the target attribute from multiple attributes corresponding to the dimension based on a second relative relationship between the second attribute change and the second index change, and / or a third relative relationship between the actual attribute result and the actual index result of each attribute.

[0018] Optionally, the target attribute determination unit may be configured to: take the attribute as the target attribute when any one or more of the following conditions occur: the change in the second attribute of the attribute is greater than or equal to the product of the change in the second index and the second adjustment parameter; the actual attribute result of the attribute is greater than or equal to the product of the actual index result and the first adjustment parameter.

[0019] Optionally, the indicator is a rate-value indicator, which includes a numerator indicator and a denominator indicator; the anomaly root cause determination unit is configured to: determine the denominator deviation degree of the leaf node and the numerator deviation degree of the leaf node; determine abnormal leaf nodes from the target dimension based on the numerator and denominator deviation degrees of the leaf nodes, wherein the leaf nodes are nodes obtained by combining attributes under the target dimension; cluster the abnormal leaf nodes to obtain at least one abnormal node class; and perform root cause search on each abnormal node class to obtain the root cause that causes the indicator to be abnormal.

[0020] Optionally, the anomaly root cause determination unit is configured to: for each of the anomaly node classes, perform the following operations: determine the anomaly impact parameters of the attributes and attribute combinations corresponding to the anomaly leaf nodes in the anomaly node class, wherein the anomaly impact parameters are obtained based on the actual attribute results and reference attribute results of the attributes and attribute combinations corresponding to the anomaly leaf nodes in the anomaly node class; determine multiple candidate root causes based on the anomaly impact parameters, wherein the candidate root causes include at least one of the attributes and attribute combinations corresponding to the anomaly leaf nodes in the anomaly node class; determine the evaluation result of each candidate root cause, wherein the evaluation result characterizes the degree of closeness between the actual indicator result and the reference indicator result after removing the candidate root cause; and determine the root cause in the anomaly node class that causes the indicator to become abnormal from the multiple candidate root causes based on the evaluation result.

[0021] Optionally, the abnormal root cause determination unit is configured to perform the following operations for each candidate root cause: determine an inferred indicator result based on the actual indicator result, the actual attribute result of the candidate root cause, and the reference attribute result; and determine an evaluation result of the candidate root cause based on the inferred indicator result, the actual indicator result, and the reference indicator result.

[0022] Optionally, the abnormal root cause determination unit is configured to: use the numerator and denominator deviation of the abnormal leaf nodes as two-dimensional features in the clustering process, and cluster the two-dimensional features using a preset clustering method to obtain the at least one abnormal node class.

[0023] According to a third aspect of the present disclosure, an electronic device is provided, comprising: at least one processor; and at least one memory storing computer-executable instructions, wherein the computer-executable instructions, when executed by the at least one processor, cause the at least one processor to perform an anomaly root cause localization method according to the present disclosure.

[0024] According to a fourth aspect of the present disclosure, a computer-readable storage medium is provided that stores instructions which, when executed by at least one processor, cause the at least one processor to perform an anomaly root cause localization method according to the present disclosure.

[0025] According to a fifth aspect of the present disclosure, a computer program product is provided, wherein instructions in the computer program product are executable by a processor of a computer device to perform an anomaly root cause localization method according to the present disclosure.

[0026] The technical solutions provided by the embodiments of this disclosure have at least the following beneficial effects:

[0027] According to the anomaly root cause localization method, apparatus, electronic device and storage medium disclosed herein, by performing dimension filtering, dimensions unrelated to the root cause of the anomaly are pre-filtered, and anomaly root cause search is performed based on the filtered target dimensions, which can greatly narrow the search range of anomaly root causes and improve the search speed of anomaly root causes.

[0028] Furthermore, when screening abnormal leaf nodes for rate indicators, screening the numerator and denominator indicators separately can pinpoint anomalies caused by changes in the ratio of data volume of the numerator and denominator indicators, thus improving the accuracy of anomaly root cause localization.

[0029] In addition, inference indicators were introduced when determining the evaluation results of candidate root causes, which improved the accuracy of the evaluation of candidate root causes.

[0030] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this disclosure. Attached Figure Description

[0031] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this disclosure and, together with the description, serve to explain the principles of this disclosure, and are not intended to unduly limit this disclosure.

[0032] Figure 1 This is a schematic diagram illustrating the structure of the dimensional space of an index according to an exemplary embodiment of the present disclosure.

[0033] Figure 2 This is a flowchart illustrating an anomaly root cause localization method according to an exemplary embodiment of the present disclosure.

[0034] Figure 3 This is a schematic diagram illustrating a specific workflow for root cause localization of anomalies according to an exemplary embodiment of the present disclosure.

[0035] Figure 4 This is a block diagram illustrating an anomaly root cause localization device according to an exemplary embodiment of the present disclosure.

[0036] Figure 5 This is a block diagram illustrating an electronic device 500 according to an exemplary embodiment of the present disclosure. Detailed Implementation

[0037] To enable those skilled in the art to better understand the technical solutions of this disclosure, the technical solutions in the embodiments of this disclosure will be clearly and completely described below with reference to the accompanying drawings.

[0038] It should be noted that the terms "first," "second," etc., used in the specification, claims, and accompanying drawings of this disclosure are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this disclosure described herein can be implemented in orders other than those illustrated or described herein. The embodiments described in the following examples do not represent all embodiments consistent with this disclosure. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this disclosure as detailed in the appended claims.

[0039] It should be noted that the phrase "at least one of several items" in this disclosure refers to three parallel cases: "any one of the several items", "a combination of any number of the several items", and "all of the several items". For example, "including at least one of A and B" includes the following three parallel cases: (1) including A; (2) including B; (3) including A and B. As another example, "performing at least one of step one and step two" indicates the following three parallel cases: (1) performing step one; (2) performing step two; (3) performing both step one and step two.

[0040] In the operation and maintenance management of audio and video, there is a massive amount of time-series metric data. This metric data can be divided into single-dimensional time series (a single variable changes over time) and multi-dimensional time series (multiple variables change over time). Among these, there are single-metric multi-dimensional time series with the same physical meaning (i.e., the same metric name) but different dimensions. In a single-metric multi-dimensional time series, different dimensions can be combined to obtain a single time series, and different time series influence each other. Physically, these metrics can be divided into additive metrics (e.g., click count) and rate-value metrics (e.g., download failure rate), where rate-value metrics can be obtained by dividing the numerator by the denominator.

[0041] For a single-indicator multidimensional time series, when a fault occurs, all parent and child nodes, leaf nodes, etc., that are internally related to the fault will experience anomalies, forming an alarm storm. For example, the indicator is named download failure rate, and the dimensions include province, CDN (Content Delivery Network), ISP (Internet Service Provider), network, etc. Each dimension has multiple attributes; for example, the province dimension has attributes such as Hebei Province and Henan Province. When the attribute "Hebei Province" under the province dimension experiences a fault, all ISPs, networks, and CDNs within Hebei Province, as well as the comprehensive data of all dimensions and combinations of dimensions, will experience a certain degree of abnormal fluctuation.

[0042] For faults in single-indicator multidimensional time series, accurately locating the specific position of the anomaly (formally a combination of attributes within a certain dimension) can narrow the scope of fault analysis, thereby accelerating the analysis process. One anomaly root cause localization scheme in related technologies optimizes root cause scores based on chain reactions and uses heuristic strategies to speed up the search. However, this scheme's root cause search speed is still relatively slow, and it cannot locate faults caused by changes in the ratio of numerator and denominator data in rate indicators. In other words, there is still significant room for improvement in the accuracy of anomaly root cause localization.

[0043] To improve the search speed and accuracy of anomaly root cause localization, this disclosure proposes an anomaly localization method, apparatus, electronic device, and storage medium. Specifically, by performing dimensional filtering, dimensions unrelated to the root cause of the anomaly are pre-filtered. Anomaly root cause search is then performed based on the filtered target dimensions, which significantly narrows the search range and improves the search speed. Furthermore, for rate indicators, when filtering anomaly leaf nodes, both the numerator and denominator indicators are filtered separately. This allows for the localization of anomalies caused by changes in the ratio of the data volume of the numerator and denominator indicators, improving the accuracy of anomaly root cause localization. Additionally, when determining the evaluation results of candidate root causes, inference indicator results are introduced, improving the evaluation accuracy of candidate root causes. The following will refer to… Figures 1 to 5 The present disclosure provides a detailed description of an anomaly root cause localization method, apparatus, electronic device, and storage medium according to exemplary embodiments thereof.

[0044] Figure 1 This is a schematic diagram illustrating the structure of the dimensional space of an index according to an exemplary embodiment of the present disclosure.

[0045] Reference Figure 1A, B, C, and D are the four dimensions of the indicator. AB, AC, ABC, ABCD, etc., are dimension combinations obtained by combining the dimensions. "ROOT" represents the comprehensive data that includes all dimensions and dimension combinations, which can be called the overall market. The four dimensions are located at the first level of the entire dimension space. Dimension combinations of any two dimensions are located at the second level, dimensional combinations of any three dimensions are located at the third level, and dimensional combinations of all four dimensions are located at the fourth level. Each dimension or dimension combination includes multiple attributes or attribute combinations (for example, dimension A includes attributes such as a1 and a2, and dimension AB includes attribute combinations such as a1b1 and a1b2). The attribute combinations at the lowest level are called leaf nodes (e.g., ...). Figure 1 (Attribute combinations such as a1b1c1d1, etc.)

[0046] Figure 2 This is a flowchart illustrating an anomaly root cause localization method according to an exemplary embodiment of the present disclosure.

[0047] Reference Figure 2 In step 201, when an anomaly is determined in a multimedia resource's metric, the actual and reference metric results for that metric, as well as the actual and reference attribute results for each target attribute under that metric's dimension, are determined. Here, the metric is an additive metric (e.g., number of clicks) or a rate-value metric (e.g., download failure rate), where the rate-value metric includes a numerator and a denominator. The dimension refers to... Figure 1 The dimensions A, B, C, and D shown refer to the attributes within each dimension (e.g., attribute a1 in dimension A or attribute b1 in dimension B), or attributes obtained after filtering the attributes within a dimension; there are no restrictions on this. In practical implementation, the actual indicator result can be the overall observed value of the indicator, and the reference indicator result can be the overall predicted value of the indicator. The actual attribute result of the target attribute can be the observed value of the indicator at that attribute, and the reference attribute result can be the predicted value of the indicator at that attribute. When an anomaly is determined in a multimedia resource indicator, the overall observed value and overall predicted value of the indicator can be directly obtained. The observed value and predicted value of the indicator at the attribute can be obtained by adding the observed values ​​at the leaf nodes dimension by dimension, and by adding the predicted values ​​at the leaf nodes dimension by dimension, respectively.

[0048] In step 202, the dimensional evaluation result of the dimension can be determined based on the actual and reference indicator results of the indicator, as well as the actual and reference attribute results of each target attribute.

[0049] In step 203, dimensions whose evaluation results meet preset conditions can be identified, and these dimensions are selected as target dimensions. Specifically, too many dimensions increase the complexity of root cause search, leading to longer search times and slower speeds. Furthermore, too many dimensions can result in small leaf node values ​​and high noise, reducing the accuracy of root cause localization. Therefore, dimension filtering can be performed first. Based on the dimension evaluation results, target dimensions related to the anomaly are determined from all current dimensions. Root cause search is then performed on these target dimensions, which speeds up the search process.

[0050] According to an exemplary embodiment of this disclosure, the change in a first indicator can be determined firstly based on the actual indicator results and the reference indicator results. Then, the change in the first attribute of each target attribute can be determined based on the actual attribute results and the reference attribute results of each target attribute under the dimension. Next, the actual weight of the actual attribute results of each target attribute relative to the actual indicator results can be determined, as well as the reference weight of the reference attribute results of each target attribute relative to the reference indicator results can be determined. Finally, based on the change in the first indicator, and the change in the first attribute, the actual weight, and the reference weight of each target attribute under the dimension, the dimension evaluation result of the dimension can be determined.

[0051] Here, the change in the first indicator refers to the rate of change of the actual indicator result relative to the reference indicator result, and the change in the first attribute refers to the rate of change of the actual attribute result relative to the reference attribute result. For additable indicators, the change in the first indicator can be obtained by subtracting the actual indicator result from the reference indicator result and dividing the difference by the reference indicator result. Similarly, the change in the first attribute can be obtained by subtracting the actual attribute result from the reference attribute result and dividing the result by the reference attribute result.

[0052] For rate-value indicators, we can first determine the first quotient between the actual result of the numerator indicator and the actual result of the denominator indicator, and the second quotient between the reference result of the numerator indicator and the reference result of the denominator indicator. Subtracting the first and second quotients yields the change in the first indicator. Similarly, we can first determine the first division result between the actual result of the numerator indicator at each target attribute and the actual result of the denominator indicator at each target attribute, and the second division result between the reference result of the numerator indicator at each target attribute and the reference result of the denominator indicator at each target attribute. Subtracting the first and second division results yields the change in the first attribute. Here, the first indicator change and the first attribute change of the rate-value indicator can be expressed as:

[0053] (1) Market Change Rate = Observed Market Numerator / Observed Market Denominator - Forecasted Market Numerator / Forecasted Market Denominator

[0054] (2) Rate of change of attribute = Observed value of attribute numerator / Observed value of attribute denominator - Predicted value of attribute numerator / Predicted value of attribute denominator

[0055] Among them, the overall market change rate represents the change of the first indicator; the attribute change rate represents the change of the first attribute; the observed values ​​of the overall market numerator and denominator represent the actual indicator results of the numerator and denominator indicators, respectively; the predicted values ​​of the overall market numerator and denominator represent the reference indicator results of the numerator and denominator indicators, respectively; the observed values ​​of the attribute numerator and denominator represent the actual attribute results of the numerator and denominator indicators at a certain attribute, respectively; and the predicted values ​​of the attribute numerator and denominator represent the reference attribute results of the numerator and denominator indicators at a certain attribute, respectively.

[0056] The actual weight can be obtained by dividing the actual attribute result by the actual indicator result, and the reference weight can be obtained by dividing the reference attribute result by the reference indicator result. For rate-value indicators, the actual weight includes the actual weight of the numerator and the actual weight of the denominator, while the reference weight includes the reference weight of the numerator and the reference weight of the denominator. For example, the actual weight of the numerator can be obtained by dividing the actual attribute result of the numerator by the numerator of the actual indicator result. For example, for rate-value indicators, the actual and reference weights of the numerator and denominator can be expressed as follows:

[0057] (3) Actual weight of attribute molecules = Observed value of attribute molecules / Observed value of mass molecules

[0058] (4) Reference weight of attribute molecule = predicted value of attribute molecule / predicted value of market molecule

[0059] (5) Actual weight of attribute denominator = Observed value of attribute denominator / Observed value of overall denominator

[0060] (6) Attribute denominator reference weight = Attribute denominator predicted value / Market denominator predicted value

[0061] Among them, the actual weight of the attribute numerator represents the actual weight of the numerator index at a certain attribute; the reference weight of the attribute numerator represents the reference weight of the numerator index at a certain attribute; the actual weight of the attribute denominator represents the actual weight of the denominator index at a certain attribute; and the reference weight of the attribute denominator represents the reference weight of the denominator index at a certain attribute.

[0062] In some embodiments, a first relative relationship can be first determined between the change in the first attribute of each target attribute under the dimension and the change in the first indicator of the dimension, and a first degree of difference can be determined between the number of attributes whose first relative relationship conforms to a preset relationship and the total number of attributes. Then, a second degree of difference can be determined between the actual weight of each target attribute and the reference weight. Finally, a dimension evaluation result is generated based on the first and second degrees of difference. Here, the first relative relationship refers to the relative magnitude relationship between the change in the first attribute of each target attribute under the dimension and the change in the first indicator of the dimension. The number of target attributes whose change in the first attribute is less than the change in the first indicator can be determined. The first degree of difference is obtained by dividing the determined number of attributes by the total number of attributes under the dimension. The weight difference of each target attribute is obtained by subtracting the actual weight of each target attribute from the reference weight. The second degree of difference of the dimension is obtained by summing the weight differences and averaging them.

[0063] Specifically, regarding the rate-value index, when determining the second degree of difference, the average weight difference of the numerator index and the average weight difference of the denominator index are first determined separately, and the sum of the two yields the second degree of difference for the dimension of the rate-value index. Specifically, when an anomaly occurs, if a dimension is unrelated to the root cause, all target attributes within that dimension will be affected by the propagation of the fault, and most target attributes will exhibit anomalies. Conversely, if the dimension is related to the root cause, most attributes will be normal, with only a small portion being anomalous. Therefore, the proportion of attributes unaffected by the anomaly within the dimension (i.e., the first degree of difference) reflects whether the dimension is related to the root cause of the anomaly. Furthermore, if the anomaly is unrelated to a certain dimension, the anomaly will propagate to all attributes in approximately the original proportion, resulting in a lower second degree of difference for that dimension; otherwise, the second degree of difference is higher. In a specific embodiment, for the rate-value index, the first degree of difference and the second degree of difference for a certain dimension, for example, but not limited to, can be expressed as:

[0064] (7) First degree of difference = (Number of target attributes (attribute change rate < market change rate)) / Number of all attributes

[0065] (8) Second degree of difference = Average proportion difference of the numerator of all attributes + Average proportion difference of the denominator of all attributes

[0066] The differences in the numerator and denominator weights of each attribute can be expressed as:

[0067] (9) Difference in the specific gravity of attribute molecules = |Actual specific gravity of attribute molecules - Reference specific gravity of attribute molecules|

[0068] (10) Difference in the weight of the attribute denominator = |Actual weight of the attribute denominator - Reference weight of the attribute denominator|

[0069] The parameters in equations (7) to (10) have been explained in equations (1) to (6), and will not be repeated here.

[0070] After determining the first and second dissimilarity levels for each dimension, the first and second dissimilarity levels are added together to obtain the dimension filtering parameters for each dimension. All dimensions are then sorted according to the magnitude of the dimension filtering parameters, and the dimensions that meet the preset ranking in the ranking results are selected as the target dimensions. Here, the preset ranking can be set based on practical experience or as a hyperparameter generated by the system according to certain rules (e.g., the top 3, etc.).

[0071] According to an exemplary embodiment of this disclosure, to further improve search speed, attribute filtering can be performed before performing dimension filtering to filter out attributes irrelevant to anomalies from the numerous attributes under the dimension. Specifically, the second attribute change between the actual attribute result and the reference attribute result of each attribute under the dimension can be determined, and the second indicator change between the actual indicator result and the reference indicator result can be determined. Based on the second relative relationship between the second attribute change and the second indicator change, and / or the third relative relationship between the actual attribute result and the actual indicator result of each attribute, the target attribute (i.e., the attribute related to the anomaly) can be determined from the multiple attributes corresponding to the dimension. The target dimension can be determined based on the target attribute, which can further improve the search speed for the root cause of the anomaly. Here, the second indicator change can be obtained by subtracting the reference indicator result from the actual indicator result, and the second attribute change can be obtained by subtracting the reference indicator result from the actual indicator result. It should be noted that, for the rate value indicator, the second attribute change and the second indicator change of the numerator indicator and the second attribute change and the second indicator change of the denominator indicator are determined respectively. In some embodiments, an attribute under a dimension may be used as the target attribute when any one or more of the following conditions are met: the change in the second attribute of the attribute is greater than or equal to the product of the change in the second indicator and the second adjustment parameter; or, the actual attribute result of the attribute is greater than or equal to the product of the actual indicator result and the first adjustment parameter. Here, the first adjustment parameter and the second adjustment parameter are hyperparameters that are equal or unequal (e.g., 1%, 5%, etc.). In a specific embodiment, for a rate value indicator, when an attribute satisfies any one of equations (11) to (14), the attribute may be determined as the target attribute:

[0072] (11) Molecular observation value >= First adjustment parameter * Large disk molecular observation value

[0073] (12) Denominator observation value >= First adjustment parameter * Large-scale denominator observation value

[0074] (13) Molecular change >= Second adjustment parameter * Overall molecular change

[0075] (14) Change in denominator >= Second adjustment parameter * Change in market denominator

[0076] Here, the change in the numerator represents the change in the second attribute of the numerator indicator, the change in the denominator represents the change in the second attribute of the denominator indicator, the change in the numerator of the overall market index represents the change in the second attribute of the numerator indicator, and the change in the denominator of the overall market index represents the change in the second attribute of the denominator indicator.

[0077] In some embodiments, the aforementioned dimension filtering and attribute filtering may also be performed separately, and this disclosure does not limit this.

[0078] In some embodiments, after determining the target dimension, a set of leaf nodes that are related to the root cause of the anomaly can be obtained. In a specific implementation, the set of leaf nodes can be a two-dimensional table that includes leaf nodes and their observed values ​​(i.e., actual attribute results) and predicted values ​​(reference attribute results). For example, for a rate index containing two single dimensions, the set of leaf nodes can be as shown in Table 1, where each row in Table 1 represents a leaf node.

[0079] Table 1

[0080]

[0081] Performing anomaly root cause search on the obtained leaf node set can greatly narrow the search scope, thereby improving the search speed. Furthermore, by filtering out useless dimensions and attributes, the complexity of anomaly root cause search is reduced, which can improve the accuracy of anomaly root cause location.

[0082] Return to reference Figure 2 In step 204, the root cause of the abnormality in the target dimension can be identified.

[0083] According to an exemplary embodiment of this disclosure, for the rate value index, the denominator deviation degree of the leaf node and the numerator deviation degree of the leaf node can be determined first. Then, based on the numerator and denominator deviation degrees of the leaf node, abnormal leaf nodes are determined from the target dimension. Here, the leaf node is a node obtained by combining attributes under the target dimension. Specifically, in order to further narrow the search range of abnormal root causes and improve the search speed and accuracy of abnormal root cause location, the leaf nodes in the leaf node set corresponding to the target dimension can be further filtered. Specifically, for the rate value index, for each leaf node in the leaf node set, the abnormal deviation degree of the numerator index and the abnormal deviation degree of the denominator index can be calculated respectively. Here, for example, the difference between the numerator actual attribute result and the numerator reference attribute result at the leaf node can be divided by the sum of the numerator actual attribute result and the numerator reference attribute result at the leaf node to calculate the value of the numerator abnormal deviation degree of the leaf node. Similarly, the value of the denominator abnormal deviation degree of the leaf node can be obtained. In the specific implementation process, the calculation can be performed according to equations (15) to (16):

[0084] (15) The degree of abnormal deviation of the molecule = (|a-a_f|) / (a+a_f)

[0085] (16) The degree of abnormal deviation of the denominator = (|b-b_f|) / (b+b_f)

[0086] Where a represents the actual numerator attribute result at the leaf node; a_f represents the reference numerator attribute result at the leaf node; b represents the actual denominator attribute result at the leaf node; and a_f represents the reference denominator attribute result at the leaf node.

[0087] Then, the abnormal deviations of the numerator and denominator are sorted in ascending order to obtain abnormal deviation sequences for the numerator and denominator. A certain trend exists within these abnormal deviation sequences (reflected by the slope of the linear fit on both sides of the data points). The data point with the most significant difference in trend (i.e., the value with the largest change in linear slope) is identified as the inflection point (i.e., the preset threshold) of the abnormal deviation sequence. The leaf nodes corresponding to the values ​​above this inflection point are the abnormal leaf nodes to be screened out. Here, for the rate index, since both the abnormal deviations of the numerator and denominator are considered separately, anomalies caused by changes in the ratio of the numerator and denominator (i.e., no obvious anomaly in the "numerator / denominator" ratio, but anomalies in both the numerator and denominator) can be located, thereby improving the accuracy and comprehensiveness of anomaly root cause localization.

[0088] According to an exemplary embodiment of this disclosure, after identifying anomalous leaf nodes, these anomalous leaf nodes can be clustered to obtain at least one anomalous node class. Specifically, a root cause will cause similar changes in the numerator and denominator of leaf nodes, and these leaf nodes can be clustered into one class. The anomalous behavior of leaf nodes in different classes is inconsistent, and there may be multiple results representing the root cause. Therefore, the selected anomalous leaf nodes are first clustered to obtain at least one anomalous node class that is correlated with the anomalousness. Here, for the rate value index, the degree of deviation of the numerator and denominator of the anomalous leaf nodes can be used as two-dimensional features in the clustering process. The two-dimensional features are clustered using a preset clustering method to obtain at least one anomalous node class. In some embodiments, the preset clustering method can be K-Means clustering, hierarchical clustering, or DBSCAN (Density-Based Spatial Clustering of Applications with Noise) clustering method, etc., and there is no limitation thereto. Taking K-Means clustering as an example: The [abnormal deviation of the numerator and abnormal deviation of the denominator] of at least one selected anomalous leaf node are used as a two-dimensional feature. The K-means clustering method is then used to iterate through 1 to K classes, selecting the cluster with the best clustering effect. Here, the silhouette coefficient can be used to evaluate the clustering effect. The silhouette coefficient ranges from -1 to 1; a larger value indicates a better clustering effect. The silhouette coefficient, for example, but not limited to, can be expressed as:

[0089] (17) Silhouette coefficient = (inter-class distance - intra-class distance) / min(inter-class distance, intra-class distance)

[0090] Among them, "inter-class distance" refers to the average distance from an abnormal leaf node in a cluster to all abnormal leaf nodes in a cluster that does not contain the abnormal leaf node; "intra-class distance" refers to the average distance from an abnormal leaf node in a cluster to all other abnormal leaf nodes in its own cluster; "min(inter-class distance, intra-class distance)" refers to the minimum value of "inter-class distance" and "intra-class distance".

[0091] According to an exemplary embodiment of this disclosure, after obtaining at least one abnormal node class, a root cause search can be performed on each abnormal node class to obtain the root cause causing the indicator to become abnormal. Specifically, for each abnormal node class, the following operations can be performed: First, determine the abnormal impact parameters of the attributes and attribute combinations corresponding to the abnormal leaf nodes in the abnormal node class. Here, the abnormal impact parameters are obtained based on the actual attribute results and reference attribute results of the attributes and attribute combinations corresponding to the abnormal leaf nodes in the abnormal node class. Then, determine multiple candidate root causes based on the abnormal impact parameters. The candidate root causes include at least one of the attributes and attribute combinations corresponding to the abnormal leaf nodes in the abnormal node class. Next, determine the evaluation result of each candidate root cause. The evaluation result characterizes the degree of closeness between the actual indicator result and the reference indicator result after removing a certain candidate root cause. Finally, determine the root cause causing the indicator to become abnormal in the abnormal node class from the multiple candidate root causes based on the evaluation results of each determined candidate root cause.

[0092] According to an exemplary embodiment of this disclosure, to obtain multiple candidate root causes for each abnormal node class, the dimensions and dimension combinations corresponding to the abnormal leaf nodes in the abnormal node class can be used as candidate dimensions and candidate dimension combinations. For each candidate dimension and candidate dimension combination in each abnormal node class, the following operations are performed: Based on the abnormal impact parameter, the attributes or attribute combinations under the candidate dimension or candidate dimension combination are sorted in descending order, and at least one attribute or attribute combination whose sorting rank matches a preset rank is determined as at least one candidate root cause under the candidate dimension or candidate dimension combination; the obtained candidate dimension and at least one candidate root cause under each candidate dimension combination are collectively used as multiple candidate root causes for that abnormal node class. In some embodiments, the abnormal impact parameter of the rate value index can be expressed as:

[0093] (18)S ij =((A) ij (a)-F ij (a))*F(b)-(A ij (b)-F ij (b))*F(a)) / (F(b)*(F(b)+A ij (b)-F ij (b)))

[0094] Among them, S ij This indicates the degree of influence of attribute j (attribute or attribute combination) on the anomaly in observation dimension i (including candidate dimensions and combinations of candidate dimensions); A ij (a) and A ij (b) Represent the numerator and denominator actual index results of attribute j in observation dimension i, respectively; F ij (a) and F ij(b) represents the numerator and denominator reference index results for attribute j of observation dimension i, respectively; F(a) and F(b) represent the numerator and denominator overall reference index results for all attributes of observation dimension i, respectively.

[0095] In other embodiments, the outlier contribution of the additable metric can be expressed as:

[0096] (19)S ij =(A ij -F ij ) / (A(*)-F(*))

[0097] Among them, S ij This indicates the degree of influence of attribute j (attribute or attribute combination) on the anomaly in observation dimension i (including candidate dimensions and combinations of candidate dimensions); A ij and F ij represents the actual and reference index results of attribute j in observation dimension i, respectively; A(*) and F(*) represent the actual and reference index results of all attributes in observation dimension i, respectively.

[0098] After obtaining the anomaly impact parameters, these parameters can be normalized. For example, normalization can be achieved by dividing the anomaly impact parameter of each attribute or combination of attributes by the overall anomaly impact parameter of the indicator, so that the sum of the anomaly impact parameters of each attribute and combination of attributes is 1. Then, the normalized anomaly impact parameters can be sorted in descending order. For example, the sorting method can be based on the attributes under the candidate dimensions. After determining the anomaly impact parameter of an attribute, one attribute is greedily added in descending order until the anomaly impact parameter of a certain attribute is less than a threshold (e.g., any value between 0 and 0.1). The at least one attribute obtained through the greedy search is then considered at least one candidate root cause of the candidate dimension. The sorting method for combinations of candidate dimensions is similar; the at least one attribute combination obtained through the greedy search can be considered at least one candidate root cause of the candidate dimension combination.

[0099] According to an exemplary embodiment of this disclosure, to determine the evaluation result of each candidate root cause, the following operations may be performed for each candidate root cause: First, an inferred indicator result is determined based on the actual indicator result, the actual attribute result of the candidate root cause, and the reference attribute result; then, the evaluation result of the candidate root cause is determined based on the inferred indicator result, the actual indicator result, and the reference indicator result. In some embodiments, the evaluation result of each candidate root cause, for example, but not limited to, may be represented as:

[0100] (20) Evaluation result of candidate root cause = 1 - (inferred indicator result - reference indicator result) / (actual indicator result - reference indicator result)

[0101] Specifically, for rate-value indicators, the inferred indicator results, for example but not limited to, can be expressed as:

[0102] (21) Inference index result = (market numerator observed value - (candidate root cause numerator observed value - candidate root cause numerator predicted value)) / (market denominator observed value - (candidate root cause denominator observed value - candidate root cause denominator predicted value))

[0103] After obtaining the evaluation results of each candidate root cause, the ranking score can be determined based on the evaluation results of each candidate root cause in a certain abnormal node class. All candidate root causes in the class are ranked according to the ranking score of each candidate root cause, and the candidate root cause with the highest ranking score is determined as the root cause of the abnormality in that class. Here, the evaluation results can be directly used as the ranking score of each candidate root cause, or the evaluation results can be used as part of the ranking score, without any restriction. In the case where the evaluation results are used as part of the ranking score, the ranking score, for example, but not limited to, can be expressed as: (22) Ranking score = Evaluation result of candidate root cause + w1 (<0) * Number of root cause layers + w2 (>0) * Node coverage rate of candidate root cause + w3 (<0) * Proportion of candidate root cause in actual indicator results

[0104] Among them, "root cause level" indicates that the candidate root cause is in Figure 1 The data structure shown is at a certain level (e.g., when a candidate root cause is at level 2, its root cause level is 2); "Node coverage of candidate root cause" indicates the proportion of the number of nodes affected by the candidate root cause in its respective abnormal node class (i.e., attributes under a dimension or attribute combinations under a combination of dimensions) to the total number of nodes in that class; "Proportion of candidate root cause in actual indicator results" indicates the proportion of the actual attribute results of the candidate root cause in the actual indicator results; w1, w2, and w3 are all hyperparameters that are manually defined based on experience or automatically generated by the system, where w1 < 0, w2 > 0, and w3 < 0 (e.g., the values ​​of w1, w2, and w3 can be -0.2, 0.001, and -0.1, respectively).

[0105] Therefore, the shallower the root cause layer of a candidate root cause, or the higher the node coverage of the candidate root cause, or the smaller the proportion of the candidate root cause in the actual indicator results (i.e., the expectation is to explain the anomaly with the smallest possible root cause range), the higher its ranking.

[0106] Here, the accuracy of the candidate root cause evaluation is improved by introducing inference index results when determining the evaluation results of candidate root causes.

[0107] Below, in conjunction with Figure 3 This paper provides an overall description of the abnormal root cause localization method disclosed herein.

[0108] Figure 3 This is a schematic diagram illustrating a specific workflow for root cause localization of anomalies according to an exemplary embodiment of this disclosure. Reference Figure 3 When a fault occurs, firstly, multiple leaf nodes at the time of the fault occurrence are filtered by dimensional attributes (i.e., the aforementioned determination of target attributes and target dimensions). Then, the filtered leaf nodes are filtered for abnormal leaf nodes. After that, the abnormal leaf nodes are clustered. Then, for each class, the intra-class dimensional combination location is performed (i.e., the aforementioned determination of the abnormal root cause of each abnormal node class from multiple candidate root causes). Each class can obtain a root cause that causes the abnormality, forming a set of root causes that cause the abnormality.

[0109] Based on the obtained root cause set, maintenance personnel design solutions to mitigate losses more quickly. Using the anomaly root cause localization method disclosed herein on monitoring data of audio and video related products, the anomaly localization accuracy can exceed 90%.

[0110] Figure 4 This is a block diagram illustrating an anomaly root cause localization device according to an exemplary embodiment of the present disclosure.

[0111] Reference Figure 4 The anomaly root cause localization device 400 according to an exemplary embodiment of the present disclosure may include a parameter determination unit 401, a dimension evaluation result determination unit 402, a target dimension determination unit 403, and an anomaly root cause determination unit 404.

[0112] The parameter determination unit 401 can determine the actual indicator result and reference indicator result of the indicator, as well as the actual attribute result and reference attribute result of each target attribute under the dimension of the indicator, when the indicator of the multimedia resource is determined to be abnormal. The dimension evaluation result determination unit 402 can determine the dimension evaluation result of the dimension based on the actual indicator result and reference indicator result of the indicator, as well as the actual attribute result and reference attribute result of each target attribute. The target dimension determination unit 403 can determine the dimension whose dimension evaluation result meets the preset conditions, and take the dimension that meets the preset conditions as the target dimension. The anomaly root cause determination unit 404 can determine the root cause that caused the indicator to be abnormal from the target dimension. According to an exemplary embodiment of the present disclosure, the anomaly root cause localization device 400 may further include a target attribute determination unit 405. Figure 4 (Not shown in the figure), the target attribute determination unit 405 can first determine the second attribute change between the actual attribute result and the reference attribute result of each attribute under the dimension, and determine the second indicator change between the actual indicator result and the reference indicator result. Then, based on the second relative relationship between the second attribute change and the second indicator change, and / or the third relative relationship between the actual attribute result and the actual indicator result of each attribute, the target attribute is determined from the multiple attributes corresponding to the dimension.

[0113] because Figure 2 The abnormal root cause localization method shown can be derived from... Figure 4 The abnormal root cause localization device 400 shown is used to perform the operation, and the parameter determination unit 401, dimension evaluation result determination unit 402, target dimension determination unit 403, and abnormal root cause determination unit 404 can respectively perform the operation with... Figure 2 The operations corresponding to steps 201, 202, 203, and 204 in the text, therefore, regarding Figure 4 Any relevant details regarding the operations performed by each unit within the [system / component] can be found in the [document / reference / etc.]. Figure 2 The corresponding descriptions will not be repeated here.

[0114] Furthermore, it should be noted that although the anomaly root cause localization device 400 is divided into units for performing corresponding processes in the above description, those skilled in the art will understand that the processes performed by the aforementioned units can also be performed without any specific unit division or clear boundaries between the units. In addition, the anomaly root cause localization device 400 may also include other units, such as a data processing unit, a storage unit, etc.

[0115] Figure 5 This is a block diagram of an electronic device 500 according to an exemplary embodiment of the present disclosure.

[0116] Reference Figure 5 The electronic device 500 includes at least one memory 501 and at least one processor 502. The at least one memory 501 stores a set of computer-executable instructions. When the set of computer-executable instructions is executed by the at least one processor 502, an anomaly root cause localization method according to an exemplary embodiment of the present disclosure is performed.

[0117] As an example, electronic device 500 may be a PC, tablet, personal digital assistant, smartphone, or other device capable of executing the aforementioned set of instructions. Here, electronic device 500 is not necessarily a single electronic device, but may be a collection of any devices or circuits capable of executing the aforementioned instructions (or instruction sets) individually or in combination. Electronic device 500 may also be part of an integrated control system or system manager, or may be configured to interconnect with a portable electronic device locally or remotely (e.g., via wireless transmission) through an interface.

[0118] In electronic device 500, processor 502 may include a central processing unit (CPU), a graphics processing unit (GPU), a programmable logic device, a dedicated processor system, a microcontroller, or a microprocessor. By way of example and not limitation, processor may also include analog processors, digital processors, microprocessors, multi-core processors, processor arrays, network processors, etc.

[0119] The processor 502 can execute instructions or code stored in the memory 501, which can also store data. Instructions and data can also be sent and received over a network via a network interface device, which can employ any known transmission protocol.

[0120] The memory 501 may be integrated with the processor 502, for example, by placing RAM or flash memory within an integrated circuit microprocessor. Alternatively, the memory 501 may include a separate device, such as an external disk drive, a storage array, or other storage device usable by any database system. The memory 501 and the processor 502 may be operatively coupled, or may communicate with each other, for example, via I / O ports, network connections, etc., enabling the processor 502 to read files stored in the memory.

[0121] In addition, electronic device 500 may also include a video display (such as a liquid crystal display) and a user interaction interface (such as a keyboard, mouse, touch input device, etc.). All components of electronic device 500 can be interconnected via a bus and / or network.

[0122] According to exemplary embodiments of the present disclosure, a computer-readable storage medium storing instructions may also be provided, wherein when the instructions are executed by at least one processor, they cause at least one processor to perform an exception root cause localization method according to the present disclosure. Examples of computer-readable storage media herein include: read-only memory (ROM), random access programmable read-only memory (PROM), electrically erasable programmable read-only memory (EEPROM), random access memory (RAM), dynamic random access memory (DRAM), static random access memory (SRAM), flash memory, non-volatile memory, CD-ROM, CD-R, CD+R, CD-RW, CD+RW, DVD-ROM, DVD-R, DVD+R, DVD-RW, DVD+RW, DVD-RAM, BD-ROM, BD-R, BD-R LTH, BD-RE, Blu-ray or optical disc storage, hard disk drive (HDD), solid-state drive (SSD), card storage (such as multimedia cards, secure digital (SD) cards, or ultra-fast digital (XD) cards), magnetic tape, floppy disk, magneto-optical data storage device, optical data storage device, hard disk, solid-state drive, and any other device configured to store a computer program and any associated data, data files, and data structures in a non-transitory manner and to provide the computer program and any associated data, data files, and data structures to a processor or computer so that the processor or computer can execute the computer program. The computer program in the aforementioned computer-readable storage medium can run in an environment deployed in computer devices such as clients, hosts, agent devices, servers, etc. Furthermore, in one example, the computer program and any associated data, data files, and data structures are distributed across a networked computer system, such that the computer program and any associated data, data files, and data structures are stored, accessed, and executed in a distributed manner through one or more processors or computers.

[0123] According to exemplary embodiments of the present disclosure, a computer program product may also be provided, wherein the instructions in the computer program product are executable by a processor of a computer device to perform an anomaly root cause localization method according to exemplary embodiments of the present disclosure.

[0124] According to the anomaly root cause localization method, apparatus, electronic device and storage medium disclosed herein, by performing dimensional attribute filtering, dimensions and attributes unrelated to the root cause of the anomaly are pre-filtered, and anomaly root cause search is performed based on the filtered target dimensions and target attributes, which can greatly narrow the search range of anomaly root causes and improve the search speed of anomaly root causes.

[0125] Furthermore, when screening abnormal leaf nodes for rate indicators, screening the numerator and denominator indicators separately can pinpoint anomalies caused by changes in the ratio of data volume of the numerator and denominator indicators, thus improving the accuracy of anomaly root cause localization.

[0126] In addition, inference indicators were introduced when determining the evaluation results of candidate root causes, which improved the accuracy of the evaluation of candidate root causes.

[0127] Other embodiments of this disclosure will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of this disclosure that follow the general principles of this disclosure and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this disclosure are indicated by the following claims.

[0128] It should be understood that this disclosure is not limited to the precise structures described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this disclosure is limited only by the appended claims.

Claims

1. A method for locating the root cause of an anomaly, characterized in that, include: When it is determined that the indicators of multimedia resources are abnormal, the actual indicator results and reference indicator results of the indicators, as well as the actual attribute results and reference attribute results of each target attribute under the dimension of the indicators are determined. Based on the actual and reference indicator results of the stated indicators, as well as the actual and reference attribute results of each of the stated target attributes, the dimensional evaluation result of the stated dimension is determined. Determine the dimensions whose evaluation results meet the preset conditions, and use the dimensions that meet the preset conditions as the target dimensions; Identify the root causes that lead to the abnormality of the indicator from the target dimension; The step of determining the dimensional evaluation result of the dimension based on the actual and reference indicator results of the indicator, as well as the actual and reference attribute results of each of the target attributes, includes: The change in the first indicator is determined based on the actual indicator result and the reference indicator result, wherein the change in the first indicator is the rate of change of the actual indicator result relative to the reference indicator result; Based on the actual attribute results and reference attribute results of each target attribute under the dimension, the first attribute change amount of each target attribute is determined, wherein the first attribute change amount refers to the rate of change of the actual attribute result of the corresponding target attribute relative to the reference attribute result; Determine the actual weight of the actual attribute result of each target attribute relative to the actual indicator result, and the reference weight of the reference attribute result of each target attribute relative to the reference indicator result; Based on the change in the first indicator, and the change in the first attribute, actual weight, and reference weight of each target attribute under the dimension, the dimension evaluation result is determined. The step of determining the dimensional evaluation result of the dimension based on the change in the first indicator, and the change in the first attribute, actual weight, and reference weight of each target attribute under the dimension, includes: Determine the number of target attributes whose change in the first attribute is less than the change in the first indicator under the given dimension, and divide the determined number of attributes by the total number of attributes under the given dimension to obtain the first difference degree; Subtract the reference weight from the actual weight of each target attribute under the dimension to obtain the weight difference of each target attribute. Sum the weight differences and take the average to obtain the second difference degree. The dimension evaluation result is generated based on the first difference degree and the second difference degree.

2. The abnormal root cause localization method according to claim 1, characterized in that, The method further includes: Determine the amount of change in the second attribute between the actual attribute result and the reference attribute result for each attribute under the stated dimension; Determine the second indicator change between the actual indicator result and the reference indicator result; The target attribute is determined from multiple attributes corresponding to the dimension based on the second relative relationship between the change in the second attribute and the change in the second indicator, and / or the third relative relationship between the actual attribute result and the actual indicator result of each attribute.

3. The abnormal root cause localization method according to claim 2, characterized in that, The step of determining the target attribute from multiple attributes corresponding to the dimension based on the second relative relationship between the change in the second attribute and the change in the second indicator, and the third relative relationship between the actual attribute result and the actual indicator result of each attribute, includes: The attribute is used as the target attribute when any one or more of the following conditions are met: The change in the second attribute of the attribute is greater than or equal to the product of the change in the second indicator and the second adjustment parameter; The actual attribute result of the attribute is greater than or equal to the product of the actual index result and the first adjustment parameter.

4. The abnormal root cause localization method according to claim 1, characterized in that, The indicator is a rate-value indicator, which includes a numerator indicator and a denominator indicator; The step of identifying the root cause of the abnormality in the target dimension includes: Determine the degree of deviation of the denominator of the leaf node, and the degree of deviation of the numerator of the leaf node; Based on the degree of deviation of the numerator and denominator of the leaf node, abnormal leaf nodes are determined from the target dimension, wherein the leaf node is a node obtained by combining the attributes under the target dimension; Cluster the abnormal leaf nodes to obtain at least one abnormal node class; For each of the abnormal node classes, a root cause search is performed to obtain the root cause that caused the abnormality of the indicator.

5. The abnormal root cause localization method according to claim 4, characterized in that, The root cause search for each of the abnormal node classes to obtain the root cause causing the abnormality of the indicator includes: For each of the aforementioned abnormal node classes, perform the following operations: Determine the abnormal impact parameters of the attributes and attribute combinations corresponding to the abnormal leaf nodes in the abnormal node class, wherein the abnormal impact parameters are obtained based on the actual attribute results and reference attribute results of the attributes and attribute combinations corresponding to the abnormal leaf nodes in the abnormal node class. Multiple candidate root causes are determined based on the abnormal impact parameters, wherein the candidate root causes include at least one of the attributes and attribute combinations corresponding to the abnormal leaf nodes in the abnormal node class; Determine the evaluation result for each candidate root cause, wherein the evaluation result characterizes the degree of closeness between the actual indicator result and the reference indicator result after removing the candidate root cause; Based on the evaluation results, the root cause that causes the index to become abnormal is determined from the multiple candidate root causes in the abnormal node class.

6. The abnormal root cause localization method according to claim 5, characterized in that, The evaluation result for determining each of the candidate root causes includes: For each of the candidate root causes, perform the following operations: Based on the actual indicator results, the actual attribute results of the candidate root causes, and the reference attribute results, the inferred indicator results are determined; The evaluation results of the candidate root causes are determined based on the inferred indicator results, the actual indicator results, and the reference indicator results.

7. The abnormal root cause localization method according to claim 4, characterized in that, The clustering of the abnormal leaf nodes to obtain at least one abnormal node class includes: The degree of deviation of the numerator and denominator of the abnormal leaf nodes is used as a two-dimensional feature in the clustering process. The two-dimensional feature is clustered by a preset clustering method to obtain the at least one abnormal node class.

8. An abnormal root cause localization device, characterized in that, include: The parameter determination unit is configured to: when an abnormality is found in the indicator of a multimedia resource, determine the actual indicator result and reference indicator result of the indicator, as well as the actual attribute result and reference attribute result of each target attribute under the dimension of the indicator; The dimension evaluation result determination unit is configured to: determine the dimension evaluation result of the dimension based on the actual indicator result and reference indicator result of the indicator, and the actual attribute result and reference attribute result of each of the target attributes; The target dimension determination unit is configured to: determine the dimensions whose dimension evaluation results meet preset conditions, and take the dimensions that meet the preset conditions as target dimensions; The anomaly root cause determination unit is configured to: determine the root cause that causes the indicator to become abnormal from the target dimension; The dimensional evaluation result is configured as follows: The change in the first indicator is determined based on the actual indicator result and the reference indicator result, wherein the change in the first indicator is the rate of change of the actual indicator result relative to the reference indicator result; Based on the actual attribute results and reference attribute results of each target attribute under the dimension, the first attribute change amount of each target attribute is determined, wherein the first attribute change amount refers to the rate of change of the actual attribute result of the corresponding target attribute relative to the reference attribute result; Determine the actual weight of the actual attribute result of each target attribute relative to the actual indicator result, and the reference weight of the reference attribute result of each target attribute relative to the reference indicator result; Based on the change in the first indicator, and the change in the first attribute, actual weight, and reference weight of each target attribute under the dimension, the dimension evaluation result is determined. The dimension evaluation result determination unit is configured as follows: Determine the number of target attributes whose change in the first attribute is less than the change in the first indicator under the given dimension, and divide the determined number of attributes by the total number of attributes under the given dimension to obtain the first difference degree; Subtract the reference weight from the actual weight of each target attribute under the dimension to obtain the weight difference of each target attribute. Then, add up the weight differences and take the average to obtain the second difference degree. The dimension evaluation result is generated based on the first difference degree and the second difference degree.

9. The abnormal root cause localization device according to claim 8, characterized in that, It also includes a target attribute determination unit, which is configured as follows: Determine the amount of change in the second attribute between the actual attribute result and the reference attribute result for each attribute under the stated dimension; Determine the second indicator change between the actual indicator result and the reference indicator result; The target attribute is determined from multiple attributes corresponding to the dimension based on the second relative relationship between the change in the second attribute and the change in the second indicator, and / or the third relative relationship between the actual attribute result and the actual indicator result of each attribute.

10. The abnormal root cause localization device according to claim 9, characterized in that, The target attribute determination unit is configured as follows: The attribute is used as the target attribute when any one or more of the following conditions are met: The change in the second attribute of the attribute is greater than or equal to the product of the change in the second indicator and the second adjustment parameter; The actual attribute result of the attribute is greater than or equal to the product of the actual index result and the first adjustment parameter.

11. The abnormal root cause localization device according to claim 8, characterized in that, The indicator is a rate-value indicator, which includes a numerator indicator and a denominator indicator; The anomaly root cause determination unit is configured as follows: Determine the degree of deviation of the denominator of the leaf node, and the degree of deviation of the numerator of the leaf node; Based on the degree of deviation of the numerator and denominator of the leaf node, abnormal leaf nodes are determined from the target dimension, wherein the leaf node is a node obtained by combining the attributes under the target dimension; Cluster the abnormal leaf nodes to obtain at least one abnormal node class; For each of the abnormal node classes, a root cause search is performed to obtain the root cause that caused the abnormality of the indicator.

12. The abnormal root cause localization device according to claim 11, characterized in that, The anomaly root cause determination unit is configured as follows: For each of the aforementioned abnormal node classes, perform the following operations: Determine the abnormal impact parameters of the attributes and attribute combinations corresponding to the abnormal leaf nodes in the abnormal node class, wherein the abnormal impact parameters are obtained based on the actual attribute results and reference attribute results of the attributes and attribute combinations corresponding to the abnormal leaf nodes in the abnormal node class. Multiple candidate root causes are determined based on the abnormal impact parameters, wherein the candidate root causes include at least one of the attributes and attribute combinations corresponding to the abnormal leaf nodes in the abnormal node class; Determine the evaluation result for each candidate root cause, wherein the evaluation result characterizes the degree of closeness between the actual indicator result and the reference indicator result after removing the candidate root cause; Based on the evaluation results, the root cause that causes the index to become abnormal is determined from the multiple candidate root causes in the abnormal node class.

13. The abnormal root cause localization device according to claim 12, characterized in that, The anomaly root cause determination unit is configured as follows: For each of the candidate root causes, perform the following operations: The inferred indicator results are determined based on the actual indicator results, the actual attribute results of the candidate root causes, and the reference attribute results. The evaluation results of the candidate root causes are determined based on the inferred indicator results, the actual indicator results, and the reference indicator results.

14. The abnormal root cause localization device according to claim 11, characterized in that, The anomaly root cause determination unit is configured as follows: The degree of deviation of the numerator and denominator of the abnormal leaf nodes is used as a two-dimensional feature in the clustering process. The two-dimensional feature is clustered by a preset clustering method to obtain the at least one abnormal node class.

15. An electronic device, characterized in that, include: At least one processor; At least one memory that stores computer-executable instructions. The computer-executable instructions, when executed by the at least one processor, cause the at least one processor to perform the anomaly root cause localization method according to any one of claims 1 to 7.

16. A computer-readable storage medium for storing instructions, characterized in that, When the instruction is executed by at least one processor, it causes the at least one processor to perform the anomaly root cause localization method according to any one of claims 1 to 7.

17. A computer program product comprising computer instructions, characterized in that, When the computer instructions are executed by at least one processor, they implement the anomaly root cause localization method according to any one of claims 1 to 7.

Images