A method and apparatus for analyzing the state of a device

Abstract

A method for analyzing the state of a device is disclosed, comprising: obtaining first data and second data indicating the state of the device; obtaining a first state event according to the first data; obtaining a second state event according to the second data; wherein the first state event has a correlation relationship with the second state event; and determining the state of the device according to the correlation relationship. The technical solution ensures accurate acquisition of device state information through comprehensive intelligent analysis of data from multiple sources.

Description

Technical Field

[0001] This invention relates to the field of computers, and more particularly to a method and apparatus for analyzing the state of a device. Background Technology

[0002] With the large-scale development of IT infrastructure, traditional manual operation and maintenance methods are not only costly but also prone to errors. Therefore, artificial intelligence is playing an increasingly important role in IT infrastructure operation and maintenance, with anomaly identification and fault diagnosis of equipment being a key focus. Current equipment fault detection typically employs big data analysis of Key Performance Indicators (KPIs) and anomaly detection algorithms to support the discovery of equipment anomalies. Equipment KPI data includes link speeds, throughput, packet loss rates, and latency data for processors, memory, disks, network devices, etc. KPI anomaly detection analyzes KPI time series to determine if abnormal behavior has occurred. However, relying on a single data source results in poor accuracy in fault diagnosis. Summary of the Invention

[0003] This application discloses a method and apparatus for analyzing the condition of equipment. This method can comprehensively analyze data from multiple sources to ensure accurate status information of the equipment.

[0004] Firstly, a method for analyzing the state of a device is provided, including:

[0005] Acquire the first and second data indicating the status of the device;

[0006] The first state event is obtained based on the first data;

[0007] The second state event is obtained based on the second data; wherein the first state event and the second state event are related.

[0008] The status of the device is determined based on the association relationship.

[0009] This technical solution enables the accurate acquisition of equipment status information through comprehensive intelligent analysis of data from multiple sources.

[0010] In one possible implementation, the first state event and the second state event are correlated, meaning the time interval between the occurrence of the first state event and the occurrence of the second state event is less than a first threshold. When the time interval between the occurrences of two state events is close, it indicates a temporal correlation between the two state events.

[0011] In one possible implementation, the first state event and the second state event are related, meaning that the semantic category of the first state event is the same as that of the second state event. When the two state events are the same type of state event, it indicates that proving the occurrence of the state event from two data sources can more accurately confirm the state of the device.

[0012] In one possible implementation, the first state event and the second state event are correlated, including: the first state event and the second state event are causally related. There is a causal relationship between the state events of the device; for example, a rise in the processor temperature and a decrease in the fan speed are causally related. When the fan speed is low, the processor temperature will rise. Therefore, by diagnosing the rise in processor temperature, the low fan speed can be diagnosed, further determining a fan malfunction.

[0013] In one possible implementation, the method further includes: acquiring third data and fourth data indicating the state of the device; obtaining a third state event based on the third data; obtaining a fourth state event based on the fourth data; wherein the third state event and the fourth state event are not related.

[0014] In one possible implementation, the method further includes: adjusting a first detection parameter related to the third data, detecting the third data, and obtaining a fifth state event; adjusting a second detection parameter related to the fourth data, detecting the fourth data, and obtaining a sixth state event; the fifth and sixth state events are correlated. By adjusting the detection parameters, a more accurate detection model can be obtained, thus enabling a more accurate determination of the device's state.

[0015] In one possible implementation, the fifth state event and the sixth state event are related, including that the interval between the time point of the fifth state event and the time point of the sixth state event is less than a first threshold.

[0016] In one possible implementation, the fifth state event and the sixth state event are related, and the semantic categories of the fifth state event and the sixth state event are the same.

[0017] In one possible implementation, the fifth state event and the sixth state event are related, and the fifth state event and the sixth state event are causally related.

[0018] In one possible implementation, the first detection parameter includes: a second threshold for the frequency of occurrence of the semantic category of the third state event or a third threshold for the discreteness of the fourth data; the second detection parameter includes: a fourth threshold for the frequency of occurrence of the semantic category of the third state event or a fifth threshold for the discreteness of the fourth data.

[0019] In a second aspect, an apparatus for equipment fault analysis is provided, the apparatus comprising: a first acquisition module and a second acquisition module, a first detection module and a second detection module, and a determination module;

[0020] The first acquisition module is used to acquire the first data of the device;

[0021] The second acquisition module is used to acquire the second data of the device;

[0022] The first detection module is used to detect the first data and determine the first state event;

[0023] The second detection module is used to acquire the second data and determine the second state event;

[0024] The determination module is used to determine the correlation between the first state event and the second state event, and to determine the state of the device based on the correlation.

[0025] This technical solution enables the accurate acquisition of equipment status information through comprehensive intelligent analysis of data from multiple sources.

[0026] In one possible implementation, the determining module is used to determine that the first state event and the second state event are related, including: determining that the interval between the occurrence times of the first state event and the second state event is less than a first threshold. When the time interval between the occurrences of the two state events is close, it can be said that the two state events are temporally related.

[0027] In one possible implementation, the determining module is used to determine that the first state event and the second state event are related, including: determining that the semantic category of the first state event and the semantic category of the second state event are the same. When the two state events are the same type of state event, it indicates that the occurrence of the state event is proven from two data sources, which can more accurately confirm the state of the device.

[0028] In one possible implementation, the determining module is used to determine the correlation between the first state event and the second state event, including determining a causal relationship between the first state event and the second state event. There is a causal relationship between the state events of the device; for example, a rise in the temperature of the processor in the device is causally related to the speed of the fan in the device. When the fan speed is low, the processor temperature will rise. Therefore, by diagnosing the rise in processor temperature, the low fan speed of the device can be diagnosed, further determining a fan malfunction.

[0029] In one possible implementation, the first acquisition module is further configured to acquire third data of the device; the second acquisition module is further configured to acquire fourth data of the device; the first detection module is further configured to detect the third data and determine the third state event; the second detection module is further configured to acquire the fourth data and determine the fourth state event; and the determination module is further configured to determine that the third state event and the fourth state event are not related.

[0030] In one possible implementation, the device further includes: a first adjustment module and a second adjustment module; the first adjustment module is used to adjust a first detection parameter of the first detection module, and the second adjustment module is used to adjust a second detection parameter of the second detection module; the first detection module is also used to detect third data based on the adjusted first detection parameters to determine a fifth state event; the second detection module is also used to detect fourth data based on the adjusted second detection parameters to determine a sixth state event; the determining module is also used to determine that the fifth state event and the sixth state event are correlated. By adjusting the detection parameters, a more accurate detection model can be obtained, thus enabling a more accurate determination of the device's state.

[0031] In one possible implementation, the determining module is further configured to determine that the fifth state event and the sixth state event are related, including: determining that the interval between the time point of occurrence of the fifth state event and the time point of occurrence of the sixth state event is less than a first threshold.

[0032] In one possible implementation, the determining module is further configured to determine that the fifth state event and the sixth state event are related, including: determining that the semantic category of the fifth state event and the semantic category of the sixth state event are the same.

[0033] In one possible implementation, the determining module is further configured to determine that the fifth state event and the sixth state event are related, including: determining that the fifth state event and the sixth state event are causally related.

[0034] In one possible implementation, the first detection parameter includes: a second threshold for the frequency of occurrence of the semantic category of the third state event or a third threshold for the discreteness of the fourth data; the second detection parameter includes: a fourth threshold for the frequency of occurrence of the semantic category of the third state event or a fifth threshold for the discreteness of the fourth data.

[0035] Thirdly, a computer device is provided, including at least one memory and at least one processor, wherein the at least one memory is used to store computer instructions;

[0036] When at least one processor executes computer instructions, the computer device performs the method of any one of claims 1 to 10.

[0037] Fourthly, a non-transient readable storage medium is provided, which stores computer program code, and when the computer program code is executed by a computer device, the computer device performs the method of any one of claims 1 to 10. Attached Figure Description

[0038] Figure 1 Flowchart of a device fault detection method with a single data source;

[0039] Figure 2 A flowchart of a device fault detection method with multiple data sources provided in this application embodiment;

[0040] Figure 3 A structural diagram of a device fault detection apparatus with multiple data sources provided in an embodiment of this application;

[0041] Figure 4 A structural diagram of another device fault detection device with multiple data sources provided in this application embodiment;

[0042] Figure 5 This is a hardware structure diagram of a fault detection device provided in an embodiment of this application. Detailed Implementation

[0043] Figure 1 The diagram shows a flowchart of a device fault detection method using only KPI data. This method first generates a large amount of KPI data to establish an analytical model, and then uses this model to analyze new KPI data, providing fault analysis results corresponding to the new KPI data.

[0044] As shown in step S102: First, obtain the existing KPI data. This data is time-related, and each KPI data includes a timestamp.

[0045] As shown in step S104: Each KPI data is marked as abnormal. For example, when a KPI data is considered to be abnormal, it is marked as abnormal KPI data, indicating that the equipment is in a fault state at the time corresponding to the KPI data.

[0046] As shown in step S106: After obtaining the labels for whether the KPI data is abnormal, the KPI anomaly detection model is trained, and finally the KPI anomaly detection model is determined.

[0047] As shown in step S108: new KPI data for the device is acquired and input into the KPI anomaly detection model, which then outputs a detection result indicating whether the new KPI data is abnormal. This determines whether the device is faulty at the time point corresponding to the new KPI data.

[0048] However, using a single data source to determine whether a device is faulty is not accurate enough, leading to low operational efficiency. Therefore, this application provides a technical solution that utilizes multiple data sources for anomaly identification and fault diagnosis, achieving rapid location of faults in intelligent operations and maintenance (AIOps). Comprehensive fault diagnosis using multi-source data and multiple detection methods can effectively improve operational efficiency and reduce costs in IT infrastructure. The types of data include numerical data and text data, etc. Numerical data includes KPI data, such as processor and memory usage, power consumption, temperature, disk I / O (input / output, I / O) read / write rates, and network performance indicators. Text data includes logs, call chains, alarms, and work orders, such as operating system fault logs, performance bottleneck logs, hard disk fault logs, and bus fault logs.

[0049] The technical solution of this application is applied to IT infrastructure (servers, storage, cloud service data centers, etc.) operation and maintenance devices. For example, it can be used in fault detection devices for server whole-machine fault management scenarios; anomaly detection devices for server hardware fault prediction scenarios; and fault diagnosis devices for server operating system and middleware fault diagnosis scenarios. It realizes multi-source data correlation analysis and interactive verification of anomaly results, ultimately achieving intelligent comprehensive fault management and diagnosis.

[0050] like Figure 2 The diagram shown is a flowchart of a device fault diagnosis process provided in an embodiment of this application.

[0051] As shown in step S202, begin the equipment fault diagnosis and analysis.

[0052] As shown in step S204, the existing KPI data and log data of the device are obtained. Each KPI data has a timestamp, and each log data also has a timestamp. These timestamps are used to characterize the point in time when each KPI data was recorded and the point in time when each log data was recorded.

[0053] Specifically, the KPI data is a dataset composed of time-series data, D_kpi = {D1_kpi, D2_kpi…Di_kpi…DN_kpi}, where i represents the i-th KPI. Specifically, the KPI data Di_kpi includes a timestamp dimension and a numerical dimension, Di_kpi = [Timestamp, data], where each dimension is a data list.

[0054] Specifically, the log data is structured or unstructured text data, D_log = {D1_log, D2_log…Di_log…DM_log}, where i represents the i-th log type. It can include dimensions such as timestamp, log level, log function name, and specific log content, where Di_log = [Timestamp, level, function, content], and each dimension is a data list.

[0055] As shown in step S206, existing KPI data is used to label whether the KPI data is abnormal. Based on the anomaly labels, the labeled KPI data is trained to obtain an anomaly detection model based on the KPI data. Similarly, existing log data is used to label whether the log data is abnormal. Based on the anomaly labels, the labeled log data is trained to obtain an anomaly detection model based on the log data.

[0056] The KPI anomaly detection model can employ unsupervised or supervised machine learning algorithms. Taking the K-means machine learning algorithm as an example, for the KPI data Di_kpi, a clustering range num = [num_1, num_2, ..., num_i, ..., num_L] is set. The number of clusters is not fixed; instead, the optimal range from num_1 to num_L is selected. For num = num_i, the cluster center set cluster_i and the clustering score_i are obtained using the K-means algorithm (closer clustering and smaller distances between clusters indicate higher quality). The number of clusters corresponding to the highest score score_optimal, num_optimal, and the corresponding cluster center set cluster_optimal are selected. A suitable anomaly threshold α is set. When distance(data, cluster_optimal) > α, the KPI data is considered anomaly. Here, distance can be selected from Euclidean distance, etc. To illustrate how this KPI anomaly detection model works, consider a server where, under normal conditions, the processor utilization rate is approximately 60%-70% during the day and 30%-40% at night. Data statistics show that cluster = [65%, 35%], indicating two clusters: 65% and 35%. Setting the anomaly threshold to 10%, if the processor utilization rate reaches 90% for an extended period (e.g., five consecutive minutes), then this KPI data is considered to deviate from the cluster center (65%) by more than the 10% threshold, and is therefore deemed an anomaly.

[0057] The log anomaly detection model can employ an anomaly detection algorithm based on log templates. Taking a template extraction algorithm based on frequent word vectors as an example, when the frequency of a certain word vector in a log entry exceeds a certain threshold, the word vectors exceeding the threshold are extracted as templates. For example, consider three log entries: [Physical drive Disk 0patrolread, Physical drive Disk 2patrol read, Physical drive Disk 5patrol read]. Except for Disk 0, 2, and 5, the frequency of the other word vectors is 3 (assuming a threshold of 2). The final extracted template is: Physical drive Disk *patrol read. A complete log entry also includes information such as time, function name, and log level. Using the same principle, the template Di_log = [Timestamp, level, function, content] is extracted as Template = [template1, template2…]. Given a time window, the frequency of all templates recorded within that time window is obtained as Frequency = [frequency1, frequency2…]. Similarly, an anomaly detection model for the frequency of each template is trained using the K-means algorithm, thus obtaining a method for anomaly detection of a single log template. To illustrate how this log anomaly detection model works, consider a device's daily operation log with 10,000 lines. Set the time window to 1000 lines, meaning the frequency of each log template is counted every 1000 lines. The log template for device disk reads is "Physical drive Disk*patrol read". Normally, this template appears approximately 20-30 times per 1000 lines. However, in a specific statistical analysis, the frequency of this template suddenly increases to 90 times. This log data is considered an anomaly, potentially indicating an abnormal disk read.

[0058] As shown in step S208, new KPI data and new log data of the device within a certain period of time are obtained to determine whether the device has failed during this period.

[0059] As shown in step S210, based on the anomaly detection model based on KPI data and the anomaly detection model based on log data obtained in step S206, fault analysis is performed on the new KPI data and the new log data respectively, and the anomaly analysis results based on KPI data and the anomaly analysis results based on log data are obtained respectively.

[0060] Specifically, to retrieve KPI anomaly results, use the formula: [Abnormal KPI Name, Abnormal Time 1, Abnormal Data]. To retrieve log anomaly results, use the formula: [Abnormal Log Template, Abnormal Time 2, Abnormal Content].

[0061] According to step S212, analyze the correlation between abnormal KPI results and abnormal log results.

[0062] Specifically, based on time correlation, the system compares the abnormal time 1 of the KPI anomaly result and the abnormal time 2 of the log anomaly result to filter KPI anomaly results and establish a time correlation between 'abnormal KPI name' and 'abnormal log template'. When abnormal time 1 and abnormal time 2 differ within a threshold range, the KPI anomaly result and the log anomaly result are considered to be time-related, indicating that the two anomalies occurred within the same time period. For example, this threshold could be one day or one week.

[0063] Based on semantic association, anomaly KPI names are associated with anomaly log templates using a semantic association algorithm. Here, the semantic association algorithm uses the edit distance algorithm as an example, which refers to the minimum number of edit operations required to transform one string into another. Generally, the smaller the edit distance, the greater the similarity between the two strings. When the edit distance is less than a threshold, the anomaly KPI name and the anomaly log template are considered semantically associated, indicating that the KPI anomaly result and the log anomaly result are the same anomaly result.

[0064] Based on causal relationships, a causal relationship is established by examining the causal connections between existing anomalies. For example, if an anomaly KPI data shows an abnormal processor temperature, while anomaly log data shows that the device's fan speed is below a certain value, then it can be determined that there is a causal relationship between the anomaly KPI data and the anomaly log data. Therefore, they are causally related, and the KPI anomaly result and the log anomaly result are the same anomaly result, indicating that the device's fan component is faulty.

[0065] When there is a correlation between abnormal KPI results and abnormal log results, including temporal correlation, semantic correlation, or causal correlation, it indicates that there is a correlation between the abnormal KPI results and abnormal log results.

[0066] If there is no temporal, semantic, or causal relationship between abnormal KPI results and abnormal log results, it means that there is no correlation between the abnormal KPI results and abnormal log results.

[0067] As shown in step S214, the detection parameters of the anomaly detection model are adjusted based on the correlation analysis results between KPI anomaly results and log anomaly results.

[0068] The adjustments to the KPI anomaly detection model include: ① Adjusting the anomaly alarm threshold of the KPI anomaly detection model, increasing the threshold sensitivity for data that is considered abnormal by both KPI and log data; ② Decreasing the threshold sensitivity for data that is not considered abnormal by both KPI and log data. Additionally, when training the anomaly detection model, the training set is supplemented with data that the KPI anomaly detection model classifies as anomaly but the log anomaly detection model classifies as normal, increasing the model's robustness.

[0069] The adjustments to the log anomaly detection model include: ① Adjusting the anomaly alarm threshold of the log anomaly detection model. For data identified as anomalous by the KPI anomaly detection model, the weight of the corresponding log template is increased to increase threshold sensitivity. For example, doubling the weight and halving the threshold will make anomaly detection more sensitive; ② For data that is not jointly identified as anomalous by the KPI anomaly detection model and the log anomaly detection model, the weight of the response log template is reduced to decrease threshold sensitivity. For example, halving the weight and halving the threshold will decrease anomaly detection sensitivity.

[0070] Specifically, increasing threshold sensitivity means the model is more easily triggered to confirm that the data is an anomaly. Decreasing threshold sensitivity means the model is less easily triggered to confirm that the data is an anomaly.

[0071] Based on the adjustment of detection parameters in the above steps, proceed to process S206 to update the KPI anomaly detection model and the log anomaly detection model, retrain them, and output the latest anomaly detection model.

[0072] As shown in step S216, the final fault diagnosis result is output.

[0073] Complete the anomaly detection process as shown in step S220.

[0074] like Figure 3 The diagram shows a possible structural diagram of a fault analysis device 300 according to an embodiment of this application. The fault analysis device 300 includes: a KPI data acquisition module 302 and a log data acquisition module 312; a KPI anomaly detection training module 304 and a log anomaly detection training module 314; a KPI anomaly detection module 306 and a log anomaly detection module 316; a KPI anomaly detection output module 308 and a log anomaly detection output module 318; a correlation confirmation module 322; a KPI anomaly detection parameter adjustment module 310 and a log anomaly detection parameter adjustment module 320; and an anomaly analysis result output module 324.

[0075] The KPI data acquisition module 302 and the log data acquisition module 312 are used to acquire the device's KPI data and log data, respectively. Each KPI data piece has a timestamp, and each log data piece also has a timestamp. These timestamps are used to represent the point in time when each KPI data piece was recorded, and the point in time when each log data piece was recorded.

[0076] Specifically, the KPI data is a dataset composed of time-series data, D_kpi = {D1_kpi, D2_kpi…Di_kpi…DN_kpi}, where i represents the i-th KPI. Specifically, the KPI data Di_kpi includes a timestamp dimension and a numerical dimension, Di_kpi = [Timestamp, data], where each dimension is a data list.

[0077] Specifically, the log data is structured or unstructured text data, D_log = {D1_log, D2_log…Di_log…DM_log}, where i represents the i-th log type. It can include dimensions such as timestamp, log level, log function name, and specific log content, where Di_log = [Timestamp, level, function, content], and each dimension is a data list.

[0078] The KPI anomaly detection training module 304 and the log anomaly detection training module 314 are used to label existing KPI data as anomaly-related, and then train the model on the labeled KPI data to obtain an anomaly detection model based on the KPI data. Similarly, they are used to label existing log data as anomaly-related, and then train the model on the labeled log data to obtain an anomaly detection model based on the log data.

[0079] The KPI anomaly detection model can employ unsupervised or supervised machine learning algorithms. Taking the K-means machine learning algorithm as an example, for the KPI data Di_kpi, a clustering range num = [num_1, num_2, ..., num_i, ..., num_L] is set. The number of clusters is not fixed; instead, the optimal range from num_1 to num_L is selected. For num = num_i, the cluster center set cluster_i and the clustering score_i are obtained using the K-means algorithm (closer clustering and smaller distances between clusters indicate higher quality). The number of clusters corresponding to the highest score score_optimal, num_optimal, and the corresponding cluster center set cluster_optimal are selected. A suitable anomaly threshold α is set. When distance(data, cluster_optimal) > α, the KPI data is considered anomaly. Here, distance can be selected from Euclidean distance, etc. To illustrate how this KPI anomaly detection model works, consider a server where, under normal conditions, the processor utilization rate is approximately 60%-70% during the day and 30%-40% at night. Data statistics show that cluster = [65%, 35%], indicating two clusters: 65% and 35%. Setting the anomaly threshold to 10%, if the processor utilization rate reaches 90% for an extended period (e.g., five consecutive minutes), then this KPI data is considered to deviate from the cluster center (65%) by more than the 10% threshold, and is therefore deemed an anomaly.

[0080] The log anomaly detection model can employ an anomaly detection algorithm based on log templates. Taking a template extraction algorithm based on frequent word vectors as an example, when the frequency of a certain word vector in a log entry exceeds a certain threshold, the word vectors exceeding the threshold are extracted as templates. For example, consider three log entries: [Physical drive Disk 0patrolread, Physical drive Disk 2patrol read, Physical drive Disk 5patrol read]. Except for Disk 0, 2, and 5, the frequency of the other word vectors is 3 (assuming a threshold of 2). The final extracted template is: Physical drive Disk *patrol read. A complete log entry also includes information such as time, function name, and log level. Using the same principle, the template Di_log = [Timestamp, level, function, content] is extracted as Template = [template1, template2…]. Given a time window, the frequency of all templates recorded within that time window is obtained as Frequency = [frequency1, frequency2…]. Similarly, an anomaly detection model for the frequency of each template is trained using the K-means algorithm, thus obtaining a method for anomaly detection of a single log template. To illustrate how this log anomaly detection model works, consider a device's daily operation log with 10,000 lines. Set the time window to 1000 lines, meaning the frequency of each log template is counted every 1000 lines. The log template for device disk reads is "Physical drive Disk*patrol read". Normally, this template appears approximately 20-30 times per 1000 lines. However, in a specific statistical analysis, the frequency of this template suddenly increases to 90 times. This log data is considered an anomaly, potentially indicating an abnormal disk read.

[0081] The KPI data acquisition module 302 and the log data acquisition module 312 are also used to acquire new KPI data and new log data from the device over a period of time. Then, the KPI anomaly detection module 306 and the log anomaly detection module 316 are used to determine whether any faults have occurred in the device during this period. The anomaly detection model based on KPI data and the anomaly detection model based on log data perform fault analysis on the new KPI data and the new log data, respectively, and obtain the anomaly analysis results based on KPI data and the anomaly analysis results based on log data, respectively. Specifically, the KPI anomaly result is obtained as [anomaly KPI name, anomaly time 1, anomaly data]. The log anomaly result is obtained as [anomaly log template, anomaly time 2, anomaly content].

[0082] The KPI anomaly detection output module 308 and the log anomaly detection output module 318 are used to output the KPI anomaly results and the log anomaly results to the correlation confirmation module 322.

[0083] The correlation confirmation module 322 is used to analyze the correlation between abnormal KPI results and abnormal log results.

[0084] Specifically, based on time correlation, the system compares the abnormal time 1 of the KPI anomaly result and the abnormal time 2 of the log anomaly result to filter KPI anomaly results and establish a time correlation between 'abnormal KPI name' and 'abnormal log template'. When abnormal time 1 and abnormal time 2 differ within a threshold range, the KPI anomaly result and the log anomaly result are considered to be time-related, indicating that the two anomalies occurred within the same time period. For example, this threshold could be one day or one week.

[0085] Based on semantic association, anomaly KPI names are associated with anomaly log templates using a semantic association algorithm. Here, the semantic association algorithm uses the edit distance algorithm as an example, which refers to the minimum number of edit operations required to transform one string into another. Generally, the smaller the edit distance, the greater the similarity between the two strings. When the edit distance is less than a threshold, the anomaly KPI name and the anomaly log template are considered semantically associated, indicating that the KPI anomaly result and the log anomaly result are the same anomaly result.

[0086] Based on causal relationships, a causal relationship is established by examining the causal connections between existing anomalies. For example, if an anomaly KPI data shows an abnormal processor temperature, while anomaly log data shows that the device's fan speed is below a certain value, then it can be determined that there is a causal relationship between the anomaly KPI data and the anomaly log data. Therefore, they are causally related, and the KPI anomaly result and the log anomaly result are the same anomaly result, indicating that the device's fan component is faulty.

[0087] When there is a correlation between abnormal KPI results and abnormal log results, including temporal correlation, semantic correlation, or causal correlation, it indicates that there is a correlation between the abnormal KPI results and abnormal log results.

[0088] If there is no temporal, semantic, or causal relationship between abnormal KPI results and abnormal log results, it means that there is no correlation between the abnormal KPI results and abnormal log results.

[0089] The KPI anomaly detection parameter adjustment module 310 and the log anomaly detection parameter adjustment module 320 can adjust the parameters of the anomaly detection model by using the correlation analysis results between KPI anomaly results and log anomaly results.

[0090] The adjustments to the KPI anomaly detection model include: ① Adjusting the anomaly alarm threshold of the KPI anomaly detection model, increasing the threshold sensitivity for data that is considered abnormal by both KPI and log data; ② Decreasing the threshold sensitivity for data that is not considered abnormal by both KPI and log data. Additionally, when training the anomaly detection model, the training set is supplemented with data that the KPI anomaly detection model classifies as anomaly but the log anomaly detection model classifies as normal, increasing the model's robustness.

[0091] The adjustments to the log anomaly detection model include: ① Adjusting the anomaly alarm threshold of the log anomaly detection model. For data identified as anomalous by the KPI anomaly detection model, the weight of the corresponding log template is increased to increase threshold sensitivity. For example, doubling the weight and halving the threshold will make anomaly detection more sensitive; ② For data that is not jointly identified as anomalous by the KPI anomaly detection model and the log anomaly detection model, the weight of the response log template is reduced to decrease threshold sensitivity. For example, halving the weight and halving the threshold will decrease anomaly detection sensitivity.

[0092] Specifically, increasing threshold sensitivity means the model is more easily triggered to confirm that the data is an anomaly. Decreasing threshold sensitivity means the model is less easily triggered to confirm that the data is an anomaly.

[0093] Based on the above adjustments, the KPI anomaly detection model and the log anomaly detection model are updated, retrained, and the latest anomaly detection model is output.

[0094] The anomaly analysis result output module 324 is used to output the final anomaly analysis result based on the KPI anomaly analysis result and the log anomaly analysis result.

[0095] In the above embodiments, log data provides interpretability of abnormal events, while KPI data provides a representation of business performance. By interpreting the KPI data representation through log data, the credibility of the discovered KPI anomalies can be proven. Furthermore, the accuracy of the discovered KPI anomalies can be enhanced by adjusting the training parameters of the anomaly detection model. Similarly, by verifying the impact of the KPI data representation on the log data, the credibility of the discovered log data anomalies can be proven. The accuracy of the discovered log data anomalies can be enhanced by adjusting the training detection parameters of the log anomaly detection model.

[0096] In another embodiment of this application, such as Figure 4 As shown, an apparatus 400 for equipment fault analysis is provided. The apparatus 400 includes: a first acquisition device 402, a second acquisition module 412, a first detection module 406, a second detection module 416, a first output module 408, a second output module 418, a first adjustment module 410, a second adjustment module 420, a determination module 422, and a fault diagnosis output module 424.

[0097] The first acquisition module 402 is used to acquire first data from the device. The second acquisition module 412 is used to acquire second data from the device. The first detection module 406 is used to detect the first data and determine a first state event. The second detection module 416 is used to acquire the second data and determine a second state event. The determination module 422 is used to determine the correlation between the first state event and the second state event, and determine the state of the device based on the correlation. Through this technical solution, accurate acquisition of device state information can be ensured by comprehensively and intelligently analyzing data from multiple sources.

[0098] Optionally, the determining module 422 is used to determine that the first state event and the second state event are related, including: determining that the interval between the time points of the occurrence of the first state event and the time points of the occurrence of the second state event is less than a first threshold. When the time interval between the occurrences of two state events is close, it can be said that the two state events are temporally related.

[0099] Optionally, the determining module 422 is used to determine that the first state event and the second state event are related, including: determining that the semantic category of the first state event and the semantic category of the second state event are the same. When the two state events are the same type of state event, it indicates that the occurrence of the state event is proven from two data sources, which can more accurately confirm the state of the device.

[0100] Optionally, the determining module 422 is used to determine that the first state event and the second state event are correlated, including determining that the first state event and the second state event are causally related. There is a causal relationship between the state events of the device; for example, the temperature rise of the processor in the device is causally related to the fan speed in the device. When the fan speed is low, the processor temperature will rise. Therefore, by diagnosing the rise in processor temperature, the low fan speed of the device can be diagnosed, further determining a fan failure.

[0101] Optionally, the first acquisition module 402 is further configured to acquire third data from the device; the second acquisition module 412 is further configured to acquire fourth data from the device; the first detection module 406 is further configured to detect the third data and determine the third state event, and the first output module 408 outputs the result to the determination module 422; the second detection module 416 is further configured to acquire the fourth data and determine the fourth state event, and the second output module 418 outputs the result to the determination module 422; the determination module 422 is further configured to determine that the third state event and the fourth state event are not related.

[0102] Optionally, the device further includes: a first adjustment module 410 and a second adjustment module 420; the first adjustment module 410 is used to adjust the first detection parameter of the first detection module 406, and the second adjustment module 420 is used to adjust the second detection parameter of the second detection module 416; the first detection module 406 is also used to detect third data and determine a fifth state event based on the adjusted first detection parameters; the second detection module 416 is also used to detect fourth data and determine a sixth state event based on the adjusted second detection parameters; the determination module 422 is also used to determine that the fifth state event and the sixth state event are correlated. By adjusting the detection parameters, a more accurate detection model can be obtained, thus enabling a more accurate determination of the device's state.

[0103] Optionally, the determining module 422 is further configured to determine that the fifth state event and the sixth state event are related, including: determining that the interval between the time point of occurrence of the fifth state event and the time point of occurrence of the sixth state event is less than a first threshold.

[0104] Optionally, the determining module 422 is also used to determine that the fifth state event and the sixth state event are related, including: determining that the semantic category of the fifth state event and the semantic category of the sixth state event are the same.

[0105] Optionally, the determining module 422 is also used to determine that the fifth state event and the sixth state event are related, including: determining that the fifth state event and the sixth state event are causally related.

[0106] Optionally, the first detection parameter includes: a second threshold for the frequency of occurrence of the semantic category of the third state event or a third threshold for the dispersion of the fourth data; the second detection parameter includes: a fourth threshold for the frequency of occurrence of the semantic category of the third state event or a fifth threshold for the dispersion of the fourth data.

[0107] Optionally, after the determination module 422 completes the fault diagnosis of the equipment, the final fault diagnosis result is output through the fault diagnosis output module 424 to complete the fault diagnosis process of the equipment.

[0108] The hardware structure of the fault analysis device described in the embodiments of the present invention can be achieved through, for example... Figure 5 The device 500 shown is used to achieve this. Figure 5 As shown, the device 500 includes a processor 502, a memory 504, a communication interface 506, and a bus 508. The processor 502, memory 504, and communication interface 506 are interconnected via the bus 508.

[0109] The processor 502 is the control center of the device 500, used to execute relevant programs to implement the technical solutions provided in the embodiments of the present invention. The processor 502 may be a general-purpose central processing unit, a microprocessor, an application-specific integrated circuit, or one or more integrated circuits, used to execute relevant programs to implement the technical solutions provided in the embodiments of the present invention.

[0110] The memory 504 can be a read-only memory, a static storage device, a dynamic storage device, or a random access memory. When the technical solutions provided in the embodiments of the present invention are implemented through software or firmware, the program code used to implement the technical solutions provided in the embodiments of the present invention is stored in the memory 504 and executed by the processor 502. The memory 504 can be integrated with the processor 502 or integrated within the processor 502, or it can be one or more memory units independent of the processor 502.

[0111] The communication interface 506 uses transceiver devices, such as, but not limited to, transceivers, to enable communication between the device 500 and other devices or communication networks.

[0112] Bus 508 may include one or more lines for transmitting information between various components of device 500 (e.g., processor 502, memory 504, and communication interface 506).

[0113] It should be noted that, although Figure 5The illustrated device 500 only shows the processor 502, memory 504, communication interface 506, and bus 508. However, in specific implementations, those skilled in the art should understand that device 500 may also include other devices necessary for normal operation. Furthermore, depending on specific needs, those skilled in the art should understand that device 500 may also include hardware devices for implementing other additional functions. Moreover, those skilled in the art should understand that device 500 may only include the devices necessary for implementing the embodiments of the present invention, and may not necessarily include... Figure 5 All the devices shown.

[0114] Figure 5 The hardware structure shown and the above description are applicable to the fault analysis device provided in the embodiments of the present invention, and are applicable to performing various fault analysis methods provided in the embodiments of the present invention.

[0115] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative. For instance, the division of modules is only a logical functional division, and there may be other division methods in implementation. For example, multiple modules may be combined or integrated into another system, or some features may be ignored or not executed.

[0116] Furthermore, the functional modules in the various embodiments of the present invention can be integrated into one processing module, or each module can exist physically separately, or two or more modules can be integrated into one module. The integrated module can be implemented in hardware or in the form of hardware plus software functional modules.

[0117] The integrated modules described above, implemented as software functional modules, can be stored in a computer-readable storage medium. These software functional modules, stored in a storage medium, include several instructions to cause a computer device (which may be a personal computer, a server, or a network device, etc.) to execute some steps of the methods described in the various embodiments of the present invention.

[0118] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them; although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the corresponding technical solutions to depart from the scope of the claims.

Claims

1. A method for analyzing the state of equipment, characterized in that, include: Acquire first data and second data indicating the status of the device, wherein the first data is key performance indicator (KPI) data and the second data is log data; Based on the first data, the first state event is obtained through the KPI anomaly detection model; Based on the second data, a second state event is obtained through a log anomaly detection model; wherein the first state event and the second state event are correlated. The status of the device is determined based on the aforementioned association; Using the correlation analysis results of the first state event and the second state event, adjust the first detection parameter of the KPI anomaly detection model and / or the second detection parameter of the log anomaly detection model; wherein, the first detection parameter includes the anomaly alarm threshold of the KPI anomaly detection model, and the second detection parameter includes the weight of the log template in the log anomaly detection model; The method further includes: Acquire third and fourth data indicating the state of the device; The third state event is obtained based on the third data; The fourth state event is obtained based on the fourth data; wherein the third state event and the fourth state event are not related. Adjust the first detection parameter related to the third data, detect the third data, and obtain the fifth state event; the first detection parameter includes: a second threshold for the frequency of occurrence of the semantic category of the third state event or a third threshold for the discreteness of the fourth data; Adjust the second detection parameter related to the fourth data, detect the fourth data, and obtain the sixth state event; the second detection parameter includes: a fourth threshold for the frequency of occurrence of the semantic category of the third state event or a fifth threshold for the discreteness of the fourth data; The fifth state event and the sixth state event have the aforementioned association relationship.

2. The method according to claim 1, characterized in that, The first state event and the second state event have the aforementioned correlation relationship, including: the interval between the time point of occurrence of the first state event and the time point of occurrence of the second state event is less than a first threshold.

3. The method according to claim 1 or 2, characterized in that, The first state event and the second state event have the aforementioned association relationship, including: the semantic category of the first state event and the semantic category of the second state event are the same.

4. The method according to claim 1 or 2, characterized in that, The first state event and the second state event have the aforementioned association relationship, including: the first state event and the second state event have a causal relationship.

5. The method according to claim 1, characterized in that, The correlation between the fifth state event and the sixth state event includes: the interval between the time point of occurrence of the fifth state event and the time point of occurrence of the sixth state event is less than a first threshold.

6. The method according to claim 5, characterized in that, The association between the fifth state event and the sixth state event also includes the fact that the semantic category of the fifth state event and the semantic category of the sixth state event are the same.

7. The method according to any one of claims 5, characterized in that, The fifth state event and the sixth state event have the aforementioned correlation relationship, which also includes: the fifth state event and the sixth state event have a causal relationship.

8. An apparatus for equipment fault analysis, characterized in that, The device includes: a first acquisition module and a second acquisition module, a first detection module and a second detection module, and a determination module; The first acquisition module is used to acquire the first data of the device; The second acquisition module is used to acquire the second data of the device, wherein the first data is key performance indicator (KPI) data and the second data is log data; The first detection module is used to detect the first data and determine the first state event through the KPI anomaly detection model; The second detection module is used to acquire the second data and determine the second state event through the log anomaly detection model; The determining module is used to determine that the first state event and the second state event are associated, and to determine the state of the device based on the association. The determining module is further configured to use the correlation analysis results of the first state event and the second state event to adjust the first detection parameter of the KPI anomaly detection model and / or the second detection parameter of the log anomaly detection model; wherein, the first detection parameter includes the anomaly alarm threshold of the KPI anomaly detection model, and the second detection parameter includes the weight of the log template in the log anomaly detection model; The first acquisition module is further configured to acquire third data from the device; The second acquisition module is further configured to acquire fourth data of the device; The first detection module is also used to detect the third data and determine the third state event; The second detection module is also used to acquire the fourth data and determine the fourth state event; The determining module is also used to determine that the third state event and the fourth state event are not related; The device further includes: a first adjustment module and a second adjustment module; The first adjustment module is used to adjust the first detection parameter of the first detection module, and the second adjustment module is used to adjust the second detection parameter of the second detection module; The first detection module is also used to detect the third data and determine the fifth state event based on the adjusted first detection parameters; the first detection parameters include: a second threshold for the frequency of occurrence of the semantic category of the third state event or a third threshold for the degree of dispersion of the fourth data; The second detection module is also used to detect the fourth data and determine the sixth state event according to the adjusted second detection parameters; the second detection parameters include: a fourth threshold for the frequency of occurrence of the semantic category of the third state event or a fifth threshold for the discreteness of the fourth data; The determining module is also used to determine that the fifth state event and the sixth state event are related.

9. The apparatus according to claim 8, characterized in that, The determining module is used to determine that the first state event and the second state event are related, including: determining that the interval between the time point of the occurrence of the first state event and the time point of the occurrence of the second state event is less than a first threshold.

10. The apparatus according to claim 8 or 9, characterized in that, The determining module is used to determine that the first state event and the second state event are associated, including: determining that the semantic category of the first state event and the semantic category of the second state event are the same.

11. The apparatus according to any one of claims 8 or 9, characterized in that, The determining module is used to determine that the first state event and the second state event are related, including: determining that the first state event and the second state event are causally related.

12. The apparatus according to claim 8, characterized in that, The determining module is further configured to determine that the fifth state event and the sixth state event are related, including: determining that the interval between the time point of occurrence of the fifth state event and the time point of occurrence of the sixth state event is less than a first threshold.

13. The apparatus according to claim 12, characterized in that, The determining module is further configured to determine that the fifth state event and the sixth state event are associated, including: determining that the semantic category of the fifth state event and the semantic category of the sixth state event are the same.

14. The apparatus according to any one of claims 12, characterized in that, The determining module is further configured to determine that the fifth state event and the sixth state event are related, including: determining that the fifth state event and the sixth state event are causally related.

15. A computer device, characterized in that, It includes at least one memory and at least one processor, wherein the at least one memory is used to store computer instructions; When the at least one processor executes the computer instructions, the computer device performs the method according to any one of claims 1 to 7.

16. A non-transient readable storage medium, characterized in that, The non-transient readable storage medium stores computer program code, which, when executed by a computer device, performs the method described in any one of claims 1 to 7.

Images