Abnormal influence detection method and device, computer device and storage medium

Abstract

The application relates to an abnormal influence detection method and device, computer equipment and a storage medium. The method comprises the following steps: when an abnormality of a system is detected, acquiring abnormality information, wherein the abnormality information comprises an abnormality occurrence time; taking a preset time period after the abnormality occurrence time as an abnormality time period, determining actual values of monitoring parameters corresponding to each to-be-monitored index according to index data of each to-be-monitored index in the abnormality time period; determining a reference time period from a historical monitoring time period corresponding to the abnormality time period, determining a confidence interval of the monitoring parameters corresponding to each to-be-monitored index according to index data of each to-be-monitored index in the reference time period; and obtaining an influence degree detection result of the abnormality on each to-be-monitored index according to the actual values of the monitoring parameters corresponding to each to-be-monitored index and the confidence interval of the monitoring parameters. The method can improve the objective universality of abnormal influence detection.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computers, and in particular to an abnormal influence detection method and device, a computer device, and a storage medium. BACKGROUND

[0002] A logistics system covers systems such as order placement, receiving, transfer, transportation, and delivery. If an abnormality occurs in the system, it may affect related downstream systems, user experience, and company revenue. For example, if an abnormality occurs in the order placement system, users cannot place orders, which may result in a loss of revenue. Therefore, when an abnormality occurs in the system, the influence of the abnormality on business needs to be detected, and the system needs to be optimized and improved.

[0003] In traditional technology, after an abnormality occurs in the system, abnormal data is extracted by R&D or operation personnel, and the business influence caused by the system abnormality is analyzed by business personnel. However, the traditional method relies on human analysis and is influenced by subjective factors, and lacks objective and universal evaluation criteria. SUMMARY

[0004] Therefore, it is necessary to provide an abnormal influence detection method, device, computer device, and storage medium that can improve the objectivity and universality.

[0005] An abnormal influence detection method, the method comprising:

[0006] When an abnormality in the system is detected, abnormal information is obtained, and the abnormal information includes an abnormal occurrence time;

[0007] A preset time period after the abnormal occurrence time is set as an abnormal time period, and actual values of monitoring parameters corresponding to each of the to-be-monitored indicators are determined according to index data of each of the to-be-monitored indicators in the abnormal time period;

[0008] A reference time period is determined from a historical monitoring time period corresponding to the abnormal time period, and a confidence interval of the monitoring parameters corresponding to each of the to-be-monitored indicators is determined according to index data of each of the to-be-monitored indicators in the reference time period;

[0009] According to the actual values of the monitoring parameters corresponding to each of the to-be-monitored indicators and the confidence interval of the monitoring parameters, an influence degree detection result of the abnormality on each of the to-be-monitored indicators is obtained.

[0010] An abnormal influence detection device, the device comprising:

[0011] An acquisition module configured to, when an abnormality in the system is detected, acquire abnormal information, and the abnormal information includes an abnormal occurrence time;

[0012] An actual value determining module is configured to determine, as an abnormal period, a preset time period after the abnormal occurrence time, and determine, according to index data of each to-be-monitored index in the abnormal period, an actual value of a monitoring parameter corresponding to each to-be-monitored index.

[0013] A confidence interval determining module is configured to determine, from a historical monitoring period corresponding to the abnormal period, a reference period, and determine, according to index data of each to-be-monitored index in the reference period, a monitoring parameter confidence interval corresponding to each to-be-monitored index.

[0014] A detecting module is configured to obtain, according to the actual value of the monitoring parameter corresponding to each to-be-monitored index and the monitoring parameter confidence interval, an influence degree detection result of the abnormality on each to-be-monitored index.

[0015] A computer device includes a memory and a processor, the memory stores a computer program, and the processor implements the following steps when executing the computer program:

[0016] When an abnormality of a system is monitored, abnormality information is acquired, and the abnormality information includes an abnormal occurrence time;

[0017] A preset time period after the abnormal occurrence time is determined as an abnormal period, and an actual value of a monitoring parameter corresponding to each to-be-monitored index is determined according to index data of each to-be-monitored index in the abnormal period;

[0018] A reference period is determined from a historical monitoring period corresponding to the abnormal period, and a monitoring parameter confidence interval corresponding to each to-be-monitored index is determined according to index data of each to-be-monitored index in the reference period;

[0019] An influence degree detection result of the abnormality on each to-be-monitored index is obtained according to the actual value of the monitoring parameter corresponding to each to-be-monitored index and the monitoring parameter confidence interval.

[0020] A computer readable storage medium stores a computer program, and the computer program is executed by a processor to implement the following steps:

[0021] When an abnormality of a system is monitored, abnormality information is acquired, and the abnormality information includes an abnormal occurrence time;

[0022] A preset time period after the abnormal occurrence time is determined as an abnormal period, and an actual value of a monitoring parameter corresponding to each to-be-monitored index is determined according to index data of each to-be-monitored index in the abnormal period;

[0023] A reference period is determined from a historical monitoring period corresponding to the abnormal period, and a monitoring parameter confidence interval corresponding to each to-be-monitored index is determined according to index data of each to-be-monitored index in the reference period;

[0024] Based on the actual values ​​of the monitoring parameters and the confidence intervals of the monitoring parameters corresponding to each of the monitored indicators, the detection results of the degree of impact of the anomaly on each of the monitored indicators are obtained.

[0025] The aforementioned anomaly detection method, device, computer equipment, and storage medium, when a system anomaly occurs, determine the actual value of the monitoring parameter corresponding to each monitored indicator based on the indicator data of each monitored indicator during the anomaly period, and determine the confidence interval of the monitoring parameter corresponding to each monitored indicator based on the indicator data of each monitored indicator during the reference period. Using the confidence interval of the monitoring parameter as an objective reference interval, the degree of impact of the anomaly on each monitored indicator is detected. It has objective universality, reduces the influence of human subjectivity, and helps to strengthen the control of system anomalies. Attached Figure Description

[0026] Figure 1 This is a flowchart illustrating an anomaly impact detection method in one embodiment;

[0027] Figure 2 This is a schematic diagram of anomaly detection results in one embodiment;

[0028] Figure 3 This is a schematic diagram illustrating the change in the upper limit of the confidence interval in one embodiment;

[0029] Figure 4 This is a flowchart illustrating an anomaly impact detection method in one embodiment;

[0030] Figure 5 This is a structural block diagram of an anomaly impact detection device in one embodiment;

[0031] Figure 6 This is an internal structural diagram of a computer device in one embodiment;

[0032] Figure 7 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0033] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0034] In one embodiment, such as Figure 1 As shown, an anomaly detection method is provided. This embodiment uses the application of this method to a server as an example for illustration. It can be understood that this method can also be applied to a terminal, and can also be applied to a system including a terminal and a server, and can be implemented through the interaction between the terminal and the server. In this embodiment, the method includes the following steps S102 to S108.

[0035] S102, when an exception is detected, the exception information is obtained, and the exception information includes the exception occurrence time.

[0036] The system can be set up with function burying points for recording exception related information, and when the system has an exception, the exception information is marked and stored. The system involved in this embodiment can cover various business systems, such as system A involving waybill number, system B involving order type, and other system C.

[0037] For example, system A records the processing status of each waybill, writes logs, and if the system A waybill call parameter calculates the freight, the call fails, the corresponding waybill number, system id, time, status and other information are recorded, and the recorded information is stored in the corresponding table a under the database where the log is located. If system B fails to place an order, the corresponding system id, time, status and other information are stored in the corresponding table b under the database where the log is located. If system C fails to access, the corresponding system id, time, status and other information are stored in the corresponding table c under the database where the log is located.

[0038] The system can be determined whether an exception has occurred by monitoring whether there is new exception data in the stored data of various system logs in real time, and when new exception data is detected, it is considered that the system has an exception, the corresponding exception information is obtained, and the exception information includes the exception occurrence time, i.e. the exception event occurrence time recorded in the log.

[0039] S104, the preset time period after the exception occurrence time is taken as the exception period, and the actual value of the monitoring parameter corresponding to each to-be-monitored index is determined according to the index data of each to-be-monitored index in the exception period.

[0040] The exception period can be understood as the period affected by the exception, and the preset time period after the exception occurrence time is taken as the exception period, wherein the preset time period can be set according to actual needs, for example, 30 minutes, 1 hour, 24 hours, etc., which is not limited here. It should be noted that multiple preset time periods can be set, and detection is performed at each preset time period to refine the exception impact in different time dimensions. For example, if the order system is abnormal at a certain time point, the user may not send the package later, or it may cause user loss, so the exception impact is refined in different time dimensions.

[0041] The to-be-monitored indicators can cover all possible business indicator ranges that can be affected, including but not limited to time efficiency type, customer complaint type, income type, and system type indicators. For example, the time efficiency type indicators include commitment achievement rate, time consumption, urging rate, and late rate, the customer complaint type indicators include complaint rate and claim rate, the income type indicators include freight income, order quantity, and order average price, and the system type indicators include load rate, call volume, user volume, and access time consumption. In an embodiment, the indicator library can be developed and maintained, the latest values of each to-be-monitored indicator in each dimension are calculated, and incremental updates are retained to the indicator library (for example, the time efficiency type indicators can be divided into indicator data under each week / day / hour / minute, and some indicators have a lag, for example, claims are usually made after a period of time after the user receives the package, and the data can be incrementally updated).

[0042] The indicator data of the to-be-monitored indicators are indicator values of the to-be-monitored indicators, and the monitoring parameters corresponding to the to-be-monitored indicators are parameters related to the indicator values, for example, the indicator values or the change rates of the indicator values. The actual values of the monitoring parameters corresponding to the to-be-monitored indicators can be understood as the values of the monitoring parameters corresponding to the to-be-monitored indicators under abnormal influence.

[0043] S106, determining a reference period from the historical monitoring period corresponding to the abnormal period, and determining the monitoring parameter confidence interval corresponding to each to-be-monitored indicator according to the indicator data of each to-be-monitored indicator in the reference period.

[0044] The reference period can be understood as a historical same period corresponding to the abnormal period, and the relative period can be but is not limited to one day, one week, one month, etc. For example, assuming that the abnormal occurrence time is Monday 10:00 of the 21st week of 2020, the preset period is 1 hour, the abnormal period is 2020-21st week-Monday 10:00-11:00, assuming that the relative period is 1 week, the historical monitoring period corresponding to the abnormal period is 2020-nth week-Monday 10:00-11:00, n is less than 21, and the reference period can be any one or more monitoring periods selected from the above historical monitoring period. The monitoring parameter confidence interval corresponding to the to-be-monitored indicators can be understood as the normal fluctuation interval of the monitoring parameters corresponding to the to-be-monitored indicators.

[0045] S108, obtaining the influence degree detection result of the abnormality on each to-be-monitored indicator according to the actual values of the monitoring parameters corresponding to each to-be-monitored indicator and the monitoring parameter confidence interval.

[0046] In an embodiment, if the actual value of the monitoring parameter corresponding to a to-be-monitored indicator is within the monitoring parameter confidence interval, it can be considered that the abnormal influence on the to-be-monitored indicator is negligible. If the actual value of the monitoring parameter corresponding to a to-be-monitored indicator is not within the monitoring parameter confidence interval, for example, greater than the upper limit value in the confidence interval or less than the lower limit value in the confidence interval, it can be considered that the to-be-monitored indicator is affected by a certain abnormality.

[0047] In the abnormal influence detection method, when the system is abnormal, the actual value of the monitoring parameter corresponding to each to-be-monitored index is determined according to the index data of each to-be-monitored index in the abnormal period, the confidence interval of the monitoring parameter corresponding to each to-be-monitored index is determined according to the index data of each to-be-monitored index in the reference period, and the confidence interval of the monitoring parameter is used as an objective reference interval to detect the influence degree of the abnormality on each to-be-monitored index, which has objective universality, reduces human subjective influence, and helps to strengthen the management and control of system abnormalities.

[0048] In one embodiment, the step of determining the actual value of the monitoring parameter corresponding to each to-be-monitored index according to the index data of each to-be-monitored index in the abnormal period can specifically include: for any to-be-monitored index, obtaining an abnormal change rate of the to-be-monitored index according to the index data of the to-be-monitored index in the abnormal period and in the last monitoring period corresponding to the abnormal period, as the actual value of the monitoring parameter corresponding to the to-be-monitored index.

[0049] In the foregoing example, the abnormal period is 2020-21st week-Monday 10:00-11:00, and the relative period is 1 week, so the last monitoring period corresponding to the abnormal period is 2020-20th week-Monday 10:00-11:00. The abnormal change rate of the to-be-monitored index is the change rate of the index data of the to-be-monitored index in the abnormal period relative to the index data of the to-be-monitored index in the last monitoring period corresponding to the abnormal period. For example, assuming that the to-be-monitored index is the order quantity, the corresponding monitoring parameter is the order quantity change rate, and the order quantity in the abnormal period is D 21 , the order quantity in the last monitoring period corresponding to the abnormal period is D 20 , and the abnormal change rate (E 21 ) of the corresponding order quantity can be calculated by the following formula: E 21 =abs[(D 21 / D 20 )-1], wherein abs represents the absolute value function.

[0050] In one embodiment, the step of determining the reference period from the historical monitoring period corresponding to the abnormal period can specifically include: selecting continuous historical monitoring periods from the historical monitoring period corresponding to the abnormal period as the reference period. The step of determining the confidence interval of the monitoring parameter corresponding to each to-be-monitored index according to the index data of each to-be-monitored index in the reference period can specifically include: for any to-be-monitored index, obtaining a reference change rate of the to-be-monitored index according to the index data of the to-be-monitored index in two adjacent reference periods, and determining the confidence interval of the monitoring parameter corresponding to the to-be-monitored index according to each reference change rate.

[0051] For example, in the foregoing example, the abnormal period is 2020-21st week-Monday 10:00-11:00, the relative period is 1 week, the historical monitoring period corresponding to the abnormal period is 2020-nth week-Monday 10:00-11:00, n is less than 21, and the reference period can be selected as 2020-mth week-Monday 10:00-11:00, where m includes a continuous preset number of integers, for example, 20, 19, 18, …, 11, 10, and the reference period includes: 2020-20th week-Monday 10:00-11:00, 2020-19th week-Monday 10:00-11:00, 2020-18th week-Monday 10:00-11:00, …, 2020-11th week-Monday 10:00-11:00, and 2020-10th week-Monday 10:00-11:00.

[0052] The reference change rate of the to-be-monitored index is the change rate of the index data of the to-be-monitored index in adjacent two reference periods. For example, it is assumed that the to-be-monitored index is the order quantity, the corresponding monitoring parameter is the order quantity change rate, and 11 continuous reference periods (10th-20th week) are selected as described in the foregoing example. The corresponding order quantity is D 10 ~D 20 The reference change rate (E T ) of the order quantity can be calculated by the following formula: E T = abs[(D T / D T-1 )-1], where abs represents an absolute value function, and T is an integer in 11-20. Thus, 10 reference change rates can be obtained according to the order quantity data in the above reference periods.

[0053] Since the historical value of the to-be-monitored index can be affected by holidays, peaks, activities, and the like, the corresponding change rate can be high or low. Therefore, the multiple reference change rates are processed to determine the monitoring parameter confidence interval corresponding to the to-be-monitored index.

[0054] In one embodiment, according to the reference change rates, the step of determining the monitoring parameter confidence interval corresponding to the to-be-monitored index can specifically include: performing outlier detection on a change rate sequence composed of the reference change rates to obtain an abnormal score corresponding to each reference change rate; taking the reference change rate corresponding to the abnormal score satisfying a preset requirement as a monitoring parameter reference value corresponding to the to-be-monitored index; and determining the monitoring parameter confidence interval corresponding to the to-be-monitored index according to the monitoring parameter reference value.

[0055] Outlier detection models (such as the Isolation Forest model) can be used to detect outliers in the reference rates of change. The rate of change sequence composed of various reference rates of change is input into the outlier detection model, and the model outputs an anomaly score for each reference rate of change. The anomaly score represents the probability that the reference rate of change is an outlier; the higher the anomaly score, the greater the probability that the reference rate of change is an outlier. Therefore, based on the anomaly scores of each reference rate of change, points with a high probability of being outliers can be removed from the reference rates of change, and points with a low probability of being outliers can be selected as reference values ​​for monitoring parameters to determine the confidence interval of the monitoring parameters.

[0056] In one embodiment, a preset quantile value is determined based on the outlier scores corresponding to each reference rate of change. When an outlier score is less than this preset quantile value, the outlier score is deemed to meet a preset requirement. Here, the preset quantile is a preset percentage, and its corresponding quantile value represents the proportion of all reference rates of change less than this preset quantile value. The preset quantile can be set according to actual needs, for example, it can be set to 60%, 70%, 80%, etc.

[0057] In other embodiments, the abnormal score that meets the preset requirements can also be determined in other ways, such as by setting a preset threshold. When the abnormal score is less than the preset threshold, it is determined that the abnormal score meets the preset requirements.

[0058] Understandably, when the reference change rate of a monitored metric reaches an outlier, it means that the corresponding metric data has become abnormal. For example, in the aforementioned example, the reference change rate E of order volume... 20 =abs[(D 20 / D 19 )-1], if E 20 This is an outlier, indicating that the order volume data for week 20 is abnormal. For example... Figure 2 As shown in the figure, an anomaly detection result is provided in one embodiment. The corresponding preset quantile is 70%. It can be seen from the figure that the index data after removing anomalies fluctuates less and can be used as an objective reference value.

[0059] In one embodiment, the step of determining the confidence interval of the monitoring parameter corresponding to the indicator to be monitored based on the reference values ​​of each monitoring parameter may specifically include: determining a preset number of monitoring parameter reference values; and obtaining the upper limit and lower limit of the confidence interval of the monitoring parameter corresponding to the indicator to be monitored based on the mean and standard deviation of the preset number of monitoring parameter reference values.

[0060] The preset number k can be set according to actual needs and is not limited here. After determining the k reference values ​​for monitoring parameters, the Kolmogorov-Smirnov test can be used to check whether these k reference values ​​satisfy the Student t-distribution. If they do, the confidence interval of the monitoring parameters can be calculated based on these k reference values, a significance factor alpha can be set, and the upper and lower limits of the confidence interval of the monitoring parameters can be calculated using the t-distribution.

[0061] Specifically, based on the k reference values ​​of the monitoring parameters, the mean (represented by x) and standard deviation (represented by σ) of the k reference values ​​of the monitoring parameters can be calculated. The formulas for calculating the upper limit (represented by U) and lower limit (L) of the confidence interval of the monitoring parameters can be as follows: U = x + v * σ, L = xv * σ, where v represents the t value corresponding to the t distribution with a confidence level of (1-alpha) and a degree of freedom of (k-1).

[0062] like Figure 3 As shown in the figure, a schematic diagram of the change of the upper limit value of the confidence interval obtained by different preset quantiles is provided in an embodiment. It can be seen from the figure that the smaller the preset quantile, the smaller the change rate of the corresponding upper limit value. This is because the smaller the preset quantile, the lower the probability of the selected monitoring parameter reference value being an anomaly point, and the smaller the fluctuation of the corresponding confidence interval.

[0063] In one embodiment, the step of obtaining the impact degree detection result of an anomaly on each monitored indicator based on the actual value of the monitoring parameter corresponding to each monitored indicator and the confidence interval of the monitoring parameter may specifically include: if the monitored indicator is a positive indicator, then when the actual value of the monitoring parameter corresponding to the monitored indicator is less than the lower limit of the confidence interval of the monitoring parameter, the difference between the lower limit of the confidence interval of the monitoring parameter and the actual value of the monitoring parameter is determined as the impact degree detection result of the anomaly on the monitored indicator; if the monitored indicator is a negative indicator, then when the actual value of the monitoring parameter corresponding to the monitored indicator is greater than the upper limit of the confidence interval of the monitoring parameter, the difference between the actual value of the monitoring parameter and the upper limit of the confidence interval of the monitoring parameter is determined as the impact degree detection result of the anomaly on the monitored indicator.

[0064] The positive index indicates that the higher the index value is, the more beneficial the index is to the business, such as order quantity, access quantity, etc. The negative index indicates that the lower the index value is, the more beneficial the index is to the business, such as the rate of urging, the rate of complaint, etc. For the positive index 1, assuming that the actual value of the corresponding monitoring parameter is V1, the upper limit value and the lower limit value of the confidence interval of the corresponding monitoring parameter are U1 and L1 respectively, and V1 is less than L1, then the influence degree of the abnormality on the positive index 1 is (L1-V1). For the negative index 2, assuming that the actual value of the corresponding monitoring parameter is V2, the upper limit value and the lower limit value of the confidence interval of the corresponding monitoring parameter are U2 and L2 respectively, and V2 is greater than L2, then the influence degree of the abnormality on the negative index 2 is (V2-U2). Accordingly, the influence degree of the abnormality on each to-be-monitored index can be detected by the above general calculation method.

[0065] In one embodiment, as shown in FIG. 1, Figure 4 an abnormality influence detection method is provided, comprising the following steps S401 to S407.

[0066] S401, when an abnormality of a system is monitored, abnormality information is obtained, and the abnormality information includes an abnormality occurrence time.

[0067] S402, a preset time period after the abnormality occurrence time is taken as an abnormality period, and an abnormal change rate of each to-be-monitored index is obtained according to the index data of each to-be-monitored index in the abnormality period and in the last monitoring period corresponding to the abnormality period, as an actual value of a monitoring parameter corresponding to each to-be-monitored index.

[0068] S403, from the historical monitoring periods corresponding to the abnormality period, a continuous historical monitoring period is selected as a reference period, and a reference change rate of each to-be-monitored index is obtained according to the index data of each to-be-monitored index in the adjacent two reference periods.

[0069] S404, an abnormal point detection is performed on a change rate sequence composed of the reference change rates of each to-be-monitored index, an abnormal score corresponding to each reference change rate is obtained, and the reference change rate corresponding to the abnormal score satisfying a preset requirement is taken as a reference value of the monitoring parameter corresponding to each to-be-monitored index.

[0070] S405, a preset number of reference values of the monitoring parameter are determined, and the upper limit value and the lower limit value of the confidence interval of the monitoring parameter corresponding to each to-be-monitored index are obtained according to the mean and the standard deviation of the preset number of reference values of the monitoring parameter.

[0071] S406, if the to-be-monitored index is a positive index, when the actual value of the monitoring parameter corresponding to the to-be-monitored index is less than the lower limit value of the confidence interval of the monitoring parameter, the difference between the lower limit value of the confidence interval of the monitoring parameter and the actual value of the monitoring parameter is determined as the influence degree detection result of the abnormality on the to-be-monitored index.

[0072] S407, if the to-be-monitored index is a negative index, when the actual value of the monitoring parameter corresponding to the to-be-monitored index is greater than the upper limit value of the confidence interval of the monitoring parameter, the difference between the actual value of the monitoring parameter and the upper limit value of the confidence interval of the monitoring parameter is determined as the influence degree detection result of the abnormality on the to-be-monitored index.

[0073] The specific description of steps S401-S407 can be referred to the foregoing embodiments, which will not be repeated here. In this embodiment, when the system has an abnormality, the listening program can capture the abnormality information at the preset buried point, and then perform the calculation to strengthen the management and control of the abnormal event. Through the abnormal point detection, the influence of the index noise can be eliminated, the confidence interval of the monitoring parameter is used as the objective reference value, the confidence is high, and the divergence between the R&D, operation and maintenance, and business personnel when the system has an abnormality or a fault can be reduced. Through the establishment of the index library and the real-time calculation of the index result, the influence of different system abnormalities on the business and the system itself can be calculated, various possible business or system indexes in the logistics field are covered, the human subjective influence is reduced, and the universality is good.

[0074] It should be understood that, although each step in each flowchart involved in the above embodiments is displayed in sequence according to the arrow, these steps are not necessarily executed in sequence according to the arrow. Unless otherwise specified herein, the execution of these steps has no strict sequence limitation, and these steps can be executed in other sequences. Moreover, at least part of the steps in each flowchart involved in the above embodiments can include multiple steps or multiple stages, which are not necessarily executed at the same time, but can be executed at different times, and the execution sequence of these steps or stages is not necessarily sequential, but can be executed in rotation or alternation with at least part of other steps or steps or stages in other steps.

[0075] In one embodiment, as shown in FIG. 5, Figure 5 An abnormality influence detection apparatus is provided, comprising: an acquisition module 510, an actual value determination module 520, a confidence interval determination module 530, and a detection module 540, wherein:

[0076] The acquisition module 510 is configured to acquire abnormality information when it is detected that the system has an abnormality, and the abnormality information includes an abnormality occurrence time.

[0077] The actual value determination module 520 is configured to determine the actual value of the monitoring parameter corresponding to each to-be-monitored index according to the index data of each to-be-monitored index in an abnormality period which is a preset time period after the abnormality occurrence time.

[0078] The confidence interval determination module 530 is configured to determine a reference period from the historical monitoring period corresponding to the abnormal period, and determine the monitoring parameter confidence interval corresponding to each to-be-monitored index according to the index data of each to-be-monitored index in the reference period.

[0079] The detection module 540 is configured to obtain an influence degree detection result of the abnormality on each to-be-monitored index according to the monitoring parameter actual value and the monitoring parameter confidence interval corresponding to each to-be-monitored index.

[0080] In one embodiment, the actual value determination module 520 is specifically configured to, when determining the monitoring parameter actual value corresponding to each to-be-monitored index according to the index data of each to-be-monitored index in the abnormal period, obtain an abnormal change rate of the to-be-monitored index according to the index data of the to-be-monitored index in the abnormal period and in the last monitoring period corresponding to the abnormal period, as the monitoring parameter actual value corresponding to the to-be-monitored index.

[0081] In one embodiment, the confidence interval determination module 530 is specifically configured to, when determining the reference period from the historical monitoring period corresponding to the abnormal period, select continuous historical monitoring periods from the historical monitoring period corresponding to the abnormal period as the reference period. The confidence interval determination module 530 is specifically configured to, when determining the monitoring parameter confidence interval corresponding to each to-be-monitored index according to the index data of each to-be-monitored index in the reference period, obtain a reference change rate of the to-be-monitored index according to the index data of the to-be-monitored index in two adjacent reference periods, and determine the monitoring parameter confidence interval corresponding to the to-be-monitored index according to each reference change rate.

[0082] In one embodiment, the confidence interval determination module 530 is specifically configured to, when determining the monitoring parameter confidence interval corresponding to the to-be-monitored index according to each reference change rate, perform outlier detection on a change rate sequence composed of each reference change rate to obtain an abnormal score corresponding to each reference change rate, take the reference change rate corresponding to the abnormal score satisfying a preset requirement as the monitoring parameter reference value corresponding to the to-be-monitored index, and determine the monitoring parameter confidence interval corresponding to the to-be-monitored index according to each monitoring parameter reference value.

[0083] In one embodiment, the confidence interval determination module 530 is further configured to determine a score value corresponding to a preset quantile according to the abnormal score corresponding to each reference change rate, and determine that the abnormal score satisfies the preset requirement when the abnormal score is less than the score value.

[0084] In an embodiment, the confidence interval determination module 530, when determining the monitoring parameter confidence interval corresponding to the to-be-monitored index according to the monitoring parameter reference values, is specifically configured to: determine a preset number of monitoring parameter reference values; and obtain the upper limit value and the lower limit value of the monitoring parameter confidence interval corresponding to the to-be-monitored index according to the mean and the standard deviation of the preset number of monitoring parameter reference values.

[0085] In an embodiment, the detection module 540, when obtaining the influence degree detection result of the anomaly on the to-be-monitored index according to the monitoring parameter actual value corresponding to each to-be-monitored index and the monitoring parameter confidence interval, is specifically configured to: if the to-be-monitored index is a positive index, when the monitoring parameter actual value corresponding to the to-be-monitored index is less than the lower limit value of the monitoring parameter confidence interval, determine the difference between the lower limit value of the monitoring parameter confidence interval and the monitoring parameter actual value as the influence degree detection result of the anomaly on the to-be-monitored index; or if the to-be-monitored index is a negative index, when the monitoring parameter actual value corresponding to the to-be-monitored index is greater than the upper limit value of the monitoring parameter confidence interval, determine the difference between the monitoring parameter actual value and the upper limit value of the monitoring parameter confidence interval as the influence degree detection result of the anomaly on the to-be-monitored index.

[0086] For specific limitations of the anomaly influence detection apparatus, refer to the limitations of the anomaly influence detection method in the foregoing, which will not be described herein again. Each module in the above anomaly influence detection apparatus can be realized by software, hardware, and combinations thereof, in whole or in part. Each module described above can be embedded in or independent of the processor in the computer device in hardware form, or can be stored in the memory in the computer device in software form, so as to be called and executed by the processor to perform the operations corresponding to each module.

[0087] In an embodiment, a computer device is provided, which can be a server, and an internal structure diagram thereof can be as shown in Figure 6 The computer device includes a processor, a memory, and a network interface connected through a system bus. The processor of the computer device is configured to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program, and a database. The internal memory provides an environment for the operating system and the computer program in the non-volatile storage medium to run. The network interface of the computer device is configured to communicate with an external terminal through a network connection. The computer program is executed by the processor to implement an anomaly influence detection method.

[0088] In an embodiment, a computer device is provided, which can be a terminal, and an internal structure diagram thereof can be as shown in Figure 7As shown. The computer device includes a processor, memory, communication interface, display screen, and input devices connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, carrier networks, NFC (Near Field Communication), or other technologies. When executed by the processor, the computer program implements an anomaly detection method. The display screen can be an LCD screen or an e-ink screen. The input devices can be a touch layer covering the display screen, buttons, a trackball, or a touchpad on the computer device's casing, or an external keyboard, touchpad, or mouse.

[0089] Those skilled in the art will understand that Figure 6 or Figure 7 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0090] In one embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the above-described method embodiments.

[0091] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the steps in the above method embodiments.

[0092] In one embodiment, a computer program product or computer program is provided, the computer program product or computer program including computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and executes the computer instructions, causing the computer device to perform the steps in the above method embodiments.

[0093] It should be understood that the terms "first," "second," etc., in the above embodiments are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Regarding the description of numerical ranges, the term "multiple" is understood to mean equal to or greater than two.

[0094] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a non-volatile computer readable storage medium, and when executed, can include the processes of the above-mentioned embodiment methods. Any reference to memory, storage, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory or optical memory. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration but not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM).

[0095] Any combination of the technical features of the above embodiments can be made. In order to make the description simple, all possible combinations of the technical features in the above embodiments are not described, but as long as the combination of the technical features does not exist, it should be considered as the scope of the present application.

[0096] The above embodiments only express several implementation manners of the present application, and the description is more specific and detailed, but it should not be understood as a limitation on the scope of the patent. It should be pointed out that for those skilled in the art, without departing from the concept of the present application, some modifications and improvements can be made, which are all within the protection scope of the present application. Therefore, the protection scope of the patent of the present application should be subject to the appended claims.

Claims

1. An abnormal influence detection method characterized by comprising: The method includes: When a system anomaly is detected, the anomaly information is obtained, including the time of the anomaly occurrence. The preset time period after the occurrence of the anomaly is taken as the anomaly period. Based on the indicator data of each indicator to be monitored within the anomaly period, the actual value of the monitoring parameter corresponding to each indicator to be monitored is determined. A reference period is determined from the historical monitoring periods corresponding to the abnormal period. Based on the indicator data of each indicator to be monitored within the reference period, the confidence interval of the monitoring parameters corresponding to each indicator to be monitored is determined. Based on the actual values ​​and confidence intervals of the monitoring parameters corresponding to each of the monitored indicators, the impact degree detection results of the anomaly on each of the monitored indicators are obtained. Specifically, based on the indicator data of each monitored indicator during the anomaly period, the actual values ​​of the monitoring parameters corresponding to each of the monitored indicators are determined, including: A preset time period following the occurrence of the anomaly is designated as the anomaly period. Based on the indicator data of each monitored indicator within the anomaly period and the previous monitoring period corresponding to the anomaly period, the abnormal change rate of each monitored indicator is obtained and used as the actual value of the monitoring parameter corresponding to each monitored indicator. The reference period is determined from the historical monitoring periods corresponding to the anomaly period, including: From the historical monitoring periods corresponding to the abnormal period, consecutive historical monitoring periods are selected as reference periods; based on the indicator data of each of the monitored indicators within two adjacent reference periods, the reference change rate of each monitored indicator is obtained; anomaly detection is performed on the change rate sequence composed of the reference change rates of each monitored indicator to obtain the anomaly score corresponding to each reference change rate; the reference change rate whose corresponding anomaly score meets the preset requirements is used as the monitoring parameter reference value corresponding to each monitored indicator; a preset number of monitoring parameter reference values ​​are determined, and based on the mean and standard deviation of the preset number of monitoring parameter reference values, the upper and lower limits of the confidence interval of the monitoring parameter corresponding to each monitored indicator are obtained; if the monitored indicator is a positive indicator, when the actual value of the monitoring parameter corresponding to the monitored indicator is less than the lower limit, the difference between the lower limit and the actual value of the monitoring parameter is determined as the detection result of the degree of influence of the anomaly on the monitored indicator; if the monitored indicator is a negative indicator, when the actual value of the monitoring parameter corresponding to the monitored indicator is greater than the upper limit, the difference between the actual value and the upper limit is determined as the detection result of the degree of influence of the anomaly on the monitored indicator.

2. The method according to claim 1, characterized in that, Based on the aforementioned reference rates of change, the confidence intervals for the monitoring parameters corresponding to the indicators to be monitored are determined, including: Anomaly detection is performed on the rate of change sequence composed of the reference rates of change to obtain the anomaly score corresponding to each reference rate of change. The reference rate of change of the corresponding abnormal score that meets the preset requirements is used as the reference value of the monitoring parameter corresponding to the indicator to be monitored. Based on the reference values ​​of each monitoring parameter, determine the confidence interval of the monitoring parameter corresponding to the indicator to be monitored.

3. The method according to claim 2, characterized in that, Also includes: Based on the abnormal scores corresponding to each of the reference change rates, the score value corresponding to the preset quantile is determined. When the abnormal score is less than the score value, it is determined that the abnormal score meets the preset requirements.

4. The method according to claim 2, characterized in that, Based on the reference values ​​of each monitoring parameter, determine the confidence interval of the monitoring parameter corresponding to the indicator to be monitored, including: Determine a preset number of reference values ​​for monitoring parameters; Based on the mean and standard deviation of the preset number of monitoring parameter reference values, the upper and lower limits of the confidence interval of the monitoring parameter corresponding to the indicator to be monitored are obtained.

5. The method according to any one of claims 1 to 4, characterized in that, Based on the actual values ​​of the monitoring parameters and the confidence intervals of the monitoring parameters corresponding to each of the monitored indicators, the impact degree detection results of the anomaly on each of the monitored indicators are obtained, including: If the indicator to be monitored is a positive indicator, then when the actual value of the monitoring parameter corresponding to the indicator to be monitored is less than the lower limit of the confidence interval of the monitoring parameter, the difference between the lower limit of the confidence interval of the monitoring parameter and the actual value of the monitoring parameter is determined as the detection result of the degree of influence of the anomaly on the indicator to be monitored. If the indicator to be monitored is a negative indicator, then when the actual value of the monitoring parameter corresponding to the indicator to be monitored is greater than the upper limit of the confidence interval of the monitoring parameter, the difference between the actual value of the monitoring parameter and the upper limit of the confidence interval of the monitoring parameter is determined as the detection result of the degree of influence of the anomaly on the indicator to be monitored.

6. An abnormal influence detection device, characterized in that, The device includes: The acquisition module is used to acquire exception information when an exception is detected in the system, and the exception information includes the time of the exception occurrence. The actual value determination module is used to take a preset period after the time of the anomaly as the abnormal period and determine the actual value of the monitoring parameter corresponding to each of the monitored indicators based on the indicator data of each monitored indicator within the abnormal period. The confidence interval determination module is used to determine a reference period from the historical monitoring period corresponding to the abnormal period, and to determine the confidence interval of the monitoring parameters corresponding to each of the monitored indicators based on the indicator data of each monitored indicator within the reference period. The detection module is used to obtain the detection result of the degree of impact of the anomaly on each of the monitored indicators based on the actual value of the monitoring parameter corresponding to each monitored indicator and the confidence interval of the monitoring parameter. Specifically, the actual value determination module, when determining the actual value of the monitoring parameter corresponding to each monitored indicator based on the indicator data of each monitored indicator during the abnormal period, is used for: A preset time period following the occurrence of the anomaly is designated as the anomaly period. Based on the indicator data of each monitored indicator within the anomaly period and the previous monitoring period corresponding to the anomaly period, the abnormal change rate of each monitored indicator is obtained and used as the actual value of the monitoring parameter corresponding to each monitored indicator. Specifically, when determining the reference period from the historical monitoring periods corresponding to the anomaly period, the confidence interval determination module is used for: From the historical monitoring periods corresponding to the abnormal period, a continuous historical monitoring period is selected as a reference period; when the confidence interval determination module determines the confidence interval of the monitoring parameters corresponding to each of the monitored indicators based on the indicator data of each of the monitored indicators within the reference period, it is specifically used for: Based on the indicator data of each of the monitored indicators within two adjacent reference time periods, a reference rate of change for each monitored indicator is obtained; anomaly detection is performed on the rate of change sequence composed of the reference rates of change of each monitored indicator to obtain anomaly scores corresponding to each reference rate of change; the reference rate of change whose anomaly scores meet preset requirements is used as the reference value of the monitoring parameter corresponding to each monitored indicator; a preset number of monitoring parameter reference values ​​are determined, and the upper and lower limits of the confidence interval of the monitoring parameter corresponding to each monitored indicator are obtained based on the mean and standard deviation of the preset number of monitoring parameter reference values; the detection module, based on the data of each monitored indicator within the specified time periods, obtains the reference rate of change for each monitored indicator within the specified time periods. When obtaining the impact detection results of the anomaly on each of the monitored indicators by using the actual values ​​of the monitoring parameters corresponding to the control indicators and the confidence intervals of the monitoring parameters, the specific use is as follows: if the monitored indicator is a positive indicator, then when the actual value of the monitoring parameter corresponding to the monitored indicator is less than the lower limit value, the difference between the lower limit value and the actual value of the monitoring parameter is determined as the impact detection result of the anomaly on the monitored indicator; if the monitored indicator is a negative indicator, then when the actual value of the monitoring parameter corresponding to the monitored indicator is greater than the upper limit value, the difference between the actual value of the monitoring parameter and the upper limit value is determined as the impact detection result of the anomaly on the monitored indicator.

7. The apparatus according to claim 6, characterized in that, When determining the confidence interval for the monitoring parameter corresponding to the monitored indicator based on each of the reference change rates, the confidence interval determination module is specifically used for: Anomaly detection is performed on the rate of change sequence composed of the reference rates of change to obtain the anomaly score corresponding to each reference rate of change; the reference rate of change whose anomaly score meets the preset requirements is used as the monitoring parameter reference value corresponding to the indicator to be monitored. Based on the reference values ​​of each monitoring parameter, determine the confidence interval of the monitoring parameter corresponding to the indicator to be monitored.

8. The apparatus according to claim 6, characterized in that, The confidence interval determination module is also used for: Based on the abnormal scores corresponding to each of the reference change rates, the score value corresponding to the preset quantile is determined. When the abnormal score is less than the score value, it is determined that the abnormal score meets the preset requirements.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 5.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 5.

Images