Anomaly analysis method, device, equipment and computer readable storage medium

Abstract

The application provides an anomaly analysis method, device and equipment and a computer readable storage medium. The method comprises: obtaining an anomaly index of a service to be analyzed; determining a plurality of factor indexes of the anomaly index based on an index factor disassembly rule of the service to be analyzed; respectively determining change information of the anomaly index and each factor index within a same time range; determining at least one candidate anomaly factor index and an anomaly weight of each candidate anomaly factor index based on the change information of the anomaly index and each factor index within the time range; determining at least one anomaly factor index from the at least one candidate anomaly factor index based on the anomaly weight of the at least one candidate anomaly factor index; and performing multi-dimensional drilling analysis on the anomaly factor index based on a dimension list to be analyzed for each anomaly factor index to obtain an anomaly root cause result of the anomaly index. The application can improve the accuracy and positioning efficiency of anomaly index root cause positioning.

Description

Technical Field

[0001] This application relates to, but is not limited to, the field of information technology, and in particular to an anomaly analysis method, apparatus, device, and computer-readable storage medium. Background Technology

[0002] When analyzing business operations, it's typically crucial to focus on abnormal fluctuations in various business metrics, particularly key performance indicators (KPIs), to identify the root causes. Related technologies can employ multi-dimensional analysis of abnormal business metrics to pinpoint their root causes. However, this multi-dimensional analysis often involves assessing whether a business metric is abnormal across different dimensions to identify the root cause. This approach only considers the impact of a single dimension on the business, neglecting the interrelationships across multiple dimensions, resulting in relatively low accuracy in root cause identification. Summary of the Invention

[0003] This application provides an anomaly analysis method, apparatus, device, and computer-readable storage medium, which can improve the accuracy of root cause localization of business anomaly indicators and greatly shorten the time for anomaly root cause localization.

[0004] The technical solution of this application embodiment is implemented as follows:

[0005] This application provides an anomaly analysis method, including:

[0006] Obtain abnormal indicators for the business to be analyzed;

[0007] Based on the indicator factor decomposition rules of the business to be analyzed, multiple factor indicators of the abnormal indicators are determined.

[0008] The changes in the abnormal indicators and each of the factor indicators within the same time range are determined respectively.

[0009] Based on the change information of the abnormal indicators within the time range, and the change information of each factor indicator within the time range, at least one candidate abnormal factor indicator and the abnormal weight of each candidate abnormal factor indicator are determined.

[0010] Based on the abnormal weights of the at least one candidate abnormal factor index, at least one abnormal factor index is determined from the at least one candidate abnormal factor index.

[0011] For each anomalous factor indicator, based on the list of dimensions to be analyzed, a multi-dimensional drill-down analysis is performed on the anomalous factor indicator to obtain the root cause results of the anomalous indicator.

[0012] In some embodiments, the change information includes a change trend and a change amount. The step of determining at least one candidate abnormal factor indicator and the abnormal weight of each candidate abnormal factor indicator based on the change information of the abnormal indicator within the time range and the change information of each factor indicator within the time range includes: determining at least one candidate abnormal factor indicator from the plurality of factor indicators that has the same change trend as the abnormal indicator, based on the change trend of the abnormal indicator within the time range and the change trend of each factor indicator within the time range; and determining the abnormal weight of each candidate abnormal factor indicator based on the change amount of each candidate abnormal factor indicator within the time range.

[0013] In some embodiments, determining the abnormal weight of each candidate abnormal factor indicator based on the amount of change of each candidate abnormal factor indicator within the time range includes: summing the amount of change of each candidate abnormal factor indicator within the time range to obtain the total abnormal change; and determining the proportion of the amount of change of the candidate abnormal factor indicator within the time range in the total abnormal change as the abnormal weight of the candidate abnormal factor indicator for each candidate abnormal factor indicator.

[0014] In some embodiments, the method further includes: when it is determined that the abnormal indicator is not decomposable according to the indicator factor decomposition rule, determining at least one associated indicator associated with the abnormal indicator according to the indicator association rule of the business to be analyzed; and determining the abnormal root cause result of the abnormal indicator from the at least one associated indicator according to the association type between each associated indicator and the abnormal indicator and the change trend of each associated indicator within the time range.

[0015] In some embodiments, the abnormal root cause result includes at least one abnormal correlation indicator. Determining the abnormal root cause result of the abnormal indicator from the at least one correlation indicator based on the correlation type between each correlation indicator and the abnormal indicator, and the changing trend of each correlation indicator within the time range, includes: for each of the at least one correlation indicator, if the correlation type between the correlation indicator and the abnormal indicator, and the changing trend of the correlation indicator within the time range, satisfy a specific condition, determining the correlation indicator as an abnormal correlation indicator; wherein the specific condition includes one of the following: the correlation type between the correlation indicator and the abnormal indicator is positive, and the changing trends of the correlation indicator and the abnormal indicator are the same within the time range; the correlation type between the correlation indicator and the abnormal indicator is negative, and the changing trends of the correlation indicator and the abnormal indicator are opposite within the time range.

[0016] In some embodiments, the root cause results of anomalies include combinations of anomalies and the anomalous dimension values ​​of each anomaly dimension in the combination of anomalies. The step of performing multi-dimensional drill-down analysis on the anomaly factor indicators based on the list of dimensions to be analyzed to obtain the root cause results of the anomalies includes: determining at least one anomaly dimension from the dimension list based on the uniformity of change of the anomaly factor indicators under each dimension of the dimension list within the time range; for each anomaly dimension, determining the anomaly weight corresponding to each dimension value of the anomaly dimension based on the change information of the anomaly factor indicators under each dimension value of the anomaly dimension within the time range; determining the anomaly dimension value of each anomaly dimension based on the anomaly weight corresponding to each dimension value in each anomaly dimension, and adding each anomaly dimension to the combination of anomalies.

[0017] In some embodiments, the step of performing multi-dimensional drill-down analysis on the abnormal factor indicators based on the list of dimensions to be analyzed to obtain the abnormal root cause results of the abnormal indicators further includes: determining the cumulative abnormal weight corresponding to the abnormal dimension combination; if the cumulative abnormal weight is greater than a weight threshold, excluding each of the abnormal dimensions from the dimension list to obtain an updated dimension list; determining at least one abnormal dimension from the dimension list based on the uniformity of change of the abnormal factor indicators under each dimension of the updated dimension list within the time range; for each of the at least one abnormal dimension, determining the abnormal weight corresponding to each dimension value of the abnormal dimension based on the change information of the abnormal factor indicators under each dimension value of the abnormal dimension within the time range and the cumulative abnormal weight; determining the abnormal dimension value of each of the abnormal dimensions based on the abnormal weight corresponding to each dimension value of each of the abnormal dimensions, and adding each of the abnormal dimensions to the abnormal dimension combination.

[0018] This application provides an anomaly analysis device, including:

[0019] The acquisition module is used to acquire abnormal indicators of the business to be analyzed;

[0020] The first determining module is used to determine multiple factor indicators of the abnormal indicator based on the indicator factor decomposition rules of the business to be analyzed.

[0021] The second determining module is used to determine the change information of the abnormal indicators and each of the factor indicators within the same time range;

[0022] The third determining module is used to determine at least one candidate abnormal factor indicator and the abnormal weight of each candidate abnormal factor indicator based on the change information of the abnormal indicator within the time range and the change information of each factor indicator within the time range.

[0023] The fourth determining module is used to determine at least one abnormal factor indicator from the at least one candidate abnormal factor indicator based on the abnormal weight of the at least one candidate abnormal factor indicator.

[0024] The drill-down analysis module is used to perform multi-dimensional drill-down analysis on each abnormal factor indicator based on the list of dimensions to be analyzed, so as to obtain the abnormal root cause results of the abnormal indicator.

[0025] In some embodiments, the change information includes a change trend and a change amount, and the third determining module is further configured to: determine at least one candidate abnormal factor indicator with the same change trend as the abnormal indicator from the plurality of factor indicators based on the change trend of the abnormal indicator within the time range and the change trend of each factor indicator within the time range; and determine the abnormal weight of each candidate abnormal factor indicator based on the change amount of each candidate abnormal factor indicator within the time range.

[0026] In some embodiments, the third determining module is further configured to: sum the changes of each candidate abnormal factor indicator within the time range to obtain the total abnormal changes; and for each candidate abnormal factor indicator, determine the proportion of the changes of the candidate abnormal factor indicator within the time range in the total abnormal changes as the abnormal weight of the candidate abnormal factor indicator.

[0027] In some embodiments, the apparatus further includes: a fifth determining module, configured to determine at least one associated indicator associated with the abnormal indicator according to the indicator association rules of the business to be analyzed when the abnormal indicator is determined to be indivisible according to the indicator factor decomposition rules; and a sixth determining module, configured to determine the abnormal root cause result of the abnormal indicator from the at least one associated indicator according to the association type between each associated indicator and the abnormal indicator and the change trend of each associated indicator within the time range.

[0028] In some embodiments, the abnormal root cause result includes at least one abnormal correlation indicator, and the sixth determining module is further configured to: for each of the at least one correlation indicator, if the correlation type between the correlation indicator and the abnormal indicator and the change trend of the correlation indicator within the time range meet specific conditions, determine the correlation indicator as an abnormal correlation indicator; wherein, the specific conditions include one of the following: the correlation type between the correlation indicator and the abnormal indicator is positive, and the change trends of the correlation indicator and the abnormal indicator are the same within the time range; the correlation type between the correlation indicator and the abnormal indicator is negative, and the change trends of the correlation indicator and the abnormal indicator are opposite within the time range.

[0029] In some embodiments, the root cause result of the anomaly includes a combination of anomaly dimensions and the anomaly dimension value of each anomaly dimension in the combination of anomaly dimensions. The drill-down analysis module is further configured to: determine at least one anomaly dimension from the dimension list based on the uniformity of change of the anomaly factor index under each dimension of the dimension list within the time range; for each anomaly dimension, determine the anomaly weight corresponding to each dimension value of the anomaly dimension based on the change information of the anomaly factor index under each dimension value of the anomaly dimension within the time range; determine the anomaly dimension value of each anomaly dimension based on the anomaly weight corresponding to each dimension value of each anomaly dimension, and add each anomaly dimension to the combination of anomaly dimensions.

[0030] In some embodiments, the drill-down analysis module is further configured to: determine the cumulative abnormal weight corresponding to the abnormal dimension combination; if the cumulative abnormal weight is greater than a weight threshold, exclude each of the abnormal dimensions from the dimension list to obtain an updated dimension list; determine at least one abnormal dimension from the dimension list based on the uniformity of change of the abnormal factor index under each dimension of the updated dimension list within the time range; for each of the at least one abnormal dimension, determine the abnormal weight corresponding to each dimension value of the abnormal dimension based on the change information of the abnormal factor index under each dimension value of the abnormal dimension within the time range and the cumulative abnormal weight; determine the abnormal dimension value of each of the abnormal dimensions based on the abnormal weight corresponding to each dimension value of each of the abnormal dimensions, and add each of the abnormal dimensions to the abnormal dimension combination.

[0031] This application provides an anomaly analysis device, including: a memory for storing executable instructions; and a processor for executing the executable instructions stored in the memory to implement the method provided in this application.

[0032] This application provides a computer-readable storage medium storing executable instructions for inducing a processor to execute and implement the method provided in this application.

[0033] The embodiments of this application have the following beneficial effects:

[0034] First, based on the indicator factor decomposition rules of the business to be analyzed, multiple factor indicators of the abnormal indicators of the business to be analyzed are determined, and the change information of the abnormal indicators and each factor indicator within the same time range is determined. Second, based on the change information of the abnormal indicators and each factor indicator within the same time range, at least one candidate abnormal factor indicator and the abnormal weight of each candidate abnormal factor indicator are determined. Then, based on the abnormal weight of the at least one candidate abnormal factor indicator, at least one abnormal factor indicator is determined from the at least one candidate abnormal factor indicator. Finally, a multi-dimensional drill-down analysis is performed on each abnormal factor indicator to obtain the root cause results of the abnormal indicators. In this way, the change information of multiple factor indicators of the abnormal indicators and the abnormal weight of each candidate abnormal factor indicator are considered together when performing root cause analysis, and multi-dimensional drill-down analysis is further performed on the abnormal factor indicators, which can improve the accuracy of root cause location of the business abnormal indicators. In addition, since multi-dimensional drill-down analysis can be performed automatically, no manual drill-down investigation is required, and at least one abnormal factor indicator is determined based on the abnormal weight of each candidate abnormal factor indicator. Multi-dimensional drill-down analysis is performed only on the abnormal factor indicator, which can narrow the scope of drill-down analysis, thereby greatly shortening the time for abnormal root cause location. Attached Figure Description

[0035] Figure 1A This is a schematic diagram illustrating the implementation process of the multidimensional root cause analysis method in related technologies;

[0036] Figure 1B This is an optional architecture diagram of the anomaly analysis system provided in the embodiments of this application;

[0037] Figure 2 This is an optional structural schematic diagram of the anomaly analysis device provided in the embodiments of this application;

[0038] Figure 3 This is an optional flowchart illustrating the anomaly analysis method provided in the embodiments of this application;

[0039] Figure 4 This is an optional flowchart illustrating the anomaly analysis method provided in the embodiments of this application;

[0040] Figure 5 This is an optional flowchart illustrating the anomaly analysis method provided in the embodiments of this application;

[0041] Figure 6A This is an optional flowchart illustrating the anomaly analysis method provided in the embodiments of this application;

[0042] Figure 6B This is an optional flowchart illustrating the anomaly analysis method provided in the embodiments of this application;

[0043] Figure 7A This is a schematic diagram of an indicator analysis page of a reporting system provided in an embodiment of this application;

[0044] Figure 7B This is a schematic diagram of an application scenario of an analysis module implemented based on the anomaly analysis method provided in the embodiments of this application in a reporting system;

[0045] Figure 7C This is a schematic diagram of a breakdown rule for decomposing advertising revenue indicators provided in an embodiment of this application. Detailed Implementation

[0046] To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings. The described embodiments should not be regarded as limitations on this application. All other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0047] In the following description, references are made to “some embodiments,” which describe a subset of all possible embodiments. However, it is understood that “some embodiments” may be the same subset or different subsets of all possible embodiments and may be combined with each other without conflict.

[0048] If the application documents contain similar descriptions such as "first / second", the following explanation shall be added: In the following description, the terms "first / second / third" are used only to distinguish similar objects and do not represent a specific order of objects. It is understood that "first / second / third" may be interchanged in a specific order or sequence where permitted, so that the embodiments of this application described herein can be implemented in an order other than that illustrated or described herein.

[0049] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing embodiments of this application only and is not intended to limit this application.

[0050] In the implementation of this application, the collection and processing of relevant data should strictly comply with the requirements of relevant laws and regulations, obtain the informed consent or separate consent of the personal information subject, and carry out subsequent data use and processing within the scope of laws and regulations and the authorization of the personal information subject.

[0051] Before providing a further detailed description of the embodiments of this application, the nouns and terms involved in the embodiments of this application will be explained, and the nouns and terms involved in the embodiments of this application shall be interpreted as follows.

[0052] 1) Attribution: Find the cause of the abnormality;

[0053] 2) Contribution of Anomalies: The proportion of anomalies in a specific scenario to the overall anomalies. For example, if revenue drops by 1 million, of which WeChat advertising traffic drops by 500,000, then the contribution is 50%.

[0054] To better understand the anomaly analysis method provided in the embodiments of this application, the anomaly root cause analysis schemes in related technologies will be described below.

[0055] In related technologies, Microsoft's Adtributor system can be used to perform multidimensional root cause analysis on abnormal business indicators. See [link / reference]. Figure 1A , Figure 1A This is a schematic diagram of the implementation process of the multidimensional root cause analysis method in related technologies. The method includes the following steps S11 to S14:

[0056] Step S11, Data Collection: Collect multidimensional time series data of the indicators, including records such as timestamps, indicators, dimensions, and elements. Here, preliminary preprocessing can be performed on missing values ​​and invalid values ​​to improve data quality.

[0057] Step S12, Anomaly Detection: An Autoregressive Moving Average (ARMA) time series model is used to predict the indicator in real time, and the predicted value of the indicator is compared with the actual value to determine whether the indicator has an anomaly. Here, the predicted value and the actual value will be used for root cause analysis of the Adtributor system.

[0058] Step S13, Root Cause Analysis: The Adtributor system is used to calculate the probability P-value, expected value E-value, and standard deviation S-value for all dimensions and elements of the abnormal indicators, and threshold comparison analysis is performed to screen and locate the root causes of the anomalies. Here, the thresholds of Total Factor Productivity (TEP) and Total Effective Efficiency of Production (TEEP) can be used for comparison analysis.

[0059] Step S14, Output Results: Output the multidimensional root cause analysis results and visualize the results to provide feedback to the operations and maintenance engineer.

[0060] The aforementioned root cause analysis solutions only consider the impact of a single dimension on the business when determining whether a business metric is abnormal in each dimension, without considering the interrelationships across multiple dimensions. However, in real-world business scenarios, a complex comprehensive metric is not influenced by individual dimensions alone. Therefore, the accuracy of root cause localization in the aforementioned root cause analysis solutions is not high.

[0061] This application provides an anomaly analysis method, apparatus, device, and computer-readable storage medium, which can improve the accuracy of root cause localization of business anomaly indicators and significantly shorten the time for anomaly root cause localization. The following describes exemplary applications of the anomaly analysis device provided in this application. This anomaly analysis device can be implemented as various types of user terminals such as laptops, tablets, desktop computers, set-top boxes, and mobile devices (e.g., mobile phones, portable music players, personal digital assistants, dedicated messaging devices, portable gaming devices), or as a server. The following describes exemplary applications when the device is implemented as a server.

[0062] See Figure 1B , Figure 1B This is an optional architecture diagram of the anomaly analysis system 100 provided in this application embodiment, which can perform root cause analysis on anomaly indicators of business. The terminal (terminal 400-1 and terminal 400-2 are shown as examples) connects to the server 200 through the network 300, which can be a wide area network or a local area network, or a combination of the two.

[0063] The terminal is used to: display an interactive interface for users to perform business anomaly indicator analysis on a graphical interface (graphical interfaces 410-1 and 410-2 are shown as examples), receive the abnormal indicators of the business to be analyzed input by the user, send an anomaly analysis request to the server 200, and display the anomaly root cause results obtained from the server 200.

[0064] Server 200 is configured to: acquire abnormal indicators of the business to be analyzed; determine multiple factor indicators of the abnormal indicators based on the indicator factor decomposition rules of the business to be analyzed; determine the change information of the abnormal indicators and each of the factor indicators within the same time range; determine at least one candidate abnormal factor indicator and the abnormal weight of each candidate abnormal factor indicator based on the change information of the abnormal indicators and the change information of each factor indicator within the same time range; determine at least one abnormal factor indicator from the at least one candidate abnormal factor indicator based on the abnormal weight of the at least one candidate abnormal factor indicator; and perform multi-dimensional drill-down analysis on each abnormal factor indicator based on the dimension list to be analyzed to obtain the abnormal root cause results of the abnormal indicators.

[0065] In some embodiments, server 200 may be a standalone physical server or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms. Terminals may be smartphones, tablets, laptops, desktop computers, smart speakers, smartwatches, etc., but are not limited to these. Terminals and servers may be directly or indirectly connected via wired or wireless communication, and this is not limited in these embodiments.

[0066] In some embodiments, server 200 can also be a node in a blockchain system. The blockchain system can be a distributed network of nodes (any form of computing device connected to the network, such as servers or user terminals) and clients, forming a peer-to-peer (P2P) network. The P2P protocol is an application layer protocol running on top of the Transmission Control Protocol (TCP). In a blockchain system, any machine, such as a server or terminal, can join and become a node.

[0067] See Figure 2 , Figure 2 This is a schematic diagram of the structure of the server 200 provided in the embodiments of this application. Figure 2 The server 200 shown includes at least one processor 210, memory 250, at least one network interface 220, and a user interface 230. The various components in server 200 are coupled together via a bus system 240. It is understood that the bus system 240 is used to implement communication between these components. In addition to a data bus, the bus system 240 also includes a power bus, a control bus, and a status signal bus. However, for clarity, ... Figure 2 The general labeled all buses as Bus System 240.

[0068] Processor 210 can be an integrated circuit chip with signal processing capabilities, such as a general-purpose processor, a digital signal processor (DSP), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. Among them, the general-purpose processor can be a microprocessor or any conventional processor, etc.

[0069] User interface 230 includes one or more output devices 231 that enable the presentation of media content, including one or more speakers and / or one or more visual displays. User interface 230 also includes one or more input devices 232, including user interface components that facilitate user input, such as a keyboard, mouse, microphone, touch screen display, camera, other input buttons and controls.

[0070] The memory 250 may be removable, non-removable, or a combination thereof. Exemplary hardware devices include solid-state storage, hard disk drives, optical disk drives, etc. The memory 250 may optionally include one or more storage devices physically located away from the processor 210.

[0071] The memory 250 may include volatile memory or non-volatile memory, or both. The non-volatile memory may be read-only memory (ROM), and the volatile memory may be random access memory (RAM). The memory 250 described in this application embodiment is intended to include any suitable type of memory.

[0072] In some embodiments, memory 250 is capable of storing data to support various operations, examples of which include programs, modules, and data structures or subsets or supersets thereof, as illustrated below.

[0073] Operating system 251 includes system programs for handling various basic system services and performing hardware-related tasks, such as the framework layer, core library layer, driver layer, etc., for implementing various basic business functions and handling hardware-based tasks;

[0074] The network communication module 252 is used to reach other computing devices via one or more (wired or wireless) network interfaces 220, such as Bluetooth, WiFi, and Universal Serial Bus (USB).

[0075] Presentation module 253 is configured to enable the presentation of information (e.g., a user interface for operating peripheral devices and displaying content and information) via one or more output devices 231 associated with user interface 230 (e.g., a display screen, a speaker, etc.).

[0076] The input processing module 254 is used to detect and translate one or more user inputs or interactions from one or more input devices 232.

[0077] In some embodiments, the anomaly analysis device provided in this application can be implemented in software. Figure 2 An anomaly analysis device 255 stored in memory 250 is shown. It can be software in the form of programs and plug-ins, including the following software modules: acquisition module 2551, first determination module 2552, second determination module 2553, third determination module 2554, fourth determination module 2555, and drill-down analysis module 2556. These modules are logically related and can therefore be arbitrarily combined or further split according to the functions they implement.

[0078] The functions of each module will be explained below.

[0079] In other embodiments, the anomaly analysis device provided in this application can be implemented in hardware. As an example, the anomaly analysis device provided in this application can be a processor in the form of a hardware decoding processor, which is programmed to execute the anomaly analysis method provided in this application. For example, the processor in the form of a hardware decoding processor can be one or more application-specific integrated circuits (ASICs), DSPs, programmable logic devices (PLDs), complex programmable logic devices (CPLDs), field-programmable gate arrays (FPGAs), or other electronic components.

[0080] The following will illustrate the anomaly analysis method provided in this application embodiment with reference to exemplary applications and implementations of the terminal or server provided in the embodiments of this application.

[0081] See Figure 3 , Figure 3 This is an optional flowchart illustrating the anomaly analysis method provided in this application embodiment. The following will be combined with... Figure 3 The steps shown are explained below. The entity performing these steps can be the terminal or server mentioned above.

[0082] In step S101, abnormal indicators of the business to be analyzed are obtained;

[0083] Here, abnormal indicators refer to metrics that exhibit unusual fluctuations in the business being analyzed. These can be automatically identified by the monitoring system or manually discovered and entered by the user. Abnormal indicators can be numerical, such as advertising revenue, impressions, and page views, or proportional, such as conversion rate, success rate, and failure rate.

[0084] In step S102, based on the indicator factor decomposition rules of the business to be analyzed, multiple factor indicators of the abnormal indicators are determined.

[0085] Here, the indicator factor decomposition rules are rules for decomposing indicators in the business to be analyzed into factors. These rules can be pre-determined based on the correlation between the indicators in the business to be analyzed. In implementation, the indicator factor decomposition rules for the business to be analyzed can be manually derived based on expert experience, or they can be automatically derived through data mining based on the numerical relationships between indicators. There is no limitation here.

[0086] The factor indicators of an abnormal indicator are the indicators corresponding to the factors or elements that make up the abnormal indicator, and may include, but are not limited to, multiplicative factor indicators, additive factor indicators, etc. By querying the indicator factor decomposition rules of the business to be analyzed, multiple factor indicators of the abnormal indicator can be determined. These multiple factor indicators can be some of the factor indicators of the abnormal indicator or all of the factor indicators of the abnormal indicator. This application embodiment does not limit this. For example, for the advertising business, if the abnormal indicator is advertising revenue, since advertising revenue can be determined by multiplying the number of ad requests, exposure rate, fill rate, and revenue per thousand impressions, the advertising revenue indicator can be decomposed into the ad request volume indicator, exposure rate indicator, fill rate indicator, and revenue per thousand impressions indicator. The ad request volume indicator, exposure rate indicator, fill rate indicator, and revenue per thousand impressions indicator are the four factor indicators of the advertising revenue indicator.

[0087] In some embodiments, the factor index can be further decomposed to obtain the factor index of the factor index.

[0088] In step S103, the change information of the abnormal indicators and each of the factor indicators within the same time range is determined respectively;

[0089] Here, the time range can be user-inputted or a default value. The information regarding changes in the indicator can include, but is not limited to, one or more of the following: the amount of change, the trend of change, and the duration of the change. The information regarding changes in the indicator within the time range can be either a month-on-month change in the indicator's value within that time range or a change in the indicator's value within that time range relative to a specific comparison time range; there are no limitations on this. In implementation, the values ​​of abnormal indicators and each factor indicator can be obtained separately within the same time range, and the changes in the abnormal indicators and each factor indicator within that time range can be determined based on their values.

[0090] In step S104, based on the change information of the abnormal indicator within the time range and the change information of each factor indicator within the time range, at least one candidate abnormal factor indicator and the abnormal weight of each candidate abnormal factor indicator are determined.

[0091] Here, candidate abnormal factor indicators are factor indicators that may be abnormal among multiple factor indicators. In implementation, those skilled in the art can use appropriate methods to determine candidate abnormal factor indicators among multiple factor indicators according to the actual situation, and there is no limitation here. For example, based on the change information of abnormal indicators and each factor indicator within a time range, the change trend of abnormal indicators and each factor indicator within that time range can be determined, and factor indicators whose change trend is the same as that of abnormal indicators can be determined as candidate abnormal factor indicators. Alternatively, based on the change information of abnormal indicators and each factor indicator within a time range, the change amount of abnormal indicators and each factor indicator within that time range can be determined, and factor indicators whose change amount exceeds a certain threshold can be determined as candidate abnormal factor indicators. Alternatively, by calculating the similarity between the value curve of each factor indicator and the value curve of the abnormal indicator within that time range, factor indicators with a similarity greater than a certain similarity threshold can be determined as candidate abnormal factor indicators.

[0092] The abnormal weight of the candidate abnormal factor indicator is the weight that represents the contribution of the change of the candidate abnormal factor indicator to the overall change of the abnormal indicators. It can be the weight of the change of the candidate abnormal factor indicator in the overall change of the abnormal indicators, or the weight of the change rate of the candidate abnormal factor indicator in the overall change rate of the abnormal indicators. There is no limitation here.

[0093] In step S105, based on the abnormal weights of the at least one candidate abnormal factor index, at least one abnormal factor index is determined from the at least one candidate abnormal factor index.

[0094] Here, based on the abnormal weight of each candidate abnormal factor indicator, the contribution of the change of each candidate abnormal factor indicator to the overall change of the abnormal indicators can be determined, thereby identifying the abnormal factor indicators among the candidate abnormal factor indicators. In implementation, at least one candidate abnormal factor indicator whose abnormal weight exceeds a specific weight threshold can be identified as an abnormal factor indicator, or a specific number of candidate abnormal factor indicators with the largest abnormal weight can be identified as abnormal factor indicators.

[0095] In step S106, for each abnormal factor indicator, based on the list of dimensions to be analyzed, a multi-dimensional drill-down analysis is performed on the abnormal factor indicator to obtain the abnormal root cause results of the abnormal indicator.

[0096] Here, the list of dimensions to be analyzed includes at least one dimension that requires multi-dimensional drill-down analysis. The dimensions in the list can be user-inputted, pre-defined, or automatically determined based on the business or anomaly indicators being analyzed; there are no limitations on this. For example, for advertising business, the list of dimensions to be analyzed may include, but is not limited to, traffic dimensions, platform dimensions, industry dimensions, and customer dimensions. In some embodiments, for each dimension, at least one dimension value can be included. For example, for the traffic dimension, values ​​for WeChat traffic, QQ traffic, etc., for the platform dimension, values ​​for Android platform, Apple operating system platform, Windows platform, etc., and for the industry dimension, values ​​for the gaming industry, education industry, e-commerce industry, etc.

[0097] The root causes of abnormal indicators may include, but are not limited to, one or more of the following: abnormal dimensions, abnormal dimension values, and abnormal events that cause abnormal fluctuations in the indicators. During implementation, the dimensions in the list to be analyzed can be at the same or different levels during drill-down analysis. By traversing the list of dimensions to be analyzed, multi-dimensional, layer-by-layer drill-down analysis is performed on the abnormal factor indicators. At each level of drill-down analysis, the abnormal dimensions, abnormal dimension values, and abnormal events in that level are determined. Finally, upon completion of the drill-down analysis, the determined abnormal dimensions, abnormal dimension values, and abnormal events in each level can be used as the root causes of the abnormal indicators.

[0098] In this embodiment, firstly, based on the indicator factor decomposition rules of the business to be analyzed, multiple factor indicators of the abnormal indicators of the business to be analyzed are determined, and the change information of the abnormal indicators and each factor indicator within the same time range is determined respectively. Secondly, based on the change information of the abnormal indicators and each factor indicator within the same time range, at least one candidate abnormal factor indicator and the abnormal weight of each candidate abnormal factor indicator are determined. Then, based on the abnormal weight of the at least one candidate abnormal factor indicator, at least one abnormal factor indicator is determined from the at least one candidate abnormal factor indicator. Finally, a multi-dimensional drill-down analysis is performed on each abnormal factor indicator to obtain the abnormal root cause results of the abnormal indicators. In this way, the change information of multiple factor indicators of the abnormal indicators and the abnormal weight of each candidate abnormal factor indicator are considered together when performing root cause analysis, and multi-dimensional drill-down analysis is further performed on the abnormal factor indicators, which can improve the accuracy of root cause location of abnormal business indicators. Furthermore, since it can automatically perform multi-dimensional drill-down analysis without the need for manual drill-down investigation, and determines at least one abnormal factor indicator based on the abnormal weight of each candidate abnormal factor indicator, multi-dimensional drill-down analysis is only performed on the abnormal factor indicators, which can narrow the scope of drill-down analysis and thus greatly shorten the time for abnormal root cause localization.

[0099] In some embodiments, see Figure 4 , Figure 4 This is an optional flowchart illustrating the anomaly analysis method provided in this application embodiment, based on... Figure 3 The change information includes the change trend and the change amount. Step S104 can be implemented through steps S401 to S402. The following will describe each step in detail. The execution subject of the following steps can be the terminal or server mentioned above.

[0100] In step S401, based on the changing trend of the abnormal indicator within the time range and the changing trend of each factor indicator within the time range, at least one candidate abnormal factor indicator with the same changing trend as the abnormal indicator is determined from the plurality of factor indicators.

[0101] Here, the trend of the indicator can include, but is not limited to, one of the following: rising, falling, oscillating, or remaining flat. It can also include the rate of increase or decrease of the indicator within the time range, the frequency of oscillation, etc. In implementation, if an abnormal indicator rises within the time range, factor indicators that also rise within the same time range can be identified as candidate abnormal factor indicators. If an abnormal indicator falls within the time range, factor indicators that also fall within the same time range can be identified as candidate abnormal factor indicators. In some embodiments, the values ​​of the abnormal indicator and each factor indicator within the same time range can be fitted separately to obtain the value curves of the abnormal indicator and each factor indicator. By comparing the similarity between the value curve of each factor indicator and the value curve of the abnormal indicator, it can be determined whether the changing trend of each factor indicator is the same as that of the abnormal indicator within the same time range. Thus, factor indicators with a similarity less than a specific similarity threshold can be identified as candidate abnormal factor indicators.

[0102] In step S402, the abnormal weight of each candidate abnormal factor index is determined based on the amount of change of each candidate abnormal factor index within the time range.

[0103] Here, the anomaly weight of a candidate anomaly factor indicator can be a weight representing the contribution of the change in the candidate anomaly factor indicator to the overall change in the aomaly indicators. In implementation, the ratio of the change in a candidate anomaly factor indicator to the overall change in the aomaly indicators can be determined as the anomaly weight of that candidate anomaly factor indicator. Alternatively, the changes in each candidate anomaly factor indicator can be summed to obtain the sum of the changes in all candidate anomaly factor indicators, and the ratio of the change in each candidate anomaly factor indicator to the sum of the changes can be determined as the anomaly weight of that candidate anomaly factor indicator.

[0104] In some embodiments, step S402 can be implemented by the following steps S421 to S422: Step S421, summing the changes of each candidate abnormal factor index within the time range to obtain the total abnormal changes; Step S422, for each candidate abnormal factor index, determining the proportion of the changes of the candidate abnormal factor index within the time range in the total abnormal changes as the abnormal weight of the candidate abnormal factor index.

[0105] In this embodiment, based on the anomaly indicators and the changing trends of each factor indicator within the same time range, at least one candidate anomaly factor indicator with the same changing trend as the anomaly indicators is determined from multiple factor indicators. Based on the amount of change of each candidate anomaly factor indicator within the stated time range, the anomaly weight of each candidate anomaly factor indicator is determined. This allows for the rapid and accurate determination of candidate anomaly factor indicators and the anomaly weight of each candidate anomaly factor indicator, thereby improving the efficiency of anomaly root cause localization.

[0106] In some embodiments, see Figure 5 , Figure 5 This is an optional flowchart illustrating the anomaly analysis method provided in this application embodiment, based on... Figure 3 The method can also execute steps S501 to S502. The following will describe each step in detail; the entity executing these steps can be the terminal or server mentioned earlier.

[0107] In step S501, if it is determined that the abnormal indicator cannot be decomposed according to the indicator factor decomposition rule, at least one associated indicator associated with the abnormal indicator is determined according to the indicator association rule of the business to be analyzed.

[0108] Here, the decomposition rules for matching indicator factors can be used to determine whether an abnormal indicator is decomposable. For an abnormal indicator that is not decomposable, at least one related indicator can be identified based on the indicator association rules of the business to be analyzed. The indicator association rules of the business to be analyzed can include the relationships between various indicators in the business. In practice, the indicator association rules of the business to be analyzed can be manually derived based on expert experience, or they can be automatically obtained through data mining based on the numerical relationships between indicators; there is no limitation here.

[0109] In step S502, based on the association type between each of the associated indicators and the abnormal indicators and the change trend of each of the associated indicators within the time range, the abnormal root cause result of the abnormal indicator is determined from the at least one associated indicator.

[0110] Here, the type of correlation between related indicators and abnormal indicators can include, but is not limited to, positive correlation, negative correlation, etc. The root cause of an abnormal indicator is the fundamental reason for its abnormal fluctuations, and may include at least one related indicator that causes these fluctuations. In implementation, based on the actual situation, the related indicator whose correlation type and trend with the abnormal indicator meet the set conditions can be identified as the related indicator causing the abnormal fluctuations.

[0111] In some embodiments, the anomaly root cause result includes at least one anomaly correlation indicator. Correspondingly, step S502 above can be implemented by the following step S521:

[0112] Step S521: For each of the at least one correlated indicators, if the correlation type between the correlated indicator and the abnormal indicator and the trend of change of the correlated indicator within the time range meet specific conditions, the correlated indicator is determined to be an abnormal correlated indicator; wherein, the specific conditions include one of the following:

[0113] The correlation between the correlation indicator and the abnormal indicator is positive, and the correlation indicator and the abnormal indicator have the same trend of change within the time range.

[0114] The correlation type between the correlation indicator and the abnormal indicator is reverse correlation, and the change trends of the correlation indicator and the abnormal indicator are opposite within the time range.

[0115] In this embodiment, for indivisible anomalous indicators, at least one associated indicator is determined based on the indicator association rules of the business to be analyzed. Then, based on the association type between each associated indicator and the anomalous indicator, as well as the changing trend of each associated indicator, the root cause of the anomalous indicator is determined from at least one associated indicator. This allows for the analysis of root causes even for indivisible anomalous indicators, thereby improving the versatility of the anomaly analysis method. Furthermore, since the determination of the root cause comprehensively considers the association type between the associated indicators and the anomalous indicator, as well as the changing trend of the associated indicators, the accuracy of the root cause results can be further improved.

[0116] In some embodiments, see Figure 6A , Figure 6A This is an optional flowchart illustrating the anomaly analysis method provided in this application embodiment, based on... Figure 3The abnormal root cause results include abnormal dimension combinations and the abnormal dimension values ​​of each abnormal dimension in the abnormal dimension combinations. In step S106, based on the list of dimensions to be analyzed, multi-dimensional drill-down analysis is performed on the abnormal factor indicators to obtain the abnormal root cause results of the abnormal indicators. This can be achieved through the following steps S601 to S603. The following will describe each step in conjunction with the previous steps. The execution subject of the following steps can be the terminal or server mentioned above.

[0117] In step S601, based on the uniformity of change of the abnormal factor index within the time range under each dimension of the dimension list, at least one abnormal dimension is determined from the dimension list.

[0118] Here, the uniformity of change of an anomaly factor index within a certain time range in one dimension can be interpreted as the uniformity of the distribution of the anomaly factor index's values ​​across all dimensions within that time range. The more uneven the distribution, the more likely the anomaly factor index's value is to be abnormal in that dimension. In practice, this uniformity can be reflected by statistical indicators that characterize the uniformity of the distribution of the anomaly factor index's values ​​across all dimensions within that time range. These indicators may include, but are not limited to, one or more of the following: the Gini coefficient, the standard deviation, and the variance of the change.

[0119] In some embodiments, the uniformity of change of the anomaly index within the time range under each dimension of the dimension list includes the Gini coefficient of the change in the anomaly index under each dimension value of the dimension list within the time range. Since a larger Gini coefficient indicates a more uneven distribution of change, in practice, at least one dimension with the largest corresponding Gini coefficient can be determined as an anomaly dimension, and dimensions with a Gini coefficient greater than a specific Gini coefficient threshold can also be determined as an anomaly dimension; this is not limited here.

[0120] In step S602, for each abnormal dimension, based on the change information of the abnormal factor index under the values ​​of each dimension of the abnormal dimension within the time range, the abnormal weight corresponding to each dimension value of the abnormal dimension is determined.

[0121] Here, the anomaly weight corresponding to each value of the anomaly dimension is the weight representing the contribution of the change of the anomaly factor indicator under each value of the anomaly dimension to the overall change of the anomaly factor indicator. It can be the weight of the change in the anomaly factor indicator under each value of the anomaly dimension within the overall change of the anomaly factor indicator, or it can be the weight of the rate of change of the anomaly factor indicator under each value of the anomaly dimension within the overall rate of change of the anomaly factor indicator; there is no limitation here. In implementation, those skilled in the art can determine the anomaly weight corresponding to each value of the anomaly dimension using an appropriate method based on the actual situation. For example, for numerical metrics, the outlier weight corresponding to the value 1 in dimension 1 is: Contri(dimension 1 = value 1) = change in dimension 1 corresponding to value 1 / overall change in the outlier metric; for proportional metrics, taking revenue per thousand impressions as an example, revenue per thousand impressions = revenue / impressions, and the outlier weight corresponding to the value 1 in dimension 1 is: Contri(dimension 1 = value 1) = (revenue corresponding to value 1 in dimension 1 at the current time / impressions corresponding to value 1 in dimension 1 at the current time - revenue corresponding to value 1 in dimension 1 at the comparison time / impressions corresponding to value 1 in dimension 1 at the comparison time) / (total revenue per thousand impressions at the current time - total revenue per thousand impressions at the comparison time).

[0122] In step S603, based on the abnormal weight corresponding to the value of each dimension in each abnormal dimension, the abnormal dimension value of each abnormal dimension is determined, and each of the abnormal dimensions is added to the abnormal dimension combination.

[0123] Here, based on the anomaly weight corresponding to each value in each anomaly dimension, the contribution of the change of the anomaly factor index under each value of the anomaly dimension to the overall change of the anomaly factor index can be determined, thereby determining the anomaly dimension value for each anomaly dimension. In implementation, anomaly dimension values ​​with anomaly weights exceeding a specific weight threshold can be defined as anomaly factor indices, or a specific number of dimension values ​​with the largest anomaly weights among the various dimensions of the anomaly dimension can be defined as anomaly dimension values; there is no limitation here.

[0124] In this embodiment, at least one anomalous dimension is determined based on the uniformity of change of the anomalous factor index in each dimension of the dimension list. For each anomalous dimension, the anomalous weight corresponding to each dimension value of the anomalous factor index is determined based on the change information of the anomalous factor index in each dimension of the anomalous dimension. Based on the anomalous weight corresponding to each dimension value, the anomalous dimension value of the anomalous dimension is determined. This allows for a simple and accurate determination of whether the anomalous factor index is anomalous in each dimension. Furthermore, by comprehensively considering the changes of the anomalous factor index in each dimension of the dimension list when locating the anomalous dimension, the accuracy of anomalous dimension location can be effectively improved, thereby improving the accuracy of anomalous dimension value location.

[0125] In some embodiments, see Figure 6B , Figure 6B This is an optional flowchart illustrating the anomaly analysis method provided in this application embodiment, based on... Figure 6A In step S106, after step S603, steps S611 to S615 can also be executed. The following will explain each step in detail; the executing entity for the following steps can be the terminal or server mentioned above.

[0126] In step S611, the cumulative anomaly weights corresponding to the anomaly dimension combinations are determined;

[0127] Here, the anomaly dimension combination refers to the combination of values ​​for each of the selected anomaly dimensions from the dimensions analyzed in the multi-dimensional drill-down analysis. The cumulative anomaly weight of the anomaly dimension combination can characterize the weight of the change in the value of the anomaly factor index under the condition that each anomaly dimension value in the anomaly dimension combination satisfies the anomaly dimension value, relative to the overall change in the anomaly factor index. In practice, the cumulative anomaly weight of the anomaly dimension combination can be determined as the ratio between the change in the value of the anomaly factor index under the condition that each anomaly dimension value in the anomaly dimension combination satisfies the anomaly dimension value and the overall change in the anomaly factor index; either way, it can be determined as the ratio between the rate of change of the value of the anomaly factor index under the condition that each anomaly dimension value in the anomaly dimension combination satisfies the anomaly dimension value and the rate of change of the overall anomaly factor index. There is no limitation on this. For example, if the abnormal dimension combination includes abnormal dimension 1 and abnormal dimension 2, with abnormal dimension 1 having an abnormal dimension value of 1 and abnormal dimension 2 having an abnormal dimension value of 2, then the cumulative abnormal weight corresponding to this abnormal dimension combination can be the proportion of the change in the value of the abnormal factor index when abnormal dimension 1 takes the abnormal dimension value of 1 and abnormal dimension 2 takes the abnormal dimension value of 2 in the overall change of the abnormal factor index.

[0128] In step S612, if the cumulative abnormal weight is greater than the weight threshold, each of the abnormal dimensions is excluded from the dimension list to obtain an updated dimension list.

[0129] Here, the weight threshold can be user-defined or a default value; there is no limitation on this.

[0130] In step S613, based on the uniformity of change of the abnormal factor index under each dimension of the updated dimension list within the time range, at least one abnormal dimension is determined from the dimension list.

[0131] Here, step S613 corresponds to the aforementioned step S601. In implementation, the specific implementation method of the aforementioned step S601 can be referred to.

[0132] In step S614, for each of the at least one abnormal dimension, based on the change information of the abnormal factor index under the values ​​of each dimension of the abnormal dimension within the time range and the cumulative abnormal weight, the abnormal weight corresponding to each dimension value of the abnormal dimension is determined.

[0133] Here, during multi-dimensional drill-down analysis, when analyzing each anomaly dimension, the cumulative anomaly weights corresponding to the current combination of anomaly dimensions can be considered together to determine the anomaly weight corresponding to each value of the current anomaly dimension. In practice, the anomaly weight corresponding to each value of the anomaly dimension can be determined by multiplying the contribution of the change of the anomaly factor index under each value of the anomaly dimension relative to the overall change of the anomaly factor index by the cumulative anomaly weight. For example, the anomaly weight corresponding to each value of the anomaly dimension can be the product of the contribution of the change of the anomaly factor index under each value of the anomaly dimension to the overall change of the anomaly factor index by the cumulative anomaly weight, or it can be the product of the contribution of the rate of change of the anomaly factor index under each value of the anomaly dimension to the overall rate of change of the anomaly factor index by the cumulative anomaly weight.

[0134] In step S615, based on the abnormal weight corresponding to the value of each dimension in each of the abnormal dimensions, the abnormal dimension value of each of the abnormal dimensions is determined, and each of the abnormal dimensions is added to the abnormal dimension combination.

[0135] Here, step S615 corresponds to the aforementioned step S603. In implementation, the specific implementation method of the aforementioned step S603 can be referred to.

[0136] In this embodiment, by determining the cumulative anomaly weights corresponding to the combination of anomaly dimensions, and when the cumulative anomaly weights exceed a weight threshold, multi-dimensional drill-down analysis is continuously performed on the anomaly factor indicators. For each anomaly dimension, based on the changes in the anomaly factor indicators across all dimensions and the cumulative anomaly weights, the anomaly weights corresponding to each dimension value of that anomaly dimension are determined. Based on the anomaly weights corresponding to each dimension value within each anomaly dimension, the anomaly dimension value for each anomaly dimension is determined. Thus, during the multi-dimensional drill-down analysis, when analyzing each layer of dimensions, the influence of the currently selected anomaly dimensions and the changes in their respective anomaly dimension values ​​on the changes in the anomaly factor indicators is considered together. This gradually determines the anomaly dimensions that constitute the root cause results and the anomaly dimension values ​​for each anomaly dimension, thereby further improving the accuracy of anomaly dimension location and anomaly dimension value location.

[0137] The following describes an exemplary application of this application's embodiments in a real-world scenario. Taking the analysis of abnormal indicators in advertising business as an example, in actual business operations, a complex comprehensive indicator is not solely influenced by individual dimensions. Furthermore, a comprehensive indicator can often be further broken down into various factor indicators. For instance, advertising revenue can be broken down into metrics such as request volume, impressions, and effective cost per mile (eCPM). Only by further analyzing the causes of anomalies in these factor indicators can more practical suggestions be provided to address the decline in advertising revenue. Based on this, this application's embodiments provide an anomaly analysis method. For abnormal fluctuations in core indicators of the advertising business, the cause of the fluctuation can be found through multi-dimensional joint attribution and indicator correlation. This method can be used to implement the analysis module of a reporting system, applied to the scenario of abnormal fluctuation analysis of advertising revenue indicators in the reporting system. It provides the reporting system with anomaly analysis functionality for business indicators, and the anomaly root cause data obtained from the analysis can be displayed as part of the report on the indicator analysis page.

[0138] See Figure 7A , Figure 7A This is a schematic diagram of an indicator analysis page of a reporting system provided in an embodiment of this application. The indicator analysis page 70 may include an indicator list area 71, a filter input area 72, and a result display area 73. Users can select the business indicators to be analyzed in the indicator list area 71, perform dimension filtering operations in the filter input area 72 to filter the dimensions to be analyzed, and click the query button 721 in the filter input area 72 to query the root cause analysis results of abnormal fluctuations of the selected business indicators in the filtered dimensions. The root cause analysis results are displayed in the result display area 73.

[0139] See Figure 7B , Figure 7B This diagram illustrates an application scenario of the analysis module implemented using the anomaly analysis method provided in this application within a reporting system. The analysis module 710 receives the abnormal business indicators to be analyzed through the Nginx service access layer 720 and retrieves formatted abnormal business indicators, related indicators, indicator factor decomposition rules, factor indicators, and other data for anomaly analysis from the MySQL database 740 or Druid system 750 via a query agent 730. This data can be preprocessed by the UnifiedScheduler (US) module 760 and then stored in the MySQL database 740 or Druid system 750. After retrieving the data for anomaly analysis through the query agent 730, the analysis module 710 performs anomaly analysis on the abnormal business indicators to be analyzed, obtaining and outputting the root cause results of abnormal fluctuations. Furthermore, the BlackBox module 770 can also call the analysis module 710 to execute abnormal business indicator analysis based on the stored business indicator analysis plan and record the execution details.

[0140] In implementation, the data used for analyzing abnormal business metrics can be determined based on the actual business scenario. For example, the analysis of advertising revenue fluctuations can be based on advertising performance data and competitive data. The metric data can be stored in Druid, a multidimensional analysis system that supports Online Analytical Processing (OLAP). The dimensions of the metric data can cover, but are not limited to, one or more dimensions such as advertising attributes, advertiser attributes, industry attributes, campaign mix strategies, product attributes, and playback status. The metrics can cover, but are not limited to, one or more basic metrics such as impressions, clicks, spending, conversions, behavior, predicted conversion rate (pCVR), predicted click-through rate (pCTR), average bid, and price adjustment factors. In some embodiments, the metric data can also be stored using other suitable storage systems, such as ClickHouse or Tencent's Hermes system.

[0141] This application provides an anomaly analysis method. For anomaly indicators in a business to be analyzed, if the anomaly indicator can be decomposed, a multiplicative factorization analysis can be performed. If the anomaly indicator cannot be decomposed, a positive or negative correlation analysis can be applied. In implementation, it can be determined whether an anomaly indicator can be decomposed according to the set decomposition rules, and decomposeable anomaly indicators can be continuously decomposed. The decomposition rules can be set in advance based on expert experience after analyzing the business, see [link to relevant documentation]. Figure 7C , Figure 7C This is a schematic diagram illustrating a breakdown rule for advertising revenue metrics, provided as an embodiment of this application. For example... Figure 7C As shown, advertising revenue can be broken down into four key metrics: request volume, fill rate, impression rate, and eCPM. Each of these metrics can be further subdivided. For each of these sub-metrics, drill-down analysis or other customized analyses can be performed. For example, request volume can be further broken down into the number of requests initiated, the request failure rate, and traffic strategy. The number of requests initiated can be further analyzed using traffic-level drill-down analysis or event correlation analysis, and the request failure rate can be further analyzed using traffic-level drill-down analysis or backend service level agreement analysis.

[0142] For multiplicative factor decomposition analysis, abnormal factor indicators can be identified by calculating the abnormal contribution of each factor indicator. Here, the abnormal contribution can be the abnormal weight of the factor indicator. For positive and negative correlation analysis, simple positive and negative qualitative correlation can be used to identify correlation indicators that match the fluctuations of abnormal indicators. For example, correlation indicators that are positively or negatively correlated with abnormal indicators can be determined by pre-set positive and negative correlation rules. Among the correlation indicators that are positively correlated with abnormal indicators, those with the same fluctuation trend as the abnormal indicators can be identified as correlation indicators that match the fluctuations of abnormal indicators. Among the correlation indicators that are negatively correlated with abnormal indicators, those with the opposite fluctuation trend to the abnormal indicators can be identified as correlation indicators that match the fluctuations of abnormal indicators.

[0143] When analyzing income indicators, the following steps S711 to S714 can be used to calculate the contribution of each factor indicator to its fluctuations:

[0144] Step S711 involves decomposing the income indicator into a product of multiple factor indicators. For example, the income indicator can be factored using the following formula 1-1:

[0145] (1-1);

[0146] Step S712: Calculate the ratio between the values ​​of the income indicator in time period i and time period j, and the ratio between the values ​​of the product of each factor indicator in time period i and time period j. For example, the following formulas 1-2 can be used to compare the values ​​of the income indicator and each factor indicator in time period i and time period j:

[0147] (1-2);

[0148] Step S713: Take the logarithm of the ratio between the values ​​of the income indicator in time period i and time period j, and the ratio between the values ​​of the product of each factor indicator in time period i and time period j, to transform the product of multiple multiplicative factor indicators into the sum of multiple sub-items. For example, the following formulas 1-3 can be used to transform the product of multiple multiplicative factor indicators into the sum of multiple sub-items:

[0149] (1-3);

[0150] Step S714: If the sum of all sub-items is greater than 0, then for each sub-item with a sum greater than 0, the proportion of that sub-item in the sum of all sub-items greater than 0 is taken as the anomaly contribution of the corresponding factor indicator, and the factor indicator with the highest anomaly contribution is selected for further analysis. If the sum of all sub-items is less than 0, then for each sub-item with a sum less than 0, the proportion of that sub-item in the sum of all sub-items less than 0 is taken as the anomaly contribution of the corresponding factor indicator, and the factor indicator with the highest anomaly contribution is selected for further analysis. Here, further analysis of factor indicators may include, but is not limited to, multi-dimensional drill-down analysis, indicator customization analysis, etc.

[0151] In some embodiments, when performing multi-dimensional drill-down analysis on a factor indicator, each dimension in the list of dimensions to be analyzed can be traversed. During the traversal of each dimension, the factor indicator can be analyzed under the currently accessed dimension based on the abnormal dimension combinations determined in the previous access and the dimension values ​​of each abnormal dimension in that abnormal dimension combination, thereby determining the current abnormal dimension combination and the abnormal dimension values ​​of each abnormal dimension in the current abnormal dimension combination. In practice, for the currently accessed dimension d, the following steps S721 to S725 can be used for analysis:

[0152] Step S721: Calculate the dimensional analysis vector array V = [V1, V2, ..., Vn] corresponding to the values ​​of each dimension of the factor index under dimension d, where n is the number of dimension values ​​under dimension d. For the dimension value i under dimension d, the corresponding dimensional analysis vector Vi = (value_now, value_cmp, base, diff, scale), where i is an integer greater than or equal to 1 and less than or equal to n; value_now is the current value of the factor index when dimension d is dimension value i; value_cmp is the value of the factor index at the comparison time when dimension d is dimension value i; base is the cardinality corresponding to the factor index when it is a proportional value. If the factor index is a proportional value, the cardinality is the value of the index corresponding to the denominator of the proportional value at the current time. The index corresponding to the denominator of the factor index can be determined according to the definition of the factor index; diff is the difference between value_now and value_cmp; scale is the change rate of value_now relative to value_cmp.

[0153] Step S722: Calculate the Gini coefficients gini_diff and gini_scale of the diff and scale of each dimension analysis vector in the dimension analysis vector array V.

[0154] Step S723: If at least one of gini_diff and gini_scale is greater than the corresponding Gini coefficient threshold, dimension d is added as an abnormal dimension candidate_dim to the abnormal dimension combination. Since the Gini coefficients gini_diff and gini_scale reflect the uniformity of the distribution of factor index values ​​under dimension d, the larger gini_diff and gini_scale are, the more uneven the distribution of factor index values ​​under dimension d, and thus the more likely the factor index values ​​are to be abnormal under dimension d.

[0155] Step S724: Select the dimension with the largest diff from the various dimensions of candidate_dim as the abnormal dimension value of candidate_dim. The contribution of the change in this abnormal dimension value to the overall change is diff / root_diff. root_diff is the overall change in the factor index.

[0156] Step S725: If the contribution of the change in the value of the abnormal dimension to the overall change is less than the threshold T, then the current combination of abnormal dimensions and the value of the abnormal dimension of each abnormal dimension in the current combination of abnormal dimensions are output as the attribution result; otherwise, continue to access the next dimension for drill-down analysis.

[0157] In some embodiments, the following steps S731 to S739 can also be used to perform multi-dimensional drill-down analysis on the factor indicators:

[0158] Step S731: Determine all analysis dimensions dims_all;

[0159] Step S732, initialize the dimension value tree dim_value_tree=[];

[0160] Step S733: Traverse each dimension in all analysis dimensions and determine the selected dimension value array dims_value_selected in the dimension value tree;

[0161] Here, each element in dims_value_selected includes the currently selected dimension, the dimension value, and the outlier weight of the dimension value;

[0162] Step S734: Determine the filtering conditions corresponding to the dimension value array dims_value_selected: filters = getFilters(dims_value_selected);

[0163] Here, the filtering condition is the value condition of the dimension that matches the value of each dimension in dims_value_selected. For example, if dims_value_selected is [[dimension 1=value 1, dimension 2=value 2]], then the corresponding filtering condition is "dimension 1=value 1 and dimension 2=value 2".

[0164] Step S735: Based on dims_value_selected, calculate the remaining candidate dimension list: dim_left = dims_all - getDims(dims_value_selected); if dim_left is empty, end the traversal, otherwise proceed to step S736; where getDims() is used to retrieve the currently selected dimensions.

[0165] Step S736: Obtain the Gini coefficient corresponding to the change in factor index under each dimension value in the remaining candidate dimension list when the selected dimension values ​​meet the filtering conditions: dim_gini_list=[(dim,getGini(dim,filters,DIFF)) for dim in dims_left];

[0166] Step S737: Filter the remaining candidate dimension list and select the N=2 dimensions with the highest Gini coefficient for further analysis: dim_candidate=[x[0] for x in topN_GINI(dim_gini_list,2) if gini>GINI_THRESHOLD]; If dim_candidate is empty, end the traversal; otherwise, obtain the cumulative contribution value corresponding to the current filtering condition: acc_contribution=getAccContribution(dims_value_selected);

[0167] Here, the cumulative contribution value under the current filtering condition is the contribution of the factor indicator's value change relative to the overall change of the factor indicator, provided that each dimension of the filtering condition is satisfied. For example, for the filtering condition "Dimension 1 = Value 1 and Dimension 2 = Value 2", the cumulative contribution value = Contri(Dimension 1 = Value 1) * Contri(Dimension 2 = Value 2 | Dimension 1 = Value 1), where Contri(Dimension 1 = Value 1) is the contribution of the factor indicator's change with dimension 1 (value 1) relative to the overall change of the factor indicator, and Contri(Dimension 2 = Value 2 | Dimension 1 = Value 1) is the contribution of the factor indicator's change with dimension 1 (value 1) and dimension 2 (value 2) relative to the factor indicator's change with dimension 2 (value 2). When calculating the contribution, for numerical indicators:

[0168] Contri(Dimension1=Value1) = Dimension1 is the diff corresponding to Value1 / Total diff;

[0169] Contri(Dimension2=Value2|Dimension1=Value1) = Dimension1 is the value1 and Dimension2 is the value2 corresponding to the diff / Dimension1 is the value1 corresponding to the diff.

[0170] For proportional metrics, taking eCPM as an example, eCPM = Revenue / Impressions:

[0171] Contri(Dimension 1 = Value 1) = (Revenue corresponding to Value 1 at the current time / Exposure corresponding to Value 1 at the current time - Revenue corresponding to Value 1 at the comparison time / Exposure corresponding to Value 1 at the comparison time) / (Total eCPM at the current time - Total eCPM at the comparison time).

[0172] Contri(Dimension2=Value2|Dimension1=Value1) = (Revenue at the current time when Dimension1 is Value1 and Dimension2 is Value2 / Exposure at the current time when Dimension1 is Value1 and Dimension2 is Value2 - Revenue at the comparison time when Dimension1 is Value1 and Dimension2 is Value2 / Exposure at the comparison time when Dimension1 is Value1 and Dimension2 is Value2) / (eCPM at the current time when Dimension1 is Value1 - Total eCPM at the comparison time when Dimension1 is Value1).

[0173] Step S738, obtain the value of the dimension with the largest change contribution in dim_candidate: dim_value_candidate=[(dim,value,acc_contribution*getMostContribution(dim)) fordim in dim_cadidate];

[0174] Here, getMostContribution(dim) retrieves the maximum value among the variable contributions of each dimension in dimension dim.

[0175] Step S739: From dim_value_candidate, filter out the dimension values ​​whose anomaly contribution is greater than the contribution threshold: dim_value_final=[(dim,value,acc_contribution) for dim in dim_value_candidate if acc_contribution>CONTRIBUTION_THRESHOLD]; If dim_value_final is empty, end the traversal; otherwise, update dims_value_selected = dims_value_selected+dim_value_final, and update the updated dims_value_selected in dim_value_tree.

[0176] Here, after the traversal is complete, the dimensions selected in dims_value_selected and their values ​​can be used as the root cause results of the factor indicators.

[0177] The following examples illustrate the beneficial effects of the anomaly analysis method provided in this application. For instance, on September 26, 2020, the revenue of the advertising oCPX bidding model (a bidding model optimized for conversion cost) increased by approximately 12% compared to a week earlier (September 19, 2020).

[0178] To perform root cause analysis on the fluctuation of this indicator using the anomaly analysis method provided in this application, the following query conditions can be entered:

[0179] {"interval":"2020-09-26 / 2020-09-26", "interval_cmp": "2020-09-19 / 2020-09-19", "filters": ["is_ocpx=1"], "metric": "cost"};

[0180] Where interval is the time to be analyzed, interval_cmp is the comparison time, filters are the filtering conditions for the metrics to be analyzed, and metric is the metric to be analyzed.

[0181] Based on the above input query conditions, the following output results can be obtained:

[0182]

[0183]

[0184] When performing anomaly analysis on the revenue metrics of the aforementioned oCPX bidding model for advertising, this method took 59 seconds to run, effectively shortening the time for anomaly location. The output results show that factor decomposition determined that the average bid metric contributed the most to revenue improvement, reaching 56.769%. Therefore, the average bid metric can be identified as an anomalous factor. Through multi-dimensional drill-down analysis of the average bid metric, the dimension value "104" in the "Optimization Goal" dimension and the dimension value "Lilith" in the "Customer" dimension contributed the most to revenue improvement, both reaching nearly 50%. Therefore, the "Optimization Goal" and "Customer" dimensions can be identified as anomalous dimensions, and the dimension value "104" in the "Optimization Goal" dimension and the dimension value "Lilith" in the "Customer" dimension can be identified as anomalous dimension values.

[0185] The anomaly analysis method provided in this application can find the cause of abnormal fluctuations in indicators through multidimensional joint attribution and indicator correlation. It can effectively improve the accuracy of root cause localization and effectively shorten the time for anomaly localization, reducing the time spent manually from hours to minutes.

[0186] The following description continues to illustrate the exemplary structure of the anomaly analysis device 255 provided in the embodiments of this application as a software module. In some embodiments, such as... Figure 2 As shown, the software modules stored in the anomaly analysis device 255 in the memory 250 may include:

[0187] The acquisition module 2551 is used to acquire abnormal indicators of the business to be analyzed;

[0188] The first determining module 2552 is used to determine multiple factor indicators of the abnormal indicator based on the indicator factor decomposition rules of the business to be analyzed.

[0189] The second determining module 2553 is used to determine the change information of the abnormal indicators and each of the factor indicators within the same time range;

[0190] The third determining module 2554 is used to determine at least one candidate abnormal factor indicator and the abnormal weight of each candidate abnormal factor indicator based on the change information of the abnormal indicator within the time range and the change information of each factor indicator within the time range.

[0191] The fourth determining module 2555 is used to determine at least one abnormal factor indicator from the at least one candidate abnormal factor indicator based on the abnormal weight of the at least one candidate abnormal factor indicator.

[0192] The drill-down analysis module 2556 is used to perform multi-dimensional drill-down analysis on each abnormal factor indicator based on the list of dimensions to be analyzed, so as to obtain the abnormal root cause results of the abnormal indicator.

[0193] In some embodiments, the change information includes a change trend and a change amount, and the third determining module is further configured to: determine at least one candidate abnormal factor indicator with the same change trend as the abnormal indicator from the plurality of factor indicators based on the change trend of the abnormal indicator within the time range and the change trend of each factor indicator within the time range; and determine the abnormal weight of each candidate abnormal factor indicator based on the change amount of each candidate abnormal factor indicator within the time range.

[0194] In some embodiments, the third determining module is further configured to: sum the changes of each candidate abnormal factor indicator within the time range to obtain the total abnormal changes; and for each candidate abnormal factor indicator, determine the proportion of the changes of the candidate abnormal factor indicator within the time range in the total abnormal changes as the abnormal weight of the candidate abnormal factor indicator.

[0195] In some embodiments, the apparatus further includes: a fifth determining module, configured to determine at least one associated indicator associated with the abnormal indicator according to the indicator association rules of the business to be analyzed when the abnormal indicator is determined to be indivisible according to the indicator factor decomposition rules; and a sixth determining module, configured to determine the abnormal root cause result of the abnormal indicator from the at least one associated indicator according to the association type between each associated indicator and the abnormal indicator and the change trend of each associated indicator within the time range.

[0196] In some embodiments, the abnormal root cause result includes at least one abnormal correlation indicator, and the sixth determining module is further configured to: for each of the at least one correlation indicator, if the correlation type between the correlation indicator and the abnormal indicator and the change trend of the correlation indicator within the time range meet specific conditions, determine the correlation indicator as an abnormal correlation indicator; wherein, the specific conditions include one of the following: the correlation type between the correlation indicator and the abnormal indicator is positive, and the change trends of the correlation indicator and the abnormal indicator are the same within the time range; the correlation type between the correlation indicator and the abnormal indicator is negative, and the change trends of the correlation indicator and the abnormal indicator are opposite within the time range.

[0197] In some embodiments, the root cause result of the anomaly includes a combination of anomaly dimensions and the anomaly dimension value of each anomaly dimension in the combination of anomaly dimensions. The drill-down analysis module is further configured to: determine at least one anomaly dimension from the dimension list based on the uniformity of change of the anomaly factor index under each dimension of the dimension list within the time range; for each anomaly dimension, determine the anomaly weight corresponding to each dimension value of the anomaly dimension based on the change information of the anomaly factor index under each dimension value of the anomaly dimension within the time range; determine the anomaly dimension value of each anomaly dimension based on the anomaly weight corresponding to each dimension value of each anomaly dimension, and add each anomaly dimension to the combination of anomaly dimensions.

[0198] In some embodiments, the drill-down analysis module is further configured to: determine the cumulative abnormal weight corresponding to the abnormal dimension combination; if the cumulative abnormal weight is greater than a weight threshold, exclude each of the abnormal dimensions from the dimension list to obtain an updated dimension list; determine at least one abnormal dimension from the dimension list based on the uniformity of change of the abnormal factor index under each dimension of the updated dimension list within the time range; for each of the at least one abnormal dimension, determine the abnormal weight corresponding to each dimension value of the abnormal dimension based on the change information of the abnormal factor index under each dimension value of the abnormal dimension within the time range and the cumulative abnormal weight; determine the abnormal dimension value of each of the abnormal dimensions based on the abnormal weight corresponding to each dimension value of each of the abnormal dimensions, and add each of the abnormal dimensions to the abnormal dimension combination.

[0199] This application provides a computer program product or computer program that includes computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the anomaly analysis method described above in this application.

[0200] This application provides a computer-readable storage medium storing executable instructions. When these executable instructions are executed by a processor, they cause the processor to execute the exception analysis method provided in this application. For example, ... Figure 3 The method shown.

[0201] In some embodiments, the computer-readable storage medium may be a memory such as FRAM, ROM, PROM, EP-ROM, EEPROM, flash memory, magnetic surface memory, optical disk, or CD-ROM; or it may be a variety of devices including one or any combination of the above-mentioned memories.

[0202] In some embodiments, executable instructions may take the form of a program, software, software module, script, or code, written in any form of programming language (including compiled or interpreted languages, or declarative or procedural languages), and may be deployed in any form, including as a standalone program or as a module, component, subroutine, or other unit suitable for use in a computing environment.

[0203] As an example, executable instructions may, but do not necessarily, correspond to files in a file system. They may be stored as part of a file that holds other programs or data, for example, in one or more scripts in a Hyper Text Markup Language (HTML) document, in a single file dedicated to the program in question, or in multiple collaborating files (e.g., a file that stores one or more modules, subroutines, or code sections).

[0204] As an example, executable instructions can be deployed to execute on a single computing device, or on multiple computing devices located in one location, or on multiple computing devices distributed across multiple locations and interconnected via a communication network.

[0205] In summary, the embodiments of this application can improve the accuracy of root cause localization of business anomaly indicators and greatly shorten the time for anomaly root cause localization.

[0206] The above description is merely an embodiment of this application and is not intended to limit the scope of protection of this application. Any modifications, equivalent substitutions, and improvements made within the spirit and scope of this application are included within the scope of protection of this application.

Claims

1. An anomaly analysis method, characterized in that, include: Obtain abnormal indicators for the business to be analyzed; Based on the indicator factor decomposition rules of the business to be analyzed, multiple factor indicators of the abnormal indicators are determined. The changes in the abnormal indicators and each of the factor indicators within the same time range are determined respectively. Based on the change information of the abnormal indicators within the time range, and the change information of each of the factor indicators within the time range, at least one candidate abnormal factor indicator and the abnormal weight of each candidate abnormal factor indicator are determined. Based on the abnormal weights of the at least one candidate abnormal factor index, at least one abnormal factor index is determined from the at least one candidate abnormal factor index. For each of the aforementioned abnormal factor indicators, based on the list of dimensions to be analyzed, a multi-dimensional drill-down analysis is performed on the abnormal factor indicators to obtain the abnormal root cause results of the abnormal indicators; wherein, the abnormal root cause results include abnormal dimension combinations and the abnormal dimension values ​​of each abnormal dimension in the abnormal dimension combination. For each dimension in the dimension list, a dimension analysis vector array corresponding to the values ​​of the anomaly factor index under each dimension is calculated. For each value under the dimension, the corresponding dimension analysis vector includes the current value of the anomaly factor index when the dimension is the value of the dimension, the value of the anomaly factor index at the comparison time when the dimension is the value of the dimension, the cardinality corresponding to the anomaly factor index when it is a proportional value, the difference between the current value and the value at the comparison time, and the change ratio of the current value to the value at the comparison time. Calculate the Gini coefficient of the difference and the rate of change of each dimension analysis vector in the dimension analysis vector array respectively; if at least one of the difference and the rate of change is greater than the corresponding Gini coefficient threshold, add the corresponding dimension as an outlier dimension to the outlier dimension combination. For each abnormal dimension, the dimension value with the largest difference is selected from the values ​​of each dimension of the abnormal dimension as the abnormal dimension value of the abnormal dimension. The contribution of the change of the abnormal dimension value to the overall change is the ratio of the difference to the overall change of the abnormal factor index. Each of the abnormal dimensions is then added to the abnormal dimension combination.

2. The method according to claim 1, characterized in that, The change information includes the change trend and the change amount. The step of determining at least one candidate abnormal factor indicator and the abnormal weight of each candidate abnormal factor indicator based on the change information of the abnormal indicator within the time range, and the change information of each factor indicator within the time range, includes: Based on the changing trend of the abnormal indicator within the time range, and the changing trend of each of the factor indicators within the time range, at least one candidate abnormal factor indicator with the same changing trend as the abnormal indicator is determined from the plurality of factor indicators. The anomaly weight of each candidate anomaly factor index is determined based on the amount of change of each candidate anomaly factor index within the time range.

3. The method according to claim 2, characterized in that, The step of determining the anomaly weight of each candidate anomaly factor index based on the change in each candidate anomaly factor index within the time range includes: The total abnormal changes are obtained by summing the changes of each candidate abnormal factor index within the time range. For each candidate abnormal factor indicator, the proportion of the change of the candidate abnormal factor indicator within the time range to the total abnormal change is determined as the abnormal weight of the candidate abnormal factor indicator.

4. The method according to claim 1, characterized in that, The method further includes: If the abnormal indicator is determined to be undecomposable according to the indicator factor decomposition rules, at least one associated indicator is determined to be associated with the abnormal indicator according to the indicator association rules of the business to be analyzed. Based on the association type between each of the associated indicators and the abnormal indicator, and the changing trend of each of the associated indicators within the time range, the abnormal root cause result of the abnormal indicator is determined from the at least one associated indicator.

5. The method according to claim 4, characterized in that, The abnormal root cause result includes at least one abnormal correlation indicator. The step of determining the abnormal root cause result of the abnormal indicator from the at least one correlation indicator based on the correlation type between each correlation indicator and the abnormal indicator, and the changing trend of each correlation indicator within the time range, includes: For each of the at least one correlated indicator, if the correlation type between the correlated indicator and the abnormal indicator, and the trend of the correlated indicator within the time range, satisfy a specific condition, the correlated indicator is identified as an abnormal correlated indicator; wherein, the specific condition includes one of the following: The correlation between the correlation indicator and the abnormal indicator is positive, and the correlation indicator and the abnormal indicator have the same trend of change within the time range. The correlation type between the correlation indicator and the abnormal indicator is reverse correlation, and the change trends of the correlation indicator and the abnormal indicator are opposite within the time range.

6. The method according to claim 1, characterized in that, The step of performing multi-dimensional drill-down analysis on the abnormal factor indicators based on the list of dimensions to be analyzed, to obtain the root cause results of the abnormal indicators, also includes: Determine the cumulative anomaly weights corresponding to the combination of anomaly dimensions; If the cumulative abnormal weight is greater than the weight threshold, each of the abnormal dimensions is excluded from the dimension list to obtain an updated dimension list. Based on the uniformity of change of the abnormal factor index in each dimension of the updated dimension list within the time range, at least one abnormal dimension is determined from the dimension list. For each of the at least one abnormal dimension, based on the change information of the abnormal factor index under the values ​​of each dimension of the abnormal dimension within the time range and the cumulative abnormal weight, the abnormal weight corresponding to each dimension value of the abnormal dimension is determined. Based on the abnormal weight corresponding to the value of each dimension in each of the abnormal dimensions, the abnormal dimension value of each of the abnormal dimensions is determined, and each of the abnormal dimensions is added to the abnormal dimension combination.

7. An anomaly analysis device, characterized in that, include: The acquisition module is used to acquire abnormal indicators of the business to be analyzed; The first determining module is used to determine multiple factor indicators of the abnormal indicator based on the indicator factor decomposition rules of the business to be analyzed. The second determining module is used to determine the change information of the abnormal indicators and each of the factor indicators within the same time range; The third determining module is used to determine at least one candidate abnormal factor indicator and the abnormal weight of each candidate abnormal factor indicator based on the change information of the abnormal indicator within the time range and the change information of each factor indicator within the time range. The fourth determining module is used to determine at least one abnormal factor indicator from the at least one candidate abnormal factor indicator based on the abnormal weight of the at least one candidate abnormal factor indicator. The drill-down analysis module is used to perform multi-dimensional drill-down analysis on each of the abnormal factor indicators based on the list of dimensions to be analyzed, so as to obtain the abnormal root cause results of the abnormal indicators; wherein, the abnormal root cause results include abnormal dimension combinations and the abnormal dimension values ​​of each abnormal dimension in the abnormal dimension combination. The drill-down analysis module is further configured to calculate, for each dimension in the dimension list, a dimension analysis vector array corresponding to the values ​​of the anomaly factor index in each dimension under that dimension. For each value in that dimension, the corresponding dimension analysis vector includes the current value of the anomaly factor index when the dimension is that value, the value of the anomaly factor index at the comparison time when the dimension is that value, the base value corresponding to the anomaly factor index when it is a proportional value, the difference between the current value and the value at the comparison time, and the change ratio of the current value relative to the value at the comparison time. The drill-down analysis module is also used to calculate the Gini coefficient of the difference and the rate of change of each dimension analysis vector in the dimension analysis vector array respectively; if at least one of the difference and the rate of change is greater than the corresponding Gini coefficient threshold, the corresponding dimension is added as an abnormal dimension to the abnormal dimension combination. The drill-down analysis module is further configured to select the dimension value with the largest difference from the values ​​of each dimension of the abnormal dimension for each abnormal dimension as the abnormal dimension value of the abnormal dimension, wherein the contribution of the change of the abnormal dimension value to the overall change is the ratio of the difference to the overall change of the abnormal factor index, and to add each of the abnormal dimensions to the abnormal dimension combination.

8. The apparatus according to claim 7, characterized in that, The change information includes the trend of change and the amount of change; The third determining module is further configured to determine at least one candidate abnormal factor indicator with the same changing trend as the abnormal indicator from the plurality of factor indicators based on the changing trend of the abnormal indicator within the time range and the changing trend of each factor indicator within the time range. The anomaly weight of each candidate anomaly factor index is determined based on the amount of change of each candidate anomaly factor index within the time range.

9. The apparatus according to claim 8, characterized in that, The third determining module is also used to sum the changes of each candidate abnormal factor index within the time range to obtain the total abnormal changes. For each candidate abnormal factor indicator, the proportion of the change of the candidate abnormal factor indicator within the time range to the total abnormal change is determined as the abnormal weight of the candidate abnormal factor indicator.

10. The apparatus according to claim 7, characterized in that, The device further includes: The fifth determining module is used to determine at least one associated indicator associated with the abnormal indicator according to the indicator factor decomposition rules when the abnormal indicator is determined to be indivisible according to the indicator association rules of the business to be analyzed. The sixth determining module is used to determine the abnormal root cause result of the abnormal indicator from the at least one associated indicator based on the association type between each associated indicator and the abnormal indicator and the change trend of each associated indicator within the time range.

11. The apparatus according to claim 10, characterized in that, The abnormal root cause results include at least one abnormal correlation indicator; The sixth determining module is further configured to, for each of the at least one related indicator, determine the related indicator as an abnormal related indicator if the correlation type between the related indicator and the abnormal indicator and the changing trend of the related indicator within the time range meet specific conditions; wherein, the specific conditions include one of the following: The correlation between the correlation indicator and the abnormal indicator is positive, and the correlation indicator and the abnormal indicator have the same trend of change within the time range. The correlation type between the correlation indicator and the abnormal indicator is reverse correlation, and the change trends of the correlation indicator and the abnormal indicator are opposite within the time range.

12. The apparatus according to claim 7, characterized in that, The drill-down analysis module is also used to determine the cumulative anomaly weights corresponding to the anomaly dimension combinations; If the cumulative abnormal weight is greater than the weight threshold, each of the abnormal dimensions is excluded from the dimension list to obtain an updated dimension list. Based on the uniformity of change of the abnormal factor index in each dimension of the updated dimension list within the time range, at least one abnormal dimension is determined from the dimension list. For each of the at least one abnormal dimension, based on the change information of the abnormal factor index under the values ​​of each dimension of the abnormal dimension within the time range and the cumulative abnormal weight, the abnormal weight corresponding to each dimension value of the abnormal dimension is determined. Based on the abnormal weight corresponding to the value of each dimension in each of the abnormal dimensions, the abnormal dimension value of each of the abnormal dimensions is determined, and each of the abnormal dimensions is added to the abnormal dimension combination.

13. An anomaly analysis device, characterized in that, include: Memory, used to store executable instructions; A processor, when executing executable instructions stored in the memory, implements the method according to any one of claims 1 to 6.

14. A computer-readable storage medium, characterized in that, It stores executable instructions for implementing the method of any one of claims 1 to 6 when executed by a processor.

Images