Business anomaly monitoring method, device, electronic equipment and storage medium

Abstract

The present disclosure relates to a method, device, electronic device and storage medium for monitoring business anomalies. The method includes obtaining first occurrence data of at least one preset event corresponding to a preset business under at least one first monitoring dimension, the first occurrence data being the number of occurrences corresponding to each of multiple adjacent time periods within the current monitoring cycle; inputting the first occurrence data into a first anomaly monitoring model for anomaly monitoring processing to obtain at least one preset event corresponding to the at least one first monitoring dimension, and first anomaly indicator data corresponding to multiple adjacent time periods; based on the first anomaly indicator data, determining a first anomaly monitoring result corresponding to the preset business, the first anomaly monitoring result characterizing an abnormal event corresponding to an abnormal monitoring dimension in at least one first monitoring dimension. The embodiments of the present disclosure can be used to improve the versatility of anomaly monitoring in different business scenarios, quickly and accurately locate abnormal factors, improve the efficiency and accuracy of anomaly monitoring, and reduce business anomalies.

Description

Technical Field

[0001] The present disclosure relates to the field of Internet technology, and in particular to a method, device, electronic device and storage medium for monitoring business anomalies. Background Art

[0002] With the development of Internet technology, the business functions and scale of various network services are also expanding. How to monitor business abnormalities in a timely manner has also become the focus of maintaining the normal operation of related services.

[0003] In the related technology, the event that caused the business abnormality is often analyzed and determined by performing abnormal point mapping in the business code, collecting the information of the abnormal point mapping, and rendering the information of the abnormal point mapping to the interface. However, in the related technology, for example, in the login state verification business in some services, there are many types of events that lead to abnormal failure of login state verification, and different business scenarios cannot uniformly configure monitoring solutions such as abnormal point mapping, resulting in the inability to accurately locate abnormal factors, and the monitoring efficiency and accuracy are low, which in turn leads to problems such as business abnormalities. Summary of the invention

[0004] The present disclosure provides a method, device, electronic device and storage medium for monitoring business anomalies, so as to at least solve the problems that the abnormal factors cannot be accurately located in the related technologies, the monitoring efficiency and accuracy are low, and thus business anomalies are caused. The technical solutions of the present disclosure are as follows:

[0005] According to a first aspect of an embodiment of the present disclosure, a service anomaly monitoring method is provided, including:

[0006] Obtaining first occurrence data of at least one preset event corresponding to a preset business under at least one first monitoring dimension, wherein the first occurrence data is the number of occurrences corresponding to each of a plurality of adjacent time periods within a current monitoring cycle;

[0007] Inputting the first occurrence data into a first anomaly monitoring model for anomaly monitoring processing, and obtaining at least one preset event corresponding to the at least one first monitoring dimension and first anomaly indicator data corresponding to the multiple adjacent time periods;

[0008] Based on the first abnormal indicator data, a first abnormal monitoring result corresponding to the preset business is determined, and the first abnormal monitoring result represents an abnormal event corresponding to an abnormal monitoring dimension in the at least one first monitoring dimension.

[0009] In an optional embodiment, the method further includes:

[0010] Filtering the first occurrence data based on a first number threshold to obtain first target occurrence data;

[0011] The first occurrence data is input into the first abnormality monitoring model for abnormality monitoring processing to obtain at least one preset event corresponding to the at least one first monitoring dimension, and the first abnormality indicator data corresponding to the multiple adjacent time periods include:

[0012] The first target occurrence data is input into the first anomaly monitoring model for anomaly monitoring processing to obtain the first anomaly indicator data.

[0013] In an optional embodiment, determining the first abnormality monitoring result corresponding to the preset service based on the first abnormality indicator data includes:

[0014] In the case where the first abnormal indicator data corresponding to any preset event of the first monitoring dimension in the plurality of adjacent time periods are all greater than or equal to the first preset threshold, the preset event corresponding to the first monitoring dimension in which the first abnormal indicator data corresponding to the plurality of adjacent time periods are all greater than or equal to the first preset threshold is taken as the abnormal event corresponding to the abnormal monitoring dimension;

[0015] Based on the abnormal event corresponding to the abnormal monitoring dimension, the first abnormal monitoring result is generated.

[0016] In an optional embodiment, the method further includes:

[0017] Obtain second occurrence data of the abnormal event corresponding to the preset business under at least one second monitoring dimension, where the second occurrence data is the number of occurrences corresponding to the current monitoring period, and the at least one second monitoring dimension is a monitoring dimension after an additional monitoring dimension is added to the abnormal monitoring dimension;

[0018] Inputting the second occurrence data into a second anomaly recognition model for anomaly monitoring processing to obtain the abnormal event corresponding to the at least one second monitoring dimension and the second abnormal indicator data corresponding to the current monitoring period;

[0019] Based on the second abnormal indicator data, a second abnormal monitoring result corresponding to the preset business is determined, and the second abnormal monitoring result represents a target abnormal event corresponding to a target abnormal monitoring dimension in the at least one second monitoring dimension.

[0020] In an optional embodiment, determining the second abnormal monitoring result corresponding to the preset service based on the second abnormal indicator data includes:

[0021] In the preset event corresponding to any second monitoring dimension, when the second abnormal indicator data corresponding to the current monitoring period is greater than or equal to the second preset threshold, the abnormal event corresponding to the second monitoring dimension whose second abnormal indicator data corresponding to the current monitoring period is greater than or equal to the second preset threshold is used as the target abnormal event corresponding to the target abnormal monitoring dimension;

[0022] The second abnormality monitoring result is generated according to the target abnormality event corresponding to the target abnormality monitoring dimension.

[0023] In an optional embodiment, the preset service is a login state verification service, the at least one first monitoring dimension is at least one service, the additional monitoring dimension is at least one area, the second abnormal monitoring result represents a target abnormal event in the abnormal area corresponding to the abnormal service, and the method further includes:

[0024] The area where the second abnormal indicator data corresponding to the at least one area is greater than or equal to the second preset threshold is taken as the abnormal area;

[0025] Determine the number of first regions corresponding to the abnormal region and the number of second regions corresponding to the target region, wherein the target region is a region participating in abnormal monitoring processing in the at least one region;

[0026] The generating the second abnormality monitoring result according to the target abnormality event corresponding to the target abnormality monitoring dimension includes:

[0027] When the number of the first areas is greater than the first area threshold and the number of the second areas is greater than the second area threshold, the second abnormality monitoring result is generated according to the target abnormality event corresponding to the target abnormality monitoring dimension.

[0028] In an optional embodiment, the method further includes:

[0029] Filtering the second occurrence data based on a second numerical threshold to obtain second target occurrence data;

[0030] The inputting the second occurrence data into the second anomaly recognition model for anomaly monitoring processing to obtain the second anomaly indicator data corresponding to the abnormal event under the at least one second monitoring dimension includes:

[0031] The second target occurrence data is input into the second anomaly recognition model for anomaly monitoring processing to obtain the second anomaly indicator data.

[0032] In an optional embodiment, the method further includes:

[0033] Obtaining first sample occurrence data of at least one preset event corresponding to the preset business under the at least one first monitoring dimension and preset abnormal indicator data corresponding to the first sample occurrence data, wherein the first sample occurrence data is the number of occurrences corresponding to each of multiple adjacent historical time periods within multiple historical monitoring cycles;

[0034] Inputting the first sample occurrence data into a preset machine learning model for abnormal monitoring processing, and obtaining at least one preset event corresponding to the at least one first monitoring dimension and corresponding sample abnormality indicator data in the multiple adjacent historical time periods;

[0035] Determining target loss information according to the preset abnormal indicator data and the sample abnormal indicator data;

[0036] Based on the target loss information, the preset machine learning model is trained to obtain the first abnormality monitoring model.

[0037] According to a second aspect of an embodiment of the present disclosure, a service anomaly monitoring device is provided, including:

[0038] A first occurrence data acquisition module is configured to execute acquisition of first occurrence data of at least one preset event corresponding to a preset business under at least one first monitoring dimension, wherein the first occurrence data is the number of occurrences corresponding to each of a plurality of adjacent time periods within a current monitoring cycle;

[0039] A first abnormality monitoring processing module is configured to execute the input of the first occurrence data into a first abnormality monitoring model for abnormality monitoring processing, and obtain at least one preset event corresponding to the at least one first monitoring dimension and first abnormality indicator data corresponding to the multiple adjacent time periods;

[0040] The first abnormal monitoring result determination module is configured to determine a first abnormal monitoring result corresponding to the preset business based on the first abnormal indicator data, wherein the first abnormal monitoring result represents an abnormal event corresponding to an abnormal monitoring dimension in the at least one first monitoring dimension.

[0041] In an optional embodiment, the device further comprises:

[0042] A first data filtering module is configured to filter the first occurrence data based on a first number threshold to obtain first target occurrence data;

[0043] The first abnormality monitoring processing module is further configured to input the first target occurrence data into the first abnormality monitoring model for abnormality monitoring processing to obtain the first abnormality indicator data.

[0044] In an optional embodiment, the first abnormal monitoring result determination module includes:

[0045] The first abnormality determination unit is configured to execute a preset event corresponding to any first monitoring dimension, and when the first abnormal indicator data corresponding to the multiple adjacent time periods are all greater than or equal to the first preset threshold, the preset event corresponding to the first monitoring dimension in which the first abnormal indicator data corresponding to the multiple adjacent time periods are all greater than or equal to the first preset threshold is used as the abnormal event corresponding to the abnormal monitoring dimension;

[0046] The first abnormality monitoring result generating unit is configured to execute an abnormal event corresponding to the abnormality monitoring dimension to generate the first abnormality monitoring result.

[0047] In an optional embodiment, the device further comprises:

[0048] A second occurrence data acquisition module is configured to execute acquisition of second occurrence data of the abnormal event corresponding to the preset business under at least one second monitoring dimension, wherein the second occurrence data is the number of occurrences corresponding to the current monitoring period, and the at least one second monitoring dimension is a monitoring dimension after an additional monitoring dimension is added to the abnormal monitoring dimension;

[0049] A second abnormality monitoring processing module is configured to execute an abnormality monitoring process by inputting the second occurrence data into a second abnormality recognition model to obtain the abnormal event corresponding to the at least one second monitoring dimension and the second abnormality indicator data corresponding to the current monitoring period;

[0050] The second abnormal monitoring result determination module is configured to determine the second abnormal monitoring result corresponding to the preset business based on the second abnormal indicator data, and the second abnormal monitoring result represents the target abnormal event corresponding to the target abnormal monitoring dimension in the at least one second monitoring dimension.

[0051] In an optional embodiment, the second abnormal monitoring result determination module includes:

[0052] The second abnormality determination unit is configured to execute a preset event corresponding to any second monitoring dimension, and when the second abnormal indicator data corresponding to the current monitoring period is greater than or equal to the second preset threshold, the abnormal event corresponding to the second monitoring dimension in which the second abnormal indicator data corresponding to the current monitoring period is greater than or equal to the second preset threshold is used as the target abnormal event corresponding to the target abnormal monitoring dimension;

[0053] The second abnormality monitoring result generating unit is configured to execute the target abnormality event corresponding to the target abnormality monitoring dimension to generate the second abnormality monitoring result.

[0054] In an optional embodiment, the preset service is a login state verification service, the at least one first monitoring dimension is at least one service, the additional monitoring dimension is at least one area, the second abnormal monitoring result represents a target abnormal event in the abnormal area corresponding to the abnormal service, and the device further includes:

[0055] An abnormal area determination module is configured to execute a region in the at least one region where the corresponding second abnormal indicator data is greater than or equal to the second preset threshold as the abnormal area;

[0056] A second area number determination module is configured to determine the first area number corresponding to the abnormal area and the second area number corresponding to the target area, wherein the target area is an area in the at least one area that participates in the abnormality monitoring process;

[0057] The second abnormality monitoring result generating unit is also configured to generate the second abnormality monitoring result according to the target abnormality event corresponding to the target abnormality monitoring dimension when the number of the first areas is greater than the first area threshold and the number of the second areas is greater than the second area threshold.

[0058] In an optional embodiment, the device further comprises:

[0059] A second data filtering module is configured to filter the second occurrence data based on a second numerical threshold to obtain second target occurrence data;

[0060] The second abnormality monitoring processing module is further configured to execute abnormality monitoring processing by inputting the second target occurrence data into the second abnormality recognition model to obtain the second abnormality indicator data.

[0061] In an optional embodiment, the device further comprises:

[0062] A training data module is configured to execute acquisition of first sample occurrence data of at least one preset event corresponding to the preset business under the at least one first monitoring dimension and preset abnormal indicator data corresponding to the first sample occurrence data, wherein the first sample occurrence data is the number of occurrences corresponding to each of multiple adjacent historical time periods within multiple historical monitoring cycles;

[0063] A third anomaly monitoring and processing module is configured to input the first sample occurrence data into a preset machine learning model for anomaly monitoring processing, and obtain at least one preset event corresponding to the at least one first monitoring dimension and corresponding sample anomaly indicator data in the multiple adjacent historical time periods;

[0064] a target loss information determination module, configured to determine target loss information according to the preset abnormal indicator data and the sample abnormal indicator data;

[0065] The model training module is configured to train the preset machine learning model based on the target loss information to obtain the first abnormality monitoring model.

[0066] According to a third aspect of an embodiment of the present disclosure, an electronic device is provided, comprising: a processor; and a memory for storing instructions executable by the processor; wherein the processor is configured to execute the instructions to implement a method as described in any one of the above-mentioned first aspects.

[0067] According to a fourth aspect of an embodiment of the present disclosure, a computer-readable storage medium is provided. When instructions in the storage medium are executed by a processor of an electronic device, the electronic device is enabled to execute any method described in the first aspect of the embodiment of the present disclosure.

[0068] According to a fifth aspect of an embodiment of the present disclosure, there is provided a computer program product comprising instructions, which, when executed on a computer, enables the computer to execute any one of the methods described in the first aspect of the embodiment of the present disclosure.

[0069] The technical solution provided by the embodiments of the present disclosure brings at least the following beneficial effects:

[0070] By using the first occurrence data of at least one preset event corresponding to a preset business under at least one first monitoring dimension as the input of the first abnormality monitoring model to perform abnormality monitoring processing, it is possible to implement business abnormality monitoring according to the monitoring dimension and improve the versatility of abnormality monitoring in different business scenarios. The first occurrence data is the number of occurrences corresponding to multiple adjacent time periods in the current monitoring cycle, which can effectively reflect the abnormal fluctuation trend of the business and effectively ensure the accuracy of the first abnormal indicator data in representing the probability of abnormality due to any preset event in each adjacent time period of the preset business under the first monitoring dimension. Furthermore, based on the first abnormal indicator data, the abnormal factors can be quickly and accurately located, which greatly improves the efficiency and accuracy of business abnormality monitoring, thereby improving the effective alarm rate and reducing business abnormalities.

[0071] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0072] The drawings herein are incorporated into and constitute a part of the specification, illustrate embodiments consistent with the present disclosure, and together with the description are used to explain the principles of the present disclosure, and do not constitute improper limitations on the present disclosure.

[0073] Figure 1 is a schematic diagram of an application environment according to an exemplary embodiment;

[0074] Figure 2 is a flow chart of a method for monitoring business anomalies according to an exemplary embodiment;

[0075] Figure 3 is a flowchart showing a method of pre-training a first abnormality monitoring model according to an exemplary embodiment;

[0076] Figure 4 is a flow chart of another method for monitoring business anomalies according to an exemplary embodiment;

[0077] Figure 5 is a flow chart of another method for monitoring business anomalies according to an exemplary embodiment;

[0078] Figure 6 is a block diagram of a service anomaly monitoring device according to an exemplary embodiment;

[0079] Figure 7 is a block diagram of an electronic device for business anomaly monitoring according to an exemplary embodiment;

[0080] Figure 8 The invention is a block diagram of an electronic device for monitoring service anomalies according to an exemplary embodiment. DETAILED DESCRIPTION

[0081] In order to enable ordinary persons in the art to better understand the technical solutions of the present disclosure, the technical solutions in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the accompanying drawings.

[0082] It should be noted that the terms "first", "second", etc. in the specification and claims of the present disclosure and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present disclosure described herein can be implemented in an order other than those illustrated or described herein. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present disclosure. Instead, they are merely examples of devices and methods consistent with some aspects of the present disclosure as detailed in the appended claims.

[0083] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data for display, data for analysis, etc.) involved in this disclosure are all information and data authorized by the user or fully authorized by all parties.

[0084] See also Figure 1 , Figure 1 is a schematic diagram of an application environment according to an exemplary embodiment. Figure 1 As shown, the application environment may include a terminal 100 and a server 200 .

[0085] In an optional embodiment, the terminal 100 can be used to provide preset business services. Specifically, the terminal 100 may include but is not limited to electronic devices such as smart phones, desktop computers, tablet computers, laptops, smart speakers, digital assistants, augmented reality (AR) / virtual reality (VR) devices, smart wearable devices, etc., and may also be software running on the above electronic devices, such as applications. Optionally, the operating system running on the electronic device may include but is not limited to Android system, IOS system, Linux, Windows, etc.

[0086] In an optional embodiment, the server 200 can provide background services for the terminal 100, and perform business anomaly monitoring and processing. Optionally, the server 200 can pre-train an anomaly monitoring model. Accordingly, business anomaly monitoring and processing can be performed in combination with the anomaly monitoring model. Specifically, the server 200 can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms.

[0087] In addition, it should be noted that Figure 1 What is shown is only one application environment provided by the present disclosure. In actual application, other application environments may also be included. For example, business anomaly monitoring and processing may also be implemented in the terminal.

[0088] In the embodiments of this specification, the terminal 100 and the server 200 may be directly or indirectly connected via wired or wireless communication, which is not limited in this disclosure.

[0089] Figure 2 is a flow chart of a method for monitoring business anomalies according to an exemplary embodiment. Figure 2 As shown, the service anomaly monitoring method is used in electronic devices such as terminals and servers, and includes the following steps.

[0090] In step S201, first occurrence data of at least one preset event corresponding to a preset business under at least one first monitoring dimension is obtained.

[0091] In a specific embodiment, the preset service may correspond to different services in combination with actual application requirements, for example, the preset service may be a login status verification service, an information push service, a text message delivery service, etc. Optionally, at least one first monitoring dimension may be a dimension for monitoring service anomalies, and specifically, it may vary in combination with different monitoring requirements under actual services. The above-mentioned at least one preset event may be an event associated with an abnormality of the preset service, and specifically, it may vary in combination with different preset services.

[0092] In a specific embodiment, business anomaly monitoring can be performed regularly in combination with actual needs, and accordingly, the above-mentioned first occurrence data can be the number of occurrences corresponding to multiple adjacent time periods in the current monitoring cycle; optionally, assuming that the period of business anomaly monitoring is 3 minutes, 3 minutes can be divided into 3 adjacent time periods, and accordingly, each adjacent time period can be 1 minute. Optionally, the number of occurrences of at least one preset event corresponding to a preset business under at least one first monitoring dimension (first occurrence data) can be obtained every minute.

[0093] In a specific embodiment, taking the login state verification service as an example, and the monitoring requirement is to perform abnormal monitoring on the login state verification service in at least one service, accordingly, the at least one first monitoring dimension can be at least one service, and specifically, at least one service can be at least one business service that needs to perform login state verification. Optionally, at least one preset event can include a Token error event, a Token decryption error event, a UserId (user ID) in a parameter and a Token mismatch event, and a Token expired event, etc.

[0094] In a specific embodiment, taking the preset service as the SMS sending service as an example, and the monitoring requirement is to perform abnormal monitoring on the SMS sending service of at least one area, accordingly, the at least one first monitoring dimension mentioned above can be at least one SMS sending area, and optionally, at least one preset event can include an information service provision failure event, an SMS type error event, an SMS application scenario error event, and an SMS signature error event, etc.

[0095] In a specific embodiment, taking the preset service as an information push service as an example, and the monitoring requirement is to perform abnormal monitoring of the information push service on the model of at least one information push device, accordingly, the at least one first monitoring dimension mentioned above can be the model of at least one information push device. Optionally, at least one preset event may include a push channel failure event, a network error event, etc.

[0096] In step S203, the first occurrence data is input into the first anomaly monitoring model for anomaly monitoring processing to obtain at least one preset event corresponding to at least one first monitoring dimension and first anomaly indicator data corresponding to multiple adjacent time periods;

[0097] In a specific embodiment, at least one preset event corresponding to at least one of the above-mentioned first monitoring dimensions and the corresponding first abnormal indicator data in the above-mentioned multiple adjacent time periods can characterize the probability that the preset business under any first monitoring dimension will be abnormal due to any preset event in each adjacent time period. Specifically, taking the above-mentioned scenario where abnormal monitoring of the login state verification business in at least one service is required as an example, the first abnormal indicator data can characterize the probability that the login state verification business of any service will be abnormal due to any preset event in each adjacent time period.

[0098] In a specific embodiment, the above-mentioned first anomaly monitoring model can be a model obtained by pre-training a preset machine learning model for anomaly monitoring processing based on the first training data. Specifically, the first training data may include first sample occurrence data of at least one preset event corresponding to a preset business under at least one first monitoring dimension and preset abnormal indicator data corresponding to the first sample occurrence data, wherein the first sample occurrence data is the number of occurrences corresponding to each of multiple adjacent historical time periods within multiple historical monitoring cycles. Specifically, any historical monitoring cycle may include multiple adjacent historical time periods. The preset abnormal indicator data corresponding to the first sample occurrence data of a certain preset event corresponding to a preset business under a certain first monitoring dimension can represent the actual probability of an abnormality occurring in each adjacent historical time period due to the preset event in the preset business under the first monitoring dimension.

[0099] In an optional embodiment, the above method may further include: a step of pre-training a first abnormality monitoring model, specifically, Figure 3 As shown, the following steps may be included:

[0100] In step S301, first sample occurrence data of at least one preset event corresponding to a preset business under at least one first monitoring dimension and preset abnormal indicator data corresponding to the first sample occurrence data are obtained;

[0101] In step S303, the first sample occurrence data is input into a preset machine learning model for abnormal monitoring processing to obtain at least one preset event corresponding to at least one first monitoring dimension and corresponding sample abnormality indicator data in multiple adjacent historical time periods;

[0102] In a specific embodiment, the sample abnormality indicator data corresponding to a certain preset event corresponding to a preset business under a first monitoring dimension in multiple adjacent historical time periods can represent the probability of the preset business under the first monitoring dimension predicted by the preset machine learning model to be abnormal due to the preset event in multiple adjacent historical time periods.

[0103] In step S305, target loss information is determined according to the preset abnormal index data and the sample abnormal index data;

[0104] In a specific embodiment, the target loss information may be determined in combination with a preset loss function. Specifically, the target loss information may represent the degree of difference between the preset abnormal index data and the sample abnormal index data.

[0105] In step S307, based on the target loss information, a preset machine learning model is trained to obtain a first abnormality monitoring model.

[0106] In a specific embodiment, the above-mentioned training of a preset machine learning model based on the target loss information to obtain a first abnormality monitoring model may include: updating the model parameters of the preset machine learning model based on the target loss information; based on the updated preset machine learning model, repeating step S303 to update the training iteration operation of the model parameters of the preset machine learning model based on the target loss information until the training convergence condition is met; and using the preset machine learning model obtained when the training convergence condition is met as the first abnormality monitoring model.

[0107] In a specific embodiment, the above-mentioned training convergence condition can be that the number of training iteration operations reaches a preset number of training times. Optionally, the preset convergence condition can also be that the target loss information is less than a specified threshold. In the embodiments of this specification, the preset number of training times and the specified threshold can be pre-set in combination with the training speed of the model and the accuracy of abnormal monitoring processing in actual applications.

[0108] In the above embodiment, the preset machine learning model is trained by combining the first sample occurrence data of at least one preset event corresponding to the preset business under at least one first monitoring dimension and the preset abnormal indicator data corresponding to the first sample occurrence data. A first abnormality monitoring model can be trained that can predict the abnormal indicator data of at least one preset event corresponding to the preset business under at least one first monitoring dimension, thereby improving the efficiency of subsequent business abnormality monitoring and processing.

[0109] In an optional embodiment, if Figure 4 As shown, the above method may also include:

[0110] In step S207, the first occurrence data is filtered based on the first number threshold to obtain the first target occurrence data;

[0111] Correspondingly, the first occurrence data is input into the first anomaly monitoring model for anomaly monitoring processing to obtain at least one preset event corresponding to at least one first monitoring dimension, and the corresponding first anomaly indicator data in multiple adjacent time periods include: the first target occurrence data is input into the first anomaly monitoring model for anomaly monitoring processing to obtain the first anomaly indicator data.

[0112] In a specific embodiment, the first number threshold may be set in combination with actual applications.

[0113] In actual applications, some preset events associated with preset business anomalies may occur during the preset business processing, but within a controllable range, they will not cause business anomalies. Accordingly, the number of occurrences in the first occurrence data that is less than or equal to the first number threshold can be filtered out to obtain the above-mentioned first target occurrence data.

[0114] In the above embodiment, by filtering out the first occurrence data with a lower number of occurrences based on the first number threshold, the data associated with the preset business anomaly can be effectively screened out, thereby reducing the amount of data for anomaly monitoring and processing and improving the efficiency of anomaly monitoring and processing on the basis of improving the effectiveness of anomaly monitoring and processing.

[0115] In step S205, based on the first abnormal indicator data, a first abnormal monitoring result corresponding to the preset business is determined.

[0116] In a specific embodiment, the above-mentioned first abnormal monitoring result can characterize the abnormal event corresponding to the abnormal monitoring dimension in the above-mentioned at least one first monitoring dimension. Taking the login state verification service as an example, assuming that at least one first monitoring dimension can be at least one service, correspondingly, the first abnormal monitoring result can characterize the abnormal event corresponding to the abnormal service in at least one service, that is, the service with an abnormality can be determined through the first abnormal monitoring result, and the abnormality of the service with an abnormality is caused by the preset event (corresponding abnormal event).

[0117] In an optional embodiment, determining the first abnormal monitoring result corresponding to the preset service based on the first abnormal indicator data may include:

[0118] In the case where the first abnormal indicator data corresponding to any preset event corresponding to the first monitoring dimension in multiple adjacent time periods are all greater than or equal to the first preset threshold, the preset event corresponding to the first monitoring dimension in which the first abnormal indicator data corresponding to the multiple adjacent time periods are all greater than or equal to the first preset threshold is taken as the abnormal event corresponding to the abnormal monitoring dimension;

[0119] Based on the abnormal event corresponding to the abnormal monitoring dimension, a first abnormal monitoring result is generated.

[0120] In a specific embodiment, the first preset threshold value can be set in combination with actual applications. Specifically, the abnormal event corresponding to the abnormal monitoring dimension can be used as the first abnormal monitoring result. Optionally, the abnormal event corresponding to the abnormal monitoring dimension can also be converted into a preset data form (such as a list, etc.) as the above-mentioned first abnormal monitoring result.

[0121] In the above embodiment, combining the corresponding first abnormal indicator data in multiple adjacent time periods can effectively reflect the fluctuation trend of the occurrence of preset events corresponding to at least one first monitoring dimension, and then quickly and accurately determine the abnormal events corresponding to the abnormal monitoring dimension, thereby greatly improving the efficiency and accuracy of business abnormality monitoring.

[0122] In an optional embodiment, if Figure 5 As shown, the above method may also include:

[0123] In step S209, second occurrence data of an abnormal event corresponding to a preset business under at least one second monitoring dimension is obtained;

[0124] In a specific embodiment, the second occurrence data may be the number of occurrences corresponding to the current monitoring period, and the at least one second monitoring dimension may be a monitoring dimension after an additional monitoring dimension is added to the abnormal monitoring dimension. Specifically, the additional monitoring dimension may be a dimension for monitoring business abnormalities added on the basis of the abnormal monitoring dimension determined in combination with the first abnormal indicator data.

[0125] In an optional embodiment, assuming that the preset service is a login state verification service, and the monitoring requirement is to monitor the abnormal situation of the login state verification service in the abnormal service in at least one area, accordingly, the above-mentioned additional monitoring dimension can be at least one area; at least one second monitoring dimension can be at least one area corresponding to at least one abnormal service, that is, the first abnormal monitoring result can be combined, and on the basis of the abnormal event corresponding to at least one abnormal service represented by the first abnormal monitoring result, the regional dimension is introduced to obtain the abnormal event corresponding to at least one abnormal service, and the number of occurrences (second occurrence data) when the login state verification is performed in at least one area, so as to monitor the abnormal situation of the login state verification service in the abnormal service in at least one area. In a specific embodiment, assuming that a certain service corresponds to 5 preset events, wherein the first abnormal indicator data of the 3 preset events corresponding to the service are all greater than the first preset threshold value, accordingly, in the case where the above-mentioned additional monitoring dimension is at least one area, the number of occurrences of these 3 preset events of this service in at least one area can be obtained, and the selected number of occurrences is the number of occurrences in the current monitoring cycle.

[0126] In another optional embodiment, assuming that the preset service is an information push service, and the monitoring requirement is to perform abnormal monitoring on the information push service of at least one push application version corresponding to at least one abnormal model, accordingly, the above-mentioned additional monitoring dimension can be the application version (push application version) corresponding to at least one information push application, and at least one second monitoring dimension can be at least one push application version corresponding to at least one abnormal model, that is, in combination with the first abnormal monitoring result, on the basis of the abnormal event corresponding to at least one abnormal model represented by the first abnormal monitoring result, the push application version dimension can be introduced to obtain the number of occurrences (second occurrence data) of the abnormal event corresponding to at least one abnormal model in the information push service of at least one push application version, so as to perform abnormal monitoring of the information push service of at least one push application version corresponding to at least one abnormal model.

[0127] In step S211, the second occurrence data is input into the second anomaly recognition model for anomaly monitoring processing to obtain at least one abnormal event corresponding to the second monitoring dimension and second abnormal indicator data corresponding to the current monitoring period;

[0128] In a specific embodiment, the abnormal event corresponding to at least one of the above-mentioned second monitoring dimensions and the second abnormal indicator data corresponding to the current monitoring period can characterize the probability that the preset service under any second monitoring dimension will be abnormal due to the abnormal event in the current monitoring period. Specifically, taking the above-mentioned scenario where the abnormal situation of the login state verification service in at least one area in the abnormal service needs to be monitored as an example, the second abnormal indicator data can characterize the probability that the login state verification service of the abnormal service will be abnormal due to the corresponding abnormal event in the current monitoring period.

[0129] In a specific embodiment, the above-mentioned second anomaly monitoring model may be a model obtained by pre-training a preset machine learning model for anomaly monitoring and processing based on second training data. Specifically, the second training data may include second sample occurrence data of abnormal events corresponding to a preset business under at least one second monitoring dimension and preset abnormal indicator data corresponding to the second sample occurrence data, wherein the second sample occurrence data may be the number of occurrences corresponding to each of multiple historical monitoring cycles.

[0130] In a specific embodiment, the specific details of the above-mentioned pre-trained second abnormality monitoring model can refer to the specific details of the above-mentioned pre-trained first abnormality monitoring model, which will not be repeated here.

[0131] In a specific embodiment, the above method may further include:

[0132] Filtering the second occurrence data based on the second numerical threshold to obtain second target occurrence data;

[0133] Correspondingly, the second occurrence data is input into the second anomaly recognition model for anomaly monitoring processing to obtain second anomaly indicator data corresponding to an abnormal event under at least one second monitoring dimension, including:

[0134] The second target occurrence data is input into the second anomaly recognition model for anomaly monitoring processing to obtain second anomaly indicator data.

[0135] In a specific embodiment, the second number threshold can be set in combination with actual applications. Optionally, the number of occurrences less than or equal to the second number threshold in the second occurrence data can be filtered out to obtain the above second target occurrence data.

[0136] In the above embodiment, filtering out the second occurrence data with a lower number of occurrences based on the second number threshold can better screen out data associated with a preset business anomaly under at least one second monitoring dimension, thereby reducing the amount of data for anomaly monitoring and processing and improving the efficiency of anomaly monitoring and processing on the basis of improving the effectiveness of anomaly monitoring and processing.

[0137] In step S213, based on the second abnormal indicator data, a second abnormal monitoring result corresponding to the preset business is determined.

[0138] In a specific embodiment, the second abnormal monitoring result may characterize a target abnormal event corresponding to a target abnormal monitoring dimension in at least one second monitoring dimension. In an optional embodiment, the second abnormal monitoring result corresponding to the preset business determined based on the second abnormal indicator data may include:

[0139] In any preset event corresponding to the second monitoring dimension, when the second abnormal indicator data corresponding to the current monitoring period is greater than or equal to the second preset threshold, the abnormal event corresponding to the second monitoring dimension in which the second abnormal indicator data corresponding to the current monitoring period is greater than or equal to the second preset threshold is used as the target abnormal event corresponding to the target abnormal monitoring dimension;

[0140] A second abnormality monitoring result is generated according to the target abnormality event corresponding to the target abnormality monitoring dimension.

[0141] In a specific embodiment, the second preset threshold value can be set in combination with the actual application. Specifically, the target abnormal event corresponding to the target abnormal monitoring dimension can be used as the second abnormal monitoring result. Optionally, the target abnormal event corresponding to the target abnormal monitoring dimension can also be converted into a preset data form (such as a list, etc.) as the above-mentioned second abnormal monitoring result.

[0142] In the above embodiment, in combination with the second abnormal indicator data corresponding to the current monitoring period, the abnormal event corresponding to the second monitoring dimension in which the second abnormal indicator data corresponding to the current monitoring period is greater than or equal to the second preset threshold value is used as the target abnormal event corresponding to the target abnormal monitoring dimension, so that the abnormal monitoring result under at least one second monitoring dimension can be determined quickly and accurately, greatly improving the efficiency and accuracy of business abnormality monitoring. And on the basis of business abnormality monitoring according to at least one first monitoring dimension, combined with the first abnormal monitoring result, adding monitoring dimensions can realize abnormal monitoring of different monitoring dimensions, meet different monitoring needs, and thus better improve the accuracy and effective alarm rate of abnormal monitoring, and reduce the probability of abnormal false alarm.

[0143] In an optional embodiment, when the preset service is a login state verification service, at least one first monitoring dimension is at least one service, and the additional monitoring dimension is at least one region (for example, at least one city, at least one province, etc.), the second abnormal monitoring result may characterize the target abnormal event in the abnormal region corresponding to the abnormal service. Optionally, the method may further include:

[0144] The area in which the corresponding second abnormal indicator data in at least one area is greater than or equal to the second preset threshold is regarded as an abnormal area;

[0145] Determine the number of first regions corresponding to the abnormal region and the number of second regions corresponding to the target region;

[0146] Correspondingly, the above-mentioned generating a second abnormality monitoring result according to the target abnormality event corresponding to the target abnormality monitoring dimension includes:

[0147] When the number of first areas is greater than the first area threshold and the number of second areas is greater than the second area threshold, a second abnormality monitoring result is generated according to the target abnormal event corresponding to the target abnormality monitoring dimension.

[0148] In a specific embodiment, the first region threshold and the second region threshold can be set in combination with actual applications, wherein the first region threshold is smaller than the second region threshold. Specifically, the target region is a region in at least one region that participates in abnormal monitoring processing.

[0149] In practical applications, when the number of first areas of abnormal areas where the second abnormal indicator data is greater than or equal to the second preset threshold is greater than the first area threshold, and the number of second areas of the target area participating in the abnormal monitoring process is greater than the second area threshold, the effectiveness of the target abnormal event corresponding to the target abnormal monitoring dimension determined in combination with the second abnormal indicator data can be characterized, and then the second abnormal monitoring result can be generated according to the target abnormal event corresponding to the target abnormal monitoring dimension.

[0150] In the above embodiment, during the abnormal monitoring and processing of the login state verification business, combining the first area number of abnormal areas whose second abnormal indicator data is greater than or equal to the second preset threshold, and the second area number of the target area participating in the abnormal monitoring processing, the effectiveness of identifying the target abnormal events corresponding to the target abnormal monitoring dimension can be better improved, and then the area information corresponding to the service invaded by the black industry can be accurately determined, thereby better improving the accuracy and effectiveness of business abnormality monitoring.

[0151] In a specific embodiment, when abnormal monitoring results are obtained, relevant personnel can promptly perform corresponding repair processing on the abnormal factors (abnormal events corresponding to a certain abnormal service), thereby ensuring normal processing of the business.

[0152] It can be seen from the technical solutions provided in the above embodiments of this specification that this specification uses the first occurrence data of at least one preset event corresponding to a preset business under at least one first monitoring dimension as the input of the first abnormal monitoring model to perform abnormal monitoring processing, which can realize business abnormality monitoring according to the monitoring dimension and improve the versatility of abnormal monitoring in different business scenarios. The first occurrence data is the number of occurrences corresponding to multiple adjacent time periods in the current monitoring cycle, which can effectively reflect the abnormal fluctuation trend of the business, and effectively ensure the accuracy of the obtained first abnormal indicator data in representing the probability of abnormality due to any preset event in each adjacent time period of the preset business under the first monitoring dimension. Based on the first abnormal indicator data, the abnormal factors can be located quickly and accurately, which greatly improves the efficiency and accuracy of business abnormality monitoring, thereby improving the effective alarm rate and reducing business abnormalities.

[0153] Figure 6 FIG. 1 is a block diagram of a device for monitoring abnormal business operations according to an exemplary embodiment. Figure 6 , the device comprises:

[0154] The first occurrence data acquisition module 610 is configured to execute the acquisition of first occurrence data of at least one preset event corresponding to a preset business under at least one first monitoring dimension, where the first occurrence data is the number of occurrences corresponding to each of a plurality of adjacent time periods within a current monitoring cycle;

[0155] The first abnormality monitoring processing module 620 is configured to execute the abnormality monitoring processing by inputting the first occurrence data into the first abnormality monitoring model, and obtain the first abnormality indicator data corresponding to at least one preset event corresponding to at least one first monitoring dimension in multiple adjacent time periods;

[0156] The first abnormal monitoring result determination module 630 is configured to determine a first abnormal monitoring result corresponding to a preset business based on the first abnormal indicator data, where the first abnormal monitoring result represents an abnormal event corresponding to an abnormal monitoring dimension in at least one first monitoring dimension.

[0157] In an optional embodiment, the above device further includes:

[0158] A first data filtering module is configured to filter the first occurrence data based on a first number threshold to obtain first target occurrence data;

[0159] The first abnormality monitoring processing module 620 is further configured to input the first target occurrence data into the first abnormality monitoring model for abnormality monitoring processing to obtain first abnormality indicator data.

[0160] In an optional embodiment, the first abnormal monitoring result determination module 630 includes:

[0161] The first abnormality determination unit is configured to execute a preset event corresponding to any first monitoring dimension, and when the corresponding first abnormal indicator data in multiple adjacent time periods are all greater than or equal to the first preset threshold, the preset event corresponding to the first monitoring dimension in which the corresponding first abnormal indicator data in multiple adjacent time periods are all greater than or equal to the first preset threshold is used as the abnormal event corresponding to the abnormal monitoring dimension;

[0162] The first abnormal monitoring result generating unit is configured to execute an abnormal event corresponding to the abnormal monitoring dimension to generate a first abnormal monitoring result.

[0163] In an optional embodiment, the above device further includes:

[0164] A second occurrence data acquisition module is configured to execute acquisition of second occurrence data of an abnormal event corresponding to a preset business under at least one second monitoring dimension, where the second occurrence data is the number of occurrences corresponding to a current monitoring period, and at least one second monitoring dimension is a monitoring dimension after an additional monitoring dimension is added to the abnormal monitoring dimension;

[0165] A second abnormality monitoring processing module is configured to execute the second occurrence data input into the second abnormality recognition model for abnormality monitoring processing, and obtain at least one abnormal event corresponding to the second monitoring dimension and second abnormal indicator data corresponding to the current monitoring period;

[0166] The second abnormal monitoring result determination module is configured to determine the second abnormal monitoring result corresponding to the preset business based on the second abnormal indicator data, and the second abnormal monitoring result represents a target abnormal event corresponding to a target abnormal monitoring dimension in at least one second monitoring dimension.

[0167] In an optional embodiment, the second abnormal monitoring result determination module includes:

[0168] The second abnormality determination unit is configured to execute a preset event corresponding to any second monitoring dimension, and when the second abnormal indicator data corresponding to the current monitoring period is greater than or equal to the second preset threshold, the abnormal event corresponding to the second monitoring dimension in which the second abnormal indicator data corresponding to the current monitoring period is greater than or equal to the second preset threshold is used as the target abnormal event corresponding to the target abnormal monitoring dimension;

[0169] The second abnormality monitoring result generating unit is configured to execute a target abnormality event corresponding to a target abnormality monitoring dimension to generate a second abnormality monitoring result.

[0170] In an optional embodiment, the preset service is a login state verification service, at least one first monitoring dimension is at least one service, the additional monitoring dimension is at least one area, and the second abnormal monitoring result represents a target abnormal event in the abnormal area corresponding to the abnormal service. The above-mentioned device also includes:

[0171] The abnormal area determination module is configured to determine an area in which the corresponding second abnormal indicator data of at least one area is greater than or equal to a second preset threshold value as an abnormal area;

[0172] A second area number determination module is configured to determine the first area number corresponding to the abnormal area and the second area number corresponding to the target area, where the target area is an area participating in the abnormal monitoring process in at least one area;

[0173] The second abnormality monitoring result generating unit is also configured to generate a second abnormality monitoring result according to a target abnormal event corresponding to a target abnormality monitoring dimension when the number of first areas is greater than a first area threshold and the number of second areas is greater than a second area threshold.

[0174] In an optional embodiment, the above device further includes:

[0175] A second data filtering module is configured to filter the second occurrence data based on the second numerical threshold to obtain second target occurrence data;

[0176] The second abnormality monitoring processing module is further configured to execute abnormality monitoring processing by inputting the second target occurrence data into the second abnormality recognition model to obtain second abnormality indicator data.

[0177] In an optional embodiment, the above device further includes:

[0178] The training data module is configured to execute the acquisition of first sample occurrence data of at least one preset event corresponding to a preset business under at least one first monitoring dimension and preset abnormal indicator data corresponding to the first sample occurrence data, wherein the first sample occurrence data is the number of occurrences corresponding to each of multiple adjacent historical time periods within multiple historical monitoring cycles;

[0179] A third anomaly monitoring and processing module is configured to execute anomaly monitoring and processing by inputting the first sample occurrence data into a preset machine learning model to obtain at least one preset event corresponding to at least one first monitoring dimension and corresponding sample anomaly indicator data in multiple adjacent historical time periods;

[0180] A target loss information determination module is configured to determine target loss information according to preset abnormal indicator data and sample abnormal indicator data;

[0181] The model training module is configured to execute training of a preset machine learning model based on target loss information to obtain a first anomaly monitoring model.

[0182] Regarding the device in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0183] Figure 7 is a block diagram of an electronic device for business anomaly monitoring according to an exemplary embodiment. The electronic device may be a terminal, and its internal structure diagram may be as shown in FIG. Figure 7 As shown. The electronic device includes a processor, a memory, a network interface, a display screen and an input device connected through a system bus. Among them, the processor of the electronic device is used to provide computing and control capabilities. The memory of the electronic device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The network interface of the electronic device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a method for monitoring business anomalies is implemented. The display screen of the electronic device can be a liquid crystal display screen or an electronic ink display screen, and the input device of the electronic device can be a touch layer covering the display screen, or a button, trackball or touchpad set on the housing of the electronic device, or an external keyboard, touchpad or mouse, etc.

[0184] Figure 8 is a block diagram of an electronic device for business anomaly monitoring according to an exemplary embodiment. The electronic device may be a server, and its internal structure diagram may be as shown in FIG. Figure 8As shown. The electronic device includes a processor, a memory and a network interface connected through a system bus. Among them, the processor of the electronic device is used to provide computing and control capabilities. The memory of the electronic device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The network interface of the electronic device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a business anomaly monitoring method is implemented.

[0185] Those skilled in the art will understand that Figure 7 or Figure 8 The structure shown in the figure is merely a block diagram of a partial structure related to the scheme of the present disclosure, and does not constitute a limitation on the electronic device to which the scheme of the present disclosure is applied. The specific electronic device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0186] In an exemplary embodiment, an electronic device is also provided, including: a processor; a memory for storing instructions executable by the processor; wherein the processor is configured to execute the instructions to implement the business anomaly monitoring method as in the embodiment of the present disclosure.

[0187] In an exemplary embodiment, a computer-readable storage medium is also provided. When instructions in the storage medium are executed by a processor of an electronic device, the electronic device can execute the service anomaly monitoring method in the embodiment of the present disclosure.

[0188] In an exemplary embodiment, a computer program product including instructions is also provided. When the computer program product is run on a computer, the computer is enabled to execute the service anomaly monitoring method in the embodiment of the present disclosure.

[0189] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0190] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of the present disclosure that follow the general principles of the present disclosure and include common knowledge or customary techniques in the art that are not disclosed in the present disclosure. The specification and examples are intended to be exemplary only, and the true scope and spirit of the present disclosure are indicated by the following claims.

[0191] It should be understood that the present disclosure is not limited to the exact structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present disclosure is limited only by the appended claims.

Claims

1. A method for monitoring business anomalies, characterized in that: include: Obtaining first occurrence data of at least one preset event corresponding to a preset business under at least one first monitoring dimension, where the first occurrence data is the number of occurrences corresponding to each of a plurality of adjacent time periods within a current monitoring cycle, and the at least one first monitoring dimension is at least one service; The first occurrence data is input into a first anomaly monitoring model for anomaly monitoring processing, and at least one preset event corresponding to the at least one first monitoring dimension and first anomaly indicator data corresponding to the multiple adjacent time periods are obtained, wherein the first anomaly indicator data corresponding to the multiple adjacent time periods represent the probability that an abnormality occurs in the preset business under any first monitoring dimension in each adjacent time period due to any preset event, and the first anomaly monitoring model is a model obtained by training a preset machine learning model for anomaly monitoring processing based on first sample occurrence data of at least one preset event corresponding to the preset business under at least one first monitoring dimension and preset anomaly indicator data corresponding to the first sample occurrence data; Based on the first abnormal indicator data, a first abnormal monitoring result corresponding to the preset business is determined, and the first abnormal monitoring result represents an abnormal event corresponding to an abnormal monitoring dimension in the at least one first monitoring dimension.

2. The service anomaly monitoring method according to claim 1, characterized in that: The method further comprises: Filtering the first occurrence data based on a first number threshold to obtain first target occurrence data; The first occurrence data is input into the first abnormality monitoring model for abnormality monitoring processing to obtain at least one preset event corresponding to the at least one first monitoring dimension, and the corresponding first abnormality indicator data in the multiple adjacent time periods include: The first target occurrence data is input into the first anomaly monitoring model for anomaly monitoring processing to obtain the first anomaly indicator data.

3. The service anomaly monitoring method according to claim 1, characterized in that: The determining, based on the first abnormal indicator data, a first abnormal monitoring result corresponding to the preset service includes: In the case where the first abnormal indicator data corresponding to any preset event of the first monitoring dimension in the plurality of adjacent time periods are all greater than or equal to the first preset threshold, the preset event corresponding to the first monitoring dimension in which the first abnormal indicator data corresponding to the plurality of adjacent time periods are all greater than or equal to the first preset threshold is taken as the abnormal event corresponding to the abnormal monitoring dimension; Based on the abnormal event corresponding to the abnormal monitoring dimension, the first abnormal monitoring result is generated.

4. The method for monitoring business anomalies according to any one of claims 1 to 3, characterized in that: The method further comprises: Obtain second occurrence data of the abnormal event corresponding to the preset business under at least one second monitoring dimension, where the second occurrence data is the number of occurrences corresponding to the current monitoring period, and the at least one second monitoring dimension is a monitoring dimension after an additional monitoring dimension is added to the abnormal monitoring dimension; Inputting the second occurrence data into a second anomaly recognition model for anomaly monitoring processing to obtain the abnormal event corresponding to the at least one second monitoring dimension and the second abnormal indicator data corresponding to the current monitoring period; Based on the second abnormal indicator data, a second abnormal monitoring result corresponding to the preset business is determined, and the second abnormal monitoring result represents a target abnormal event corresponding to a target abnormal monitoring dimension in the at least one second monitoring dimension.

5. The service anomaly monitoring method according to claim 4, characterized in that: The determining, based on the second abnormal indicator data, a second abnormal monitoring result corresponding to the preset service includes: In the preset event corresponding to any second monitoring dimension, when the second abnormal indicator data corresponding to the current monitoring period is greater than or equal to the second preset threshold, the abnormal event corresponding to the second monitoring dimension whose second abnormal indicator data corresponding to the current monitoring period is greater than or equal to the second preset threshold is used as the target abnormal event corresponding to the target abnormal monitoring dimension; The second abnormality monitoring result is generated according to the target abnormality event corresponding to the target abnormality monitoring dimension.

6. The service anomaly monitoring method according to claim 5, characterized in that: The preset service is a login status verification service, the at least one first monitoring dimension is at least one service, the additional monitoring dimension is at least one area, the second abnormal monitoring result represents a target abnormal event in the abnormal area corresponding to the abnormal service, and the method further includes: The area where the second abnormal indicator data corresponding to the at least one area is greater than or equal to the second preset threshold is taken as the abnormal area; Determine the number of first regions corresponding to the abnormal region and the number of second regions corresponding to the target region, wherein the target region is a region participating in abnormal monitoring processing in the at least one region; The generating the second abnormality monitoring result according to the target abnormality event corresponding to the target abnormality monitoring dimension includes: When the number of the first areas is greater than the first area threshold and the number of the second areas is greater than the second area threshold, the second abnormality monitoring result is generated according to the target abnormality event corresponding to the target abnormality monitoring dimension.

7. The method for monitoring business anomalies according to claim 4, characterized in that: The method further comprises: Filtering the second occurrence data based on a second numerical threshold to obtain second target occurrence data; The inputting the second occurrence data into the second anomaly recognition model for anomaly monitoring processing to obtain the second anomaly indicator data corresponding to the abnormal event under the at least one second monitoring dimension includes: The second target occurrence data is input into the second anomaly recognition model for anomaly monitoring processing to obtain the second anomaly indicator data.

8. The method for monitoring business anomalies according to any one of claims 1 to 3, characterized in that: The method further comprises: Obtaining first sample occurrence data of at least one preset event corresponding to the preset business under the at least one first monitoring dimension and preset abnormal indicator data corresponding to the first sample occurrence data, wherein the first sample occurrence data is the number of occurrences corresponding to each of multiple adjacent historical time periods within multiple historical monitoring cycles; Inputting the first sample occurrence data into a preset machine learning model for abnormal monitoring processing, and obtaining at least one preset event corresponding to the at least one first monitoring dimension and corresponding sample abnormality indicator data in the multiple adjacent historical time periods; Determining target loss information according to the preset abnormal indicator data and the sample abnormal indicator data; Based on the target loss information, the preset machine learning model is trained to obtain the first abnormality monitoring model.

9. A service anomaly monitoring device, characterized in that: include: A first occurrence data acquisition module is configured to execute acquisition of first occurrence data of at least one preset event corresponding to a preset business under at least one first monitoring dimension, wherein the first occurrence data is the number of occurrences corresponding to each of a plurality of adjacent time periods within a current monitoring cycle, and the at least one first monitoring dimension is at least one service; A first abnormality monitoring and processing module is configured to execute abnormality monitoring processing by inputting the first occurrence data into a first abnormality monitoring model to obtain at least one preset event corresponding to the at least one first monitoring dimension and first abnormality indicator data corresponding to the multiple adjacent time periods, wherein the first abnormality indicator data corresponding to the multiple adjacent time periods represent the probability that an abnormality occurs in the preset business under any first monitoring dimension in each adjacent time period due to any preset event, and the first abnormality monitoring model is a model obtained by training a preset machine learning model for abnormality monitoring processing based on first sample occurrence data of at least one preset event corresponding to the preset business under at least one first monitoring dimension and preset abnormality indicator data corresponding to the first sample occurrence data; The first abnormal monitoring result determination module is configured to determine a first abnormal monitoring result corresponding to the preset business based on the first abnormal indicator data, wherein the first abnormal monitoring result represents an abnormal event corresponding to an abnormal monitoring dimension in the at least one first monitoring dimension.

10. The service anomaly monitoring device according to claim 9, characterized in that: The device also includes: A first data filtering module is configured to filter the first occurrence data based on a first number threshold to obtain first target occurrence data; The first abnormality monitoring processing module is further configured to input the first target occurrence data into the first abnormality monitoring model for abnormality monitoring processing to obtain the first abnormality indicator data.

11. The service anomaly monitoring device according to claim 9, characterized in that: The first abnormal monitoring result determination module includes: The first abnormality determination unit is configured to execute a preset event corresponding to any first monitoring dimension, and when the first abnormal indicator data corresponding to the multiple adjacent time periods are all greater than or equal to the first preset threshold, the preset event corresponding to the first monitoring dimension in which the first abnormal indicator data corresponding to the multiple adjacent time periods are all greater than or equal to the first preset threshold is used as the abnormal event corresponding to the abnormal monitoring dimension; The first abnormality monitoring result generating unit is configured to execute an abnormal event corresponding to the abnormality monitoring dimension to generate the first abnormality monitoring result.

12. The service anomaly monitoring device according to any one of claims 9 to 11, characterized in that: The device also includes: A second occurrence data acquisition module is configured to execute acquisition of second occurrence data of the abnormal event corresponding to the preset business under at least one second monitoring dimension, wherein the second occurrence data is the number of occurrences corresponding to the current monitoring period, and the at least one second monitoring dimension is a monitoring dimension after an additional monitoring dimension is added to the abnormal monitoring dimension; A second abnormality monitoring processing module is configured to execute an abnormality monitoring process by inputting the second occurrence data into a second abnormality recognition model to obtain the abnormal event corresponding to the at least one second monitoring dimension and the second abnormality indicator data corresponding to the current monitoring period; The second abnormal monitoring result determination module is configured to determine the second abnormal monitoring result corresponding to the preset business based on the second abnormal indicator data, and the second abnormal monitoring result represents the target abnormal event corresponding to the target abnormal monitoring dimension in the at least one second monitoring dimension.

13. The service anomaly monitoring device according to claim 12, characterized in that: The second abnormal monitoring result determination module includes: The second abnormality determination unit is configured to execute a preset event corresponding to any second monitoring dimension, and when the second abnormal indicator data corresponding to the current monitoring period is greater than or equal to the second preset threshold, the abnormal event corresponding to the second monitoring dimension in which the second abnormal indicator data corresponding to the current monitoring period is greater than or equal to the second preset threshold is used as the target abnormal event corresponding to the target abnormal monitoring dimension; The second abnormality monitoring result generating unit is configured to execute the target abnormality event corresponding to the target abnormality monitoring dimension to generate the second abnormality monitoring result.

14. The service anomaly monitoring device according to claim 13, characterized in that: The preset service is a login state verification service, the at least one first monitoring dimension is at least one service, the additional monitoring dimension is at least one area, the second abnormal monitoring result represents a target abnormal event in the abnormal area corresponding to the abnormal service, and the device further includes: An abnormal area determination module is configured to execute a region in the at least one region where the corresponding second abnormal indicator data is greater than or equal to the second preset threshold as the abnormal area; A second area number determination module is configured to determine the first area number corresponding to the abnormal area and the second area number corresponding to the target area, wherein the target area is an area in the at least one area that participates in the abnormality monitoring process; The second abnormality monitoring result generating unit is also configured to generate the second abnormality monitoring result according to the target abnormality event corresponding to the target abnormality monitoring dimension when the number of the first areas is greater than the first area threshold and the number of the second areas is greater than the second area threshold.

15. The service anomaly monitoring device according to claim 12, characterized in that: The device also includes: A second data filtering module is configured to filter the second occurrence data based on a second numerical threshold to obtain second target occurrence data; The second abnormality monitoring processing module is further configured to execute abnormality monitoring processing by inputting the second target occurrence data into the second abnormality recognition model to obtain the second abnormality indicator data.

16. The service anomaly monitoring device according to any one of claims 9 to 11, characterized in that: The device also includes: A training data module is configured to execute acquisition of first sample occurrence data of at least one preset event corresponding to the preset business under the at least one first monitoring dimension and preset abnormal indicator data corresponding to the first sample occurrence data, wherein the first sample occurrence data is the number of occurrences corresponding to each of multiple adjacent historical time periods within multiple historical monitoring cycles; A third anomaly monitoring and processing module is configured to input the first sample occurrence data into a preset machine learning model for anomaly monitoring processing, and obtain at least one preset event corresponding to the at least one first monitoring dimension and corresponding sample anomaly indicator data in the multiple adjacent historical time periods; a target loss information determination module, configured to determine target loss information according to the preset abnormal indicator data and the sample abnormal indicator data; The model training module is configured to train the preset machine learning model based on the target loss information to obtain the first abnormality monitoring model.

17. An electronic device, characterized in that: include: processor; a memory for storing instructions executable by the processor; The processor is configured to execute the instructions to implement the service anomaly monitoring method as described in any one of claims 1 to 8.

18. A computer-readable storage medium, characterized in that: When the instructions in the storage medium are executed by a processor of an electronic device, the electronic device is enabled to execute the service anomaly monitoring method as described in any one of claims 1 to 8.

Images