Artificial intelligence-based business monitoring method, device, and electronic equipment

Abstract

The present application provides a business monitoring method, device, electronic device and computer-readable storage medium based on artificial intelligence; it relates to monitoring and fault detection technology in the field of cloud technology; the method includes: obtaining multiple monitoring indicator curves corresponding to multiple servers in a business system to form a curve set; wherein each of the servers corresponds to at least one monitoring indicator curve; determining the degree of outlier of each monitoring indicator curve relative to the curve set, and sorting the multiple monitoring indicator curves in descending order based on the outlier degree; clustering the multiple monitoring indicator curves to obtain at least one curve cluster corresponding to the curve set; based on the at least one curve cluster, deduplicating the descending sorting results of the multiple monitoring indicator curves to obtain an abnormal monitoring curve. Through the present application, abnormal situations in the business system can be monitored in a timely and accurate manner.

Description

Technical Field

[0001] The present application relates to monitoring and fault detection technologies in the field of cloud technology, and in particular to an artificial intelligence-based business monitoring method, device, electronic device, and computer-readable storage medium. Background Art

[0002] With the development of monitoring and fault detection technologies in the field of cloud technology, people are using applications running on smartphones, tablets, and computers more and more frequently in their daily study and life. The stable operation of the business systems that these application products rely on is the basic guarantee for people's normal study and life.

[0003] During the operation of the business system, the operation and maintenance personnel will monitor the data changes of the monitoring indicators of multiple servers in the business system over time. In order to comprehensively monitor the operation status of the business system, it is necessary to present the data changes of multiple servers over time in the form of lines in the human-computer interaction interface. Due to the large number of servers in the business system, a lot of useless information that may interfere with the human-computer interaction interface is presented, resulting in the inability to timely discover abnormal situations in the business system, and further resulting in the inability to timely eliminate the abnormalities of the business system. Summary of the Invention

[0004] The embodiments of the present application provide an artificial intelligence-based business monitoring method, device, electronic device, and computer-readable storage medium, which can monitor abnormal situations in a business system in a timely and accurate manner.

[0005] The technical solution of the embodiment of the present application is implemented as follows:

[0006] The present invention provides an artificial intelligence-based service monitoring method, including:

[0007] Acquire multiple monitoring indicator curves corresponding to multiple servers in the business system to form a curve set;

[0008] Wherein, each of the servers corresponds to at least one monitoring indicator curve;

[0009] Determining the outlier degree of each monitoring indicator curve relative to the curve set, and sorting the plurality of monitoring indicator curves in descending order based on the outlier degree;

[0010] performing clustering processing on the plurality of monitoring indicator curves to obtain at least one curve cluster corresponding to the curve set;

[0011] Based on the at least one curve cluster, duplicate removal is performed on the descending sorting results of the multiple monitoring indicator curves to obtain an abnormal monitoring curve.

[0012] The present invention provides an artificial intelligence-based service monitoring device, including:

[0013] An acquisition module, configured to acquire a plurality of monitoring indicator curves corresponding to a plurality of servers in a business system to form a curve set; wherein each of the servers corresponds to at least one of the monitoring indicator curves;

[0014] a sorting module, configured to determine an outlier degree of each monitoring indicator curve relative to the curve set, and sort the plurality of monitoring indicator curves in descending order based on the outlier degree;

[0015] A clustering module, configured to perform clustering processing on the plurality of monitoring indicator curves to obtain at least one curve cluster corresponding to the curve set;

[0016] The deduplication module is used to perform deduplication processing on the descending sorting processing results of the multiple monitoring indicator curves based on the at least one curve cluster to obtain an abnormal monitoring curve.

[0017] In the above scheme, each monitoring indicator curve is used to characterize the data changes of the corresponding server for the indicator, and the acquisition module is also used to: perform the following processing for each of the servers: receive a monitoring indicator reporting request; extract the data corresponding to the monitoring indicator and the time corresponding to the data from the monitoring indicator reporting request; based on the data and the time corresponding to the data, generate a monitoring indicator curve of the server corresponding to the monitoring indicator.

[0018] In the above scheme, the sorting module is also used to: perform the following processing for each of the monitoring indicator curves: extract at least one indicator feature of the monitoring indicator curve; determine at least one type of outlier feature of each of the monitoring indicator curves relative to the curve set based on at least one indicator feature of each of the monitoring indicator curves; determine the degree of outlier of each of the monitoring indicator curves based on at least one type of outlier feature of each of the monitoring indicator curves relative to the curve set.

[0019] In the above scheme, the sorting module is also used to: query the feature type corresponding to the indicator type, and obtain at least one indicator feature of the monitoring indicator curve that is consistent with the feature type; wherein the indicator feature includes at least one of the following: the fluctuation index feature of the monitoring indicator curve, the periodic index feature of the monitoring indicator curve, the extreme value index feature of the monitoring indicator curve, the average index feature of the monitoring indicator curve, and the percentile index feature of the monitoring indicator curve.

[0020] In the above scheme, the sorting module is also used to: when the number of types of the outlier features is one, linearly process one of the outlier features based on the outlier influence factor corresponding to the outlier feature to obtain the outlier degree corresponding to the monitoring index curve; when the number of types of the outlier features is multiple, use the outlier influence factors corresponding to the multiple types of outlier features of the monitoring index curve as weights, perform weighted summation processing on the multiple outlier features, and bias the weighted summation processing result to obtain the outlier degree corresponding to the monitoring index curve.

[0021] In the above scheme, when there are multiple types of outlier features, the sorting module is also used to: perform the following processing for each of the monitoring index curves: combine multiple outlier features of the monitoring index curve to obtain multiple combination features of the monitoring index curve, wherein the outlier features used in each combination are partially different or completely different; use the outlier influence factor of each combination feature of the monitoring index curve as a weight parameter, and perform weighted summation processing on each combination feature of the monitoring index curve to obtain the outlier degree of the monitoring index curve; wherein the outlier influence factor of the combination feature is the product of the outlier association influence factors of the outlier features included in the combination feature.

[0022] In the above scheme, the clustering module is also used to: when the number of the multiple monitoring indicator curves exceeds the number threshold, classify the multiple monitoring indicator curves to obtain the type of each monitoring indicator curve, and cluster the monitoring indicator curves belonging to each type to obtain at least one curve cluster corresponding to each type of monitoring indicator curve; when the number of the multiple monitoring indicator curves does not exceed the number threshold, cluster the multiple monitoring indicator curves to obtain at least one curve cluster corresponding to the curve set.

[0023] In the above scheme, the clustering module is also used to: take any one of the monitoring indicator curves as a representative element to initialize the curve cluster corresponding to the representative element; take the monitoring indicator curves in the curve set other than the representative element as candidate monitoring indicator curves, and perform the following processing for each candidate monitoring indicator curve: when the candidate monitoring indicator curve and the representative element of any curve cluster meet the clustering condition, the candidate monitoring indicator curve is classified into the any curve cluster; when the candidate monitoring indicator curve and each of the curve clusters do not meet the clustering condition, take the candidate monitoring indicator curve as a new representative element and initialize the curve cluster corresponding to the new representative element.

[0024] In the above scheme, the clustering module is also used to: before classifying the candidate monitoring indicator curve into any one of the curve clusters, determine the similarity between the candidate monitoring indicator curve and the representative element of each of the curve clusters; when the maximum similarity exceeds the similarity threshold, determine that the candidate monitoring indicator curve and the representative element of the curve cluster corresponding to the maximum similarity meet the clustering condition, and determine the any one of the curve clusters by the curve cluster corresponding to the maximum similarity.

[0025] In the above scheme, the clustering module is also used to: perform the following processing for the representative element of each curve cluster: obtain multiple first data corresponding to each timestamp of the candidate monitoring indicator curve, and multiple second data corresponding to each timestamp of the representative element; obtain the first average data of the candidate monitoring indicator curve corresponding to the multiple timestamps, and the second average data of the representative element corresponding to the multiple timestamps; based on the difference between each first data and the first average data, and the difference between each second data and the second average data, determine the similarity between the candidate monitoring indicator curve and the representative element.

[0026] In the above scheme, the deduplication module is also used to: determine the monitoring indicator curve ranked first in the descending sorting processing result as an abnormal monitoring curve; perform the following processing on each remaining monitoring indicator curve in the order represented by the descending sorting result: when the remaining monitoring indicator curve and the abnormal monitoring curve belong to different curve clusters, determine the remaining monitoring indicator curve as an abnormal monitoring curve; when the remaining monitoring indicator curve and the abnormal monitoring curve belong to the same curve cluster, remove the remaining monitoring indicator curve from the descending sorting processing result; wherein, the remaining monitoring indicator curves are the monitoring indicator curves other than the monitoring indicator curve ranked first in the descending sorting processing result.

[0027] In the above scheme, the outlier degree is achieved through a feature extraction network and a regression network; the device also includes: a training module, which is used to: before determining the outlier degree of each monitoring indicator curve relative to the curve set, obtain a curve set sample including multiple monitoring indicator curve samples and a pre-labeled outlier curve sample in the curve set sample; wherein the multiple monitoring indicator curve samples correspond to the same monitoring indicator; perform the following processing through the feature extraction network: extract at least one type of outlier feature sample of each monitoring indicator curve sample relative to the curve set sample from the curve set sample; perform the following processing through the regression network: perform regression processing on at least one type of outlier feature sample of each monitoring indicator curve sample relative to the curve set sample to obtain the outlier degree of each monitoring indicator curve sample; based on the outlier degree of each monitoring indicator curve sample, determine a predicted outlier curve sample from the curve set sample; back-propagate the predicted outlier curve sample and the pre-labeled outlier curve sample in the feature extraction network and the regression network to update the parameters of the feature extraction network and the regression network.

[0028] In the above scheme, after deduplication processing is performed on the descending sorting processing results of the multiple monitoring indicator curves based on the at least one curve cluster to obtain the abnormal monitoring curve, the device also includes: a human-computer interaction module, which is used to: display the abnormal monitoring curve corresponding to the monitoring indicator; in response to the detail trigger operation of the abnormal monitoring curve, display the monitoring indicator curve belonging to the same curve cluster as the abnormal monitoring curve; in response to the merging operation of the abnormal monitoring curve, adjust the similarity threshold used for clustering processing based on the target curve of the merging operation, and deduplication processing is performed on the descending sorting processing results of the multiple monitoring indicator curves based on at least one new curve cluster corresponding to the new similarity threshold to obtain a new abnormal monitoring curve corresponding to the monitoring indicator.

[0029] In the above scheme, after obtaining multiple monitoring indicator curves corresponding to multiple servers in the business system to form a curve set, the human-computer interaction module is also used to: display the curve set; in response to the outlier display operation for the curve set, determine to perform the descending sorting processing, the clustering processing and the deduplication processing to obtain abnormal monitoring curves; in the displayed curve set, hide the monitoring indicator curves that are not identified as the abnormal monitoring curves.

[0030] In the above scheme, after the descending sorting results of the multiple monitoring indicator curves are deduplicated to obtain the abnormal monitoring curve, the human-computer interaction module is also used to: when the number of the abnormal monitoring curve is one, query the abnormal server and monitoring indicator corresponding to the abnormal monitoring curve to perform fault handling operations on the abnormal server based on the monitoring indicator; when the number of the abnormal monitoring curves is multiple, perform the following processing: query the abnormal server and monitoring indicator corresponding to each of the abnormal monitoring curves, and based on the outlier degree of each of the abnormal monitoring curves, perform abnormal descending sorting processing on the abnormal server; according to the abnormal descending sorting processing results, perform fault handling operations on the abnormal server based on the monitoring indicator.

[0031] An embodiment of the present application provides an electronic device, including:

[0032] a memory for storing executable instructions;

[0033] The processor is used to implement the artificial intelligence-based business monitoring method provided in the embodiment of the present application when executing the executable instructions stored in the memory.

[0034] An embodiment of the present application provides a computer-readable storage medium storing executable instructions for implementing the artificial intelligence-based business monitoring method provided in an embodiment of the present application when executed by a processor.

[0035] The embodiments of the present application have the following beneficial effects:

[0036] By evaluating the degree of outliers for each monitoring indicator curve, we can effectively screen out monitoring indicator curves with abnormal data change patterns. Through descending sorting and clustering processing, we can effectively control the number of monitoring indicator curves with abnormal data change patterns. We can obtain abnormal monitoring curves that characterize abnormal situations in a timely and accurate manner, thereby providing effective guidance for timely eliminating abnormalities in business systems. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Figure 1 Schematic diagram of a monitoring indicator curve of an artificial intelligence-based business monitoring method provided in an embodiment of the present application;

[0038] Figure 2 is a schematic diagram of a smart dashboard provided in an embodiment of the present application;

[0039] Figure 3 It is a schematic diagram of a monitoring indicator curve in the related art;

[0040] Figure 4 It is a schematic diagram of a monitoring indicator curve in the related art;

[0041] Figure 5This is a schematic diagram of the architecture of the artificial intelligence-based business monitoring system provided in an embodiment of the present application;

[0042] Figure 6 4 is a schematic diagram of the structure of the terminal 400 provided in an embodiment of the present application;

[0043] Figures 7A-7C This is a flow chart of an artificial intelligence-based business monitoring method provided in an embodiment of the present application;

[0044] Figure 8 This is a schematic diagram of an interface of an artificial intelligence-based business monitoring method provided in an embodiment of the present application;

[0045] Figure 9 Schematic diagram of the principle of the offline training phase of the artificial intelligence-based business monitoring method provided in an embodiment of the present application;

[0046] Figure 10 This is a schematic diagram of the principles of the online application phase of the artificial intelligence-based business monitoring method provided in an embodiment of the present application;

[0047] Figure 11 This is a schematic diagram of deduplication of the artificial intelligence-based business monitoring method provided in an embodiment of the present application;

[0048] Figure 12 This is a clustering diagram of the artificial intelligence-based business monitoring method provided in an embodiment of the present application;

[0049] Figures 13A-13B This is a schematic diagram of the effect of the artificial intelligence-based business monitoring method provided in an embodiment of the present application. DETAILED DESCRIPTION

[0050] In order to make the purpose, technical solutions and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings. The described embodiments should not be regarded as limiting this application. All other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0051] In the following description, reference is made to “some embodiments”, which describes a subset of all possible embodiments, but it will be understood that “some embodiments” may be the same subset or different subsets of all possible embodiments and may be combined with each other without conflict.

[0052] In the following description, the terms "first\second\third" involved are merely used to distinguish similar objects and do not represent a specific ordering of the objects. It can be understood that "first\second\third" can be interchanged with a specific order or sequence where permitted, so that the embodiments of the present application described herein can be implemented in an order other than that illustrated or described herein.

[0053] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by those skilled in the art to which this application pertains. The terms used herein are for the purpose of describing the embodiments of this application only and are not intended to limit this application.

[0054] Before further describing the embodiments of the present application in detail, the nouns and terms involved in the embodiments of the present application are explained. The nouns and terms involved in the embodiments of the present application are subject to the following interpretations.

[0055] 1) Time series: A time series is a sequence of data points arranged in chronological order. Usually, the time interval of a time series is a constant value (for example, 10 seconds, 1 minute, 5 minutes). Here, the time series mainly refers to the time series of monitoring. Figure 1 , Figure 1 This is a schematic diagram of the monitoring index curve of the artificial intelligence-based business monitoring method provided in an embodiment of the present application. From June 29, 2020 to June 30, 2020, a monitoring data point (monitoring data point for event volume) was reported every 57 seconds, and the monitoring index curve was composed of a continuous time series of monitoring data points at each minute.

[0056] 2) Time series anomaly: Time series anomaly is manifested in the sudden rise, fall, and fluctuation of the monitoring indicator curve after deviating from the normal value.

[0057] 3) Outlier monitoring: A curve with a significantly different value range or trend compared to most other monitoring indicator curves. For example, a monitoring indicator curve with the largest sudden increase or decrease, or the largest fluctuation from the normal value.

[0058] 4) Cloud Monitoring: Cloud monitoring is divided into basic monitoring and business monitoring. Basic monitoring refers to the monitoring of basic machines, databases, and other low-level services. The monitoring data points of basic monitoring are usually machine data, such as CPU utilization, memory utilization, network bandwidth, etc. Business monitoring refers to the detection and alarm monitoring of business data reported by the business party itself. The monitoring data points of business monitoring have richer business characteristics. For example, the success rate of interfaces, the success rate of web page access, the freeze rate of live video, the number of online users of application products, and other various monitoring data points. Whether it is basic monitoring or business monitoring, at each fixed moment, each time series corresponds to a unique value, for example, presented in the form of a key-value pair. Therefore, one of the core aspects of cloud monitoring is to detect anomalies in various time series and send alarms to users.

[0059] 5) Smart Dashboard: See Figure 2 , Figure 2 is a schematic diagram of a smart dashboard provided in an embodiment of the present application, Figure 2 Nine different types of dashboards are shown. Different types of dashboards use different information display methods, such as display through curves, pie charts, scatter plots, etc. The smart dashboard is a smart dashboard with visualization and analysis functions provided by Cloud Monitoring for cloud product monitoring data points. Users can create smart dashboards for various types of monitoring indicators of cloud products. The smart dashboard will automatically present the monitoring data in the form of exquisite charts in the monitoring panel, making the monitoring data more intuitive and helping users analyze indicators through trends and outliers.

[0060] In related technologies, in the Internet or financial industries, the detection, monitoring, and display of time series of monitoring indicators are one of the most important topics. The cloud monitoring smart dashboard provides a smart dashboard with visualization and analysis functions for the monitoring data of cloud product monitoring indicators. How to quickly and conveniently display valuable monitoring indicator curves is not only related to the experience of the smart dashboard, but also helps operation and maintenance users to view and discover problems more quickly and conveniently. In related technologies, the smart dashboard provides a data graphical display of alarm indicators or other data. In actual business use, this situation is often encountered: the business cluster includes hundreds of cloud servers, and it is hoped that multiple monitoring indicator curves corresponding to multiple servers will be displayed at one time on the cloud monitoring smart dashboard, so that the indicator status of each machine instance can be viewed comprehensively. However, due to the excessive number of displayed curves, the curves may overlap and interfere with each other, which is not conducive to viewing indicator data and discovering problems.

[0061] The display mode for monitoring indicators in related technologies is comprehensive display, see Figure 3 , Figure 3 It is a schematic diagram of the monitoring indicator curve in the related technology. Figure 3 The monitoring indicator curve of all servers for the intranet outbound bandwidth (monitoring indicator) is shown. The display method for monitoring indicators in related technologies is based on statistical data display. Figure 4 , Figure 4 It is a schematic diagram of the monitoring indicator curve in the related technology. Figure 4 The displayed monitoring indicator curves are sorted according to the maximum value, minimum value and other dimensions. The disadvantage of comprehensive display is that there are too many monitoring indicator curves displayed, which is not conducive to viewing and not conducive to operation and maintenance personnel to find problems. Display based on statistical data (maximum value, minimum value) is easily affected by extreme values, and the average value is like a water level line, which is more about showing the water level of the monitoring indicator. The method of display based on statistical data is effective when the fluctuation of the monitoring indicator data is small, but when the fluctuation of the monitoring indicator curve is relatively large, for example Figure 1 The monitoring indicator curves in are not effective if they are sorted and displayed based on statistical data, as this approach has weak generalization capabilities.

[0062] In response to the above technical problems, the embodiments of the present application provide a business monitoring method, device, electronic device and computer-readable storage medium based on artificial intelligence, which can determine the outlier degree of each monitoring indicator curve, and then perform aggregation processing and deduplication processing based on the descending sorting results based on the outlier degree to obtain an abnormal monitoring curve.

[0063] The following describes exemplary applications of the electronic device provided by the embodiments of the present application. The device provided by the embodiments of the present application can be implemented as various types of user terminals such as laptop computers, tablet computers, desktop computers, set-top boxes, mobile devices, etc., and can also be implemented as a server. The following describes exemplary applications when the device is implemented as a terminal.

[0064] See also Figure 5 , Figure 5 This is an architectural diagram of the artificial intelligence-based business monitoring system provided in an embodiment of the present application. The terminal 400 connects the server 200-1 to the server 200-10 through the network 300. The network 300 can be a wide area network or a local area network, or a combination of the two. The servers 200-1 to 200-10 come from the business system.

[0065] In some embodiments, servers 200-1 to 200-10 in the business system send their respective monitoring indicator curves to the terminal 400, and the monitoring indicator curves are displayed on the terminal 400. In response to the outlier display operation for the curve set, the terminal 400 determines the outlier degree of each monitoring indicator curve relative to the curve set, and sorts the multiple monitoring indicator curves in descending order based on the outlier degree, clusters the multiple monitoring indicator curves to obtain at least one curve cluster of the corresponding curve set, and de-duplicates the descending sorting results of the multiple monitoring indicator curves based on the at least one curve cluster to obtain abnormal monitoring curves. Among the displayed monitoring indicator curves, the monitoring indicator curves that are not identified as abnormal monitoring curves are hidden.

[0066] In some embodiments, servers 200-1 to 200-10 may be independent physical servers, or a server cluster or distributed system composed of multiple physical servers, or cloud servers that provide basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms. Terminal 400 may be a smartphone, tablet computer, laptop computer, desktop computer, smart speaker, smart watch, etc., but is not limited thereto. The terminal and the server may be connected directly or indirectly via wired or wireless communication, which is not limited in the embodiments of the present application.

[0067] Take the electronic device provided in the embodiment of the present application as the terminal described above as an example, see Figure 6 , Figure 6 is a schematic diagram of the structure of the terminal 400 provided in an embodiment of the present application, Figure 6 The terminal 400 shown includes: at least one processor 410, a memory 450, at least one network interface 420, and a user interface 430. The various components in the terminal 400 are coupled together via a bus system 440. It is understood that the bus system 440 is used to achieve connection and communication between these components. In addition to including a data bus, the bus system 440 also includes a power bus, a control bus, and a status signal bus. However, for the sake of clarity, the bus system 440 is not shown in FIG. Figure 6 Various buses are labeled as bus system 440 .

[0068] The processor 410 can be an integrated circuit chip with signal processing capabilities, such as a general-purpose processor, a digital signal processor (DSP), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc., where the general-purpose processor can be a microprocessor or any conventional processor, etc.

[0069] The user interface 430 includes one or more output devices 431 that enable presentation of media content, including one or more speakers and / or one or more visual display screens. The user interface 430 also includes one or more input devices 432, including user interface components that facilitate user input, such as a keyboard, mouse, microphone, touch screen display, camera, other input buttons and controls.

[0070] The memory 450 may be removable, non-removable, or a combination thereof. Exemplary hardware devices include solid-state memory, hard drives, optical drives, etc. The memory 450 may optionally include one or more storage devices that are physically remote from the processor 410.

[0071] The memory 450 includes volatile memory or non-volatile memory, or may include both volatile and non-volatile memory. The non-volatile memory may be a read-only memory (ROM), and the volatile memory may be a random access memory (RAM). The memory 450 described in the embodiments of the present application is intended to include any suitable type of memory.

[0072] In some embodiments, the memory 450 can store data to support various operations, examples of which include programs, modules, and data structures, or a subset or superset thereof, as exemplified below.

[0073] Operating system 451, including system programs for processing various basic system services and performing hardware-related tasks, such as the framework layer, core library layer, and driver layer, which are used to implement various basic services and process hardware-based tasks;

[0074] A network communication module 452 for reaching other computing devices via one or more (wired or wireless) network interfaces 420 , exemplary network interfaces 420 including Bluetooth, WiFi, and USB;

[0075] a presentation module 453 for enabling presentation of information via one or more output devices 431 (e.g., a display screen, a speaker, etc.) associated with the user interface 430 (e.g., a user interface for operating peripheral devices and displaying content and information);

[0076] The input processing module 454 is configured to detect one or more user inputs or interactions from one of the one or more input devices 432 and to translate the detected inputs or interactions.

[0077] In some embodiments, the artificial intelligence-based service monitoring device provided in the embodiments of the present application can be implemented in software. Figure 6 An artificial intelligence-based business monitoring device 455 stored in a memory 450 is shown, which can be software in the form of programs and plug-ins, including the following software modules: an acquisition module 4551, a sorting module 4552, a clustering module 4553, a deduplication module 4554, a training module 4555 and a human-computer interaction module 4556. These modules are logical, and therefore can be arbitrarily combined or further split according to the functions implemented. The functions of each module will be explained below.

[0078] The artificial intelligence-based business monitoring method provided in the embodiment of the present application will be explained in combination with the exemplary application and implementation of the terminal provided in the embodiment of the present application.

[0079] See also Figure 7A , Figure 7A This is a flow chart of the business monitoring method based on artificial intelligence provided by the embodiment of the present application, which will be combined with Figure 7A Steps 101-104 are shown for explanation.

[0080] In step 101, a plurality of monitoring indicator curves corresponding to a plurality of servers in a business system are obtained to form a curve set.

[0081] As an example, each server corresponds to at least one monitoring indicator curve, and the server comes from the business system. Multiple monitoring indicator curves can be monitoring indicator curves for a certain monitoring indicator of multiple servers. For example, there are 100 monitoring indicator curves about CPU utilization (monitoring indicators) corresponding to 100 servers. Multiple monitoring indicator curves can be monitoring indicator curves for multiple servers for multiple monitoring indicators. For example, there are 50 monitoring indicator curves about CPU (monitoring indicators) utilization corresponding to 50 servers, and another 50 monitoring indicator curves about memory utilization (monitoring indicators) corresponding to 50 servers, or there are 50 monitoring indicator curves about CPU (monitoring indicators) utilization and 50 monitoring indicator curves about memory utilization (monitoring indicators) corresponding to 50 servers, respectively. Another 50 servers have 50 monitoring indicator curves about memory utilization (monitoring indicators), that is, the server has at least one corresponding monitoring indicator curve, and may also have indicator monitoring curves corresponding to different monitoring indicators.

[0082] In some embodiments, when the multiple monitoring indicator curves in step 101 are monitoring indicator curves corresponding to the same monitoring indicator, an abnormal monitoring curve for a certain monitoring indicator is determined, thereby determining a server that represents an abnormality for the monitoring indicator. When the multiple monitoring indicator curves in step 101 are monitoring indicator curves corresponding to multiple monitoring indicators, multiple associated monitoring indicators are associated indicators. For example, monitoring indicator A and monitoring indicator B are positively correlated, then the monitoring indicator curve corresponding to monitoring indicator A and the monitoring indicator curve corresponding to monitoring indicator B have an associated relationship, so that the normal monitoring curves corresponding to the above two indicators should have the same data change law. From the multiple monitoring indicator curves for multiple monitoring indicators, the abnormal monitoring curve determined must be an outlier relative to a certain indicator.

[0083] In some embodiments, each monitoring indicator curve is used to characterize the data changes of the monitoring indicator of the server corresponding to the monitoring indicator curve. The above-mentioned acquisition of multiple monitoring indicator curves corresponding to multiple servers in the business system can be achieved through the following technical solution: performing the following processing for each server: receiving a monitoring indicator reporting request sent periodically; extracting the data of the corresponding monitoring indicator and the time of the corresponding data from the monitoring indicator reporting request; generating a monitoring indicator curve for the corresponding monitoring indicator of the server based on the data and the time of the corresponding data.

[0084] As an example, a monitoring indicator reporting request periodically sent by a business system is received, where the monitoring indicator reporting request is generated when the business system performs periodic business perception processing; or, a monitoring indicator reporting request periodically sent by a monitoring system is received, where the monitoring indicator reporting request is generated when the monitoring system performs periodic monitoring processing on the business system; data of corresponding monitoring indicators and the time of corresponding data are extracted from the monitoring indicator reporting request, for example, 10 timestamps and the data of monitoring indicators corresponding to these 10 timestamps are extracted from the monitoring indicator reporting request, such as central processing unit utilization, with the timestamp as the horizontal axis and the data of the monitoring indicator as the vertical axis, and 10 corresponding points are located on the rectangular coordinate system, and then a corresponding monitoring indicator curve is constructed based on these 10 points.

[0085] In some embodiments, after extracting the data of the corresponding monitoring indicator and the time of the corresponding data from the monitoring indicator reporting request, a time series is constructed, and the interval of the time series is a constant value. For example, the time series is X = (x1, x2, ..., xn), where x1, x2, ..., xn is the data of the monitoring indicator at the corresponding time point, and the discrete time series is directly used as the monitoring indicator curve.

[0086] In step 102 , the outlier degree of each monitoring indicator curve relative to the curve set is determined, and a plurality of monitoring indicator curves are sorted in descending order based on the outlier degree.

[0087] In some embodiments, see Figure 7B 、 Figure 7B This is a flow chart of the business monitoring method based on artificial intelligence provided by the embodiment of the present application. In step 102, the degree of outlier of each monitoring indicator curve relative to the curve set is determined. This can be done by performing Figure 7B Steps 1021-1023 are shown for explanation.

[0088] In step 1021, at least one indicator feature of the monitoring indicator curve is extracted.

[0089] In some embodiments, extracting at least one indicator feature of the monitoring indicator curve in step 1021 can be achieved through the following technical solution: querying the feature type corresponding to the indicator type, and obtaining at least one indicator feature of the monitoring indicator curve that is consistent with the feature type; wherein the indicator feature includes at least one of the following: the fluctuation indicator feature of the monitoring indicator curve, the periodic indicator feature of the monitoring indicator curve, the extreme value indicator feature of the monitoring indicator curve, the average indicator feature of the monitoring indicator curve, and the percentile indicator feature of the monitoring indicator curve.

[0090] As an example, a database of indicator types and feature types will be pre-matched in the feature engineering stage. The database stores data in the form of key-value pairs, where the key is the indicator type and the value is the feature type. When implementing the embodiments of the present application, the applicant found that selecting different types of features for different types of indicators can have a more optimized outlier prediction accuracy. Therefore, the feature type corresponding to the indicator type is queried, and at least one indicator feature of the monitoring indicator curve that is consistent with the feature type is obtained. The indicator feature can be one or more of the fluctuation index feature of the monitoring indicator curve, the periodic index feature of the monitoring indicator curve, the extreme value index feature of the monitoring indicator curve, the average index feature of the monitoring indicator curve, and the percentile index feature of the monitoring indicator curve. The fluctuation index feature is used to characterize the degree of fluctuation, the periodic index feature is used to characterize whether the curve is periodic, the extreme value index feature is used to characterize the maximum and / or minimum value of the curve, the average index feature is used to characterize the average value of the curve, and the percentile index feature characterizes the percentile value of the curve.

[0091] In some embodiments, when extracting at least one indicator feature of the monitoring indicator curve, multiple indicator features of the same feature type can be collected for different indicator types of monitoring indicators. For example, for all monitoring indicators, fluctuation indicator features, periodic indicator features, extreme value indicator features, average indicator features, and percentile indicator features are collected, thereby reducing the consumption of feature engineering. Since step 102 can be implemented through an outlier degree prediction model, the outlier degree prediction model is a neural network model including a feature extraction network and a linear regression network, thereby improving the generalization ability of the model used in step 102.

[0092] In step 1022 , at least one type of outlier feature of each monitoring indicator curve relative to the curve set is determined based on at least one indicator feature of each monitoring indicator curve.

[0093] As an example, the outlier feature characterizes the deviation value of the indicator feature of each monitoring indicator curve relative to the indicator feature of the entire curve set. For example, the difference between the two can be used as the outlier feature. For example, the average indicator feature of each monitoring indicator curve in the curve set is obtained, and then average processing is performed to obtain the average processing result. The difference between the average indicator feature of each monitoring indicator curve and the average processing result of the corresponding curve set is used as the outlier feature of the corresponding monitoring indicator curve relative to the curve set.

[0094] In step 1023 , the outlier degree of each monitoring indicator curve is determined based on at least one type of outlier feature of each monitoring indicator curve relative to the curve set.

[0095] In some embodiments, in step 1023, the outlier degree of each monitoring indicator curve is determined based on at least one type of outlier feature of each monitoring indicator curve relative to the curve set, which can be achieved by the following technical solution: when the number of types of outlier features is one, linear processing is performed on one outlier feature based on the outlier influence factor of the corresponding outlier feature to obtain the outlier degree of the corresponding monitoring indicator curve; when the number of types of outlier features is multiple, the outlier influence factors corresponding to the multiple types of outlier features of the monitoring indicator curve are used as weights, and weighted summation processing is performed on the multiple outlier features, and the weighted summation processing result is biased to obtain the outlier degree of the corresponding monitoring indicator curve.

[0096] As an example, linear regression processing is performed on the outlier features through a linear regression model. If there is only one type of outlier feature, the outlier feature is directly processed linearly. The linear processing process is to multiply the outlier feature with the linear parameter, and then add the multiplication result to the bias parameter. If there are multiple types of outlier features, the outlier features are weighted and summed with the outlier influence factor corresponding to each type of outlier feature as the weight, and the weighted summation result is added to the bias parameter to obtain the degree of outlier. Since the degree of outlier is predicted based on multiple types of outlier features, the degree of outlier can be predicted more accurately.

[0097] In some embodiments, when there are multiple types of outlier features, determining the outlier degree of each monitoring indicator curve based on at least one type of outlier feature of each monitoring indicator curve relative to the curve set in step 1023 can be achieved through the following technical solution: performing the following processing for each monitoring indicator curve: combining multiple types of outlier features of the monitoring indicator curve to obtain multiple combination features of the monitoring indicator curve, wherein the outlier features used in each combination are partially different or completely different; using the outlier influence factor of each combination feature of the monitoring indicator curve as a weight parameter, performing weighted summation processing on each combination feature of the monitoring indicator curve to obtain the outlier degree of the monitoring indicator curve; wherein the outlier influence factor of the combination feature is the product of the outlier association influence factors of the outlier features included in the combination feature.

[0098] As an example, the outlier features used in each combination are partially the same, which means that the outlier feature x1 can be combined with the outlier feature x2 to form a combination feature x12, and the outlier feature x1 can be combined with the outlier feature x3 to form a combination feature x13. The outlier features used in the two combinations involved here are partially different, but both form a combination feature with the outlier feature x1. The outlier features used in each combination here are completely different, which means that the outlier feature x1 can be combined with the outlier feature x2 to form a combination feature x12, and the outlier feature x3 can be combined with the outlier feature x4 to form a combination feature x34. The outlier features used in the two combinations involved here are completely different. The factor decomposition machine model is obtained by adding a second-order feature combination to the calculation formula of the linear regression model. Any two outlier features are combined in pairs. These combined features can be regarded as a new feature and added to the linear model. The weight of the combination feature is also learned in the training phase, where the product of the outlier association influence factor represents the correlation between the two outlier features.

[0099] In step 103, clustering processing is performed on the multiple monitoring indicator curves to obtain at least one curve cluster corresponding to the curve set.

[0100] As an example, a plurality of monitoring indicator curves are classified to obtain the type of each monitoring indicator curve, and the monitoring indicator curves belonging to each type are clustered to obtain at least one curve cluster corresponding to each type of monitoring indicator curve. The classification process is implemented by a curve classifier (a neural network model). The curve classifier is trained based on various types of monitoring indicator curve samples. For example, some monitoring indicator curve samples are approximately sawtooth-shaped curves, and some monitoring indicator curve samples are almost horizontal curves with small fluctuations. The features extracted by the curve classifier are consistent with the indicator features extracted in step 102. The fully connected layer of the curve classifier maps the indicator features to the probability that the curve belongs to each type, and determines the type corresponding to the maximum probability as the type of the curve. That is, after the multiple monitoring indicator curves are first classified by the curve classifier, clustering processing is performed on each type of monitoring indicator curve. For example, clustering processing is performed on the 50 monitoring indicator curves of type A to obtain 5 curve clusters, and clustering processing is performed on the 60 monitoring indicator curves of type B to obtain 4 curve clusters, thereby obtaining a total of 9 curve clusters. The processing method of classification first and then clustering can effectively improve the clustering processing efficiency.

[0101] In some embodiments, multiple monitoring indicator curves can be directly clustered to obtain at least one curve cluster of the corresponding curve set. For example, 110 curves can be directly clustered to obtain 10 curve clusters. The comprehensive clustering method is conducive to improving the clustering accuracy.

[0102] In some embodiments, different clustering strategies can be adopted for different situations. Figure 7C , Figure 7C This is a flow chart of the business monitoring method based on artificial intelligence provided by the embodiment of the present application. In step 103, multiple monitoring indicator curves are clustered to obtain at least one curve cluster of the corresponding curve set. Figure 7C Steps 1031-1032 are shown for explanation.

[0103] In step 1031, when the number of multiple monitoring indicator curves exceeds a number threshold, the multiple monitoring indicator curves are classified to obtain the type of each monitoring indicator curve, and the monitoring indicator curves belonging to each type are clustered to obtain at least one curve cluster corresponding to each type of monitoring indicator curve.

[0104] As an example, when the number of multiple monitoring indicator curves exceeds a number threshold, for example, the number threshold is 1000, and the number of monitoring indicator curves is 1200, the processing efficiency can be improved by first classifying and then clustering. The curve classifier can quickly differentiate a large number of monitoring indicator curves into different types, and then clustering is performed on each type of monitoring indicator curve. The computing resources occupied will be less than directly clustering the 1200 monitoring indicator curves.

[0105] As an example, when the number of multiple monitoring indicator curves does not exceed the number threshold, for example, the number threshold is 1000, and the number of monitoring indicator curves is 400, the clustering processing method can improve the accuracy without occupying too many computing resources. Directly clustering the 400 monitoring indicator curves does not require more computing resources, but is conducive to improving the clustering accuracy.

[0106] In step 1032 , when the number of the plurality of monitoring indicator curves does not exceed the number threshold, clustering processing is performed on the plurality of monitoring indicator curves to obtain at least one curve cluster of the corresponding curve set.

[0107] As an example, the following implementation of clustering processing can be applied to clustering processing for all monitoring indicator curves, or to separate clustering processing for each type of monitoring indicator curve, for example, clustering processing is performed on monitoring indicator curves of type A and clustering processing is performed on monitoring indicator curves of type B respectively.

[0108] In some embodiments, in step 103 or step 1032, multiple monitoring indicator curves are clustered to obtain at least one curve cluster of the corresponding curve set, and any monitoring indicator curve is used as a representative element to initialize the curve cluster corresponding to the representative element. The monitoring indicator curves other than the representative element in the curve set are used as candidate monitoring indicator curves, and the following processing is performed on each candidate monitoring indicator curve: when the candidate monitoring indicator curve and the representative element of any curve cluster meet the clustering conditions, the candidate monitoring indicator curve is classified into any curve cluster; when the candidate monitoring indicator curve does not meet the clustering conditions with each curve cluster, the candidate monitoring indicator curve is used as a new representative element, and the curve cluster corresponding to the new representative element is initialized.

[0109] As an example, the set of curve clusters is empty initially. Any monitoring indicator curve A is read in, and a curve cluster is constructed with this monitoring indicator curve A. The monitoring indicator curves in the curve set other than the monitoring indicator curve A are candidate monitoring indicator curves, such as candidate monitoring indicator curves B and C. Then, it is determined whether each candidate monitoring indicator curve meets the clustering conditions with any curve cluster. If so, it indicates that there is a cluster in the existing clusters for the candidate monitoring indicator curve to join. If not, it indicates that there is currently no cluster for the candidate monitoring indicator curve to join. If there is a curve cluster in the existing clusters for the candidate monitoring indicator curve B to join, the candidate monitoring indicator curve B is added to the curve cluster. If there is currently no cluster for the candidate monitoring indicator curve B to join, a new cluster is established with the candidate monitoring indicator curve B as the representative element of the new cluster.

[0110] In some embodiments, before classifying a candidate monitoring indicator curve into any curve cluster, the similarity between the candidate monitoring indicator curve and the representative element of each curve cluster is determined; when the maximum similarity exceeds the similarity threshold, it is determined that the candidate monitoring indicator curve and the representative element of the curve cluster corresponding to the maximum similarity meet the clustering condition, and the curve cluster corresponding to the maximum similarity is determined as any curve cluster.

[0111] As an example, the method for judging whether the clustering conditions are met is as follows: assuming that there are already two curve clusters, then for the candidate monitoring indicator curve B, calculate the similarity between it and the two curve clusters (by calculating the similarity between it and the representative elements of the curve clusters), and judge whether the maximum similarity exceeds the similarity threshold. The curve cluster corresponding to the maximum similarity represents that the curve cluster is the curve cluster most similar to the candidate monitoring indicator curve B in the existing curve clusters. If the maximum similarity exceeds the similarity threshold, it is determined that the representative element of the curve cluster corresponding to the maximum similarity and the candidate monitoring indicator curve meet the clustering conditions. Otherwise, it is considered that there is currently no curve cluster similar to the candidate monitoring indicator curve B.

[0112] In some embodiments, the candidate monitoring indicator curve and the representative element have the same multiple timestamps. The above-mentioned determination of the similarity between the candidate monitoring indicator curve and the representative element of each curve cluster can be achieved by the following technical solution: performing the following processing for the representative element of each curve cluster: obtaining multiple first data corresponding to each timestamp of the candidate monitoring indicator curve, and multiple second data corresponding to each timestamp of the representative element; obtaining the first average data corresponding to multiple timestamps of the candidate monitoring indicator curve, and the second average data corresponding to multiple timestamps of the representative element; based on the difference between each first data and the first average data, and the difference between each second data and the second average data, determine the similarity between the candidate monitoring indicator curve and the representative element.

[0113] As an example, the similarity r can be determined by the following formula (1):

[0114]

[0115] The two monitoring indicator curves (candidate monitoring indicator curves and representative elements) correspond to two time series X=(x1, ..., xn) and Y=(y1, ..., yn), respectively, where x1, ..., xn are multiple first data, and y1, ..., yn are multiple second data. represents the average value of multiple first data, It represents the average value of multiple second data, and the similarity is represented by r.

[0116] In step 104, based on at least one curve cluster, duplicate removal is performed on the descending sorting results of the plurality of monitoring indicator curves to obtain an abnormal monitoring curve.

[0117] In some embodiments, in step 104, based on at least one curve cluster, the descending sorting processing results of multiple monitoring indicator curves are deduplicated to obtain abnormal monitoring curves, which can be achieved through the following technical solution: the monitoring indicator curve ranked first in the descending sorting processing result is determined as the abnormal monitoring curve; for each remaining monitoring indicator curve, the following processing is performed in the order represented by the descending sorting result: when the remaining monitoring indicator curves and the abnormal monitoring curves belong to different curve clusters, the remaining monitoring indicator curves are determined as abnormal monitoring curves; when the remaining monitoring indicator curves and the abnormal monitoring curves belong to the same curve cluster, the remaining monitoring indicator curves are removed from the descending sorting processing result; wherein, the remaining monitoring indicator curves are the monitoring indicator curves other than the monitoring indicator curve ranked first in the descending sorting processing result.

[0118] As an example, assume that there are 10 monitoring indicator curves, which are sorted in descending order according to the degree of outliers. The monitoring indicator curve A ranked first in the descending sorting processing result is determined as the abnormal monitoring curve. For each remaining monitoring indicator curve (remaining monitoring indicator curve BJ), the following processing is performed in the order represented by the descending sorting result. For example, the second place is the remaining monitoring indicator curve C. When the remaining monitoring indicator curve C and the abnormal monitoring curve A belong to different curve clusters, the remaining monitoring indicator curve C is determined as the abnormal monitoring curve; when the remaining monitoring indicator curve C and the abnormal monitoring curve A belong to the same curve cluster, the remaining monitoring indicator curve C is removed from the descending sorting processing result until the descending sorting result is empty, which represents that the traversal of all monitoring indicator curves is completed, and abnormal monitoring curves with a high degree of outliers and no repetition can be obtained.

[0119] In some embodiments, the degree of outlier is achieved through a feature extraction network and a regression network; before determining the degree of outlier of each monitoring indicator curve relative to the curve set in step 102, a curve set sample including multiple monitoring indicator curve samples and a pre-labeled outlier curve sample in the curve set sample is obtained; wherein the multiple monitoring indicator curve samples correspond to the same monitoring indicator; the following processing is performed through the feature extraction network: from the curve set sample, at least one type of outlier feature sample of each monitoring indicator curve sample relative to the curve set sample is extracted; the following processing is performed through the regression network: regression processing is performed on at least one type of outlier feature sample of each monitoring indicator curve sample relative to the curve set sample to obtain the degree of outlier of each monitoring indicator curve sample; based on the outlier degree of each monitoring indicator curve sample, a predicted outlier curve sample is determined from the curve set sample; the predicted outlier curve sample and the pre-labeled outlier curve sample are back-propagated in the feature extraction network and the regression network to update the parameters of the feature extraction network and the regression network.

[0120] For example, see Figure 9 , Figure 9 This is a schematic diagram of the principles of the offline training stage of the artificial intelligence-based business monitoring method provided in an embodiment of the present application. The outlier program prediction model is trained offline. It is known that a curve set sample including multiple monitoring indicator curve samples and pre-labeled outlier curve samples in the curve set samples are extracted through a feature extraction network to extract at least one type of outlier feature sample of each monitoring indicator curve sample relative to the curve set sample. According to the outlier features extracted by the feature extraction network and combined with a linear regression algorithm, the predicted outlier curve samples in the curve set samples are obtained. Based on the difference between the predicted outlier curve samples and the pre-labeled outlier curve samples, the outlier program prediction model including the feature extraction network is trained.

[0121] In some embodiments, in step 104, based on at least one curve cluster, the descending sorting processing results of multiple monitoring indicator curves are deduplicated, and after obtaining the abnormal monitoring curve, the abnormal monitoring curve of the corresponding monitoring indicator is displayed; in response to the details trigger operation of the abnormal monitoring curve, the monitoring indicator curve belonging to the same curve cluster as the abnormal monitoring curve is displayed; in response to the merging operation of the abnormal monitoring curve, based on the target curve of the merging operation, the similarity threshold for clustering processing is adjusted, and based on at least one new curve cluster corresponding to the new similarity threshold, the descending sorting processing results of multiple monitoring indicator curves are deduplicated to obtain a new abnormal monitoring curve of the corresponding monitoring indicator.

[0122] As an example, after obtaining the abnormal monitoring curve, the abnormal monitoring curve of the corresponding monitoring indicator is displayed. Each abnormal monitoring curve has a corresponding monitoring indicator and server. The detail triggering operation can be a click operation on a certain abnormal monitoring curve to display the monitoring indicator curve that belongs to the same curve cluster as the abnormal monitoring curve, which is equivalent to restoring the previously deduplicated monitoring indicator curve to facilitate the operation and maintenance personnel to conduct more fine-grained research. The merge operation is performed on two abnormal monitoring curves, that is, the operation and maintenance personnel find that there are two similar abnormal monitoring curves displayed, but they are obviously divided into different curve clusters during clustering, indicating that the similarity threshold used for the previous clustering is relatively strict. A smaller similarity threshold can be automatically set (to achieve the effect that the two abnormal monitoring curves targeted by the merge operation can be clustered into the same curve cluster), and re-clustering and deduplication processing are performed based on the smaller similarity threshold to obtain a new batch of abnormal monitoring curves. Since the human-computer interaction function is provided, the accuracy level of filtering the indicator monitoring curve can be effectively changed according to user needs, so that the generalization ability of the filtering is better.

[0123] In some embodiments, after obtaining multiple monitoring indicator curves corresponding to multiple servers in the business system in step 101 to form a curve set, the curve set is displayed; in response to an outlier display operation on the curve set, it is determined that descending sorting processing, clustering processing, and deduplication processing will be performed to obtain abnormal monitoring curves; in the displayed curve set, the monitoring indicator curves that are not identified as abnormal monitoring curves are hidden.

[0124] As an example, after obtaining multiple monitoring indicator curves, you can first display all the original monitoring indicator curves, which is equivalent to a comprehensive display. Figure 13A , Figure 13A : is a schematic diagram of the effect of the business monitoring method based on artificial intelligence provided by an embodiment of the present application, Figure 13A All monitoring indicator curves are shown in FIG. 1 . In response to the outlier display operation for the curve set, it is determined that steps 102-104 will be executed. Figure 13B ,In the displayed curve set, the monitoring indicator curves that are not identified as abnormal monitoring curves are hidden, that is, only 5 abnormal monitoring curves are displayed.

[0125] In some embodiments, in step 104, the descending sorting processing results of multiple monitoring indicator curves are deduplicated to obtain abnormal monitoring curves. When the number of abnormal monitoring curves is one, the abnormal server and monitoring indicator corresponding to the abnormal monitoring curve are queried to perform fault handling operations on the abnormal server based on the monitoring indicator; when the number of abnormal monitoring curves is multiple, the following processing is performed: the abnormal server and monitoring indicator corresponding to each abnormal monitoring curve are queried, and based on the outlier degree of each abnormal monitoring curve, the abnormal server is sorted in abnormal descending order; and the abnormal server is fault handled based on the monitoring indicator according to the abnormal descending sorting processing results.

[0126] As an example, assuming that there is only one abnormal monitoring curve, the abnormal server and monitoring indicators corresponding to the abnormal monitoring curve are queried to indicate that the abnormal monitoring curve has an anomaly corresponding to the monitoring indicator, so as to perform fault handling operations on the abnormal server based on the monitoring indicator. Assuming that there are multiple abnormal monitoring curves, it indicates that there may be multiple abnormal servers, or there is only one abnormal server, but the abnormal server has multiple abnormal monitoring indicators. At this time, it is necessary to perform fault handling operations on the abnormal servers based on the monitoring indicators in sequence. First, query the abnormal servers and monitoring indicators corresponding to each abnormal monitoring curve. Based on the outlier degree of each abnormal monitoring curve, the abnormal servers are sorted in descending order. Assuming that there are 3 abnormal servers, each abnormal server has 2 Monitoring indicators, a total of 6 abnormal monitoring curves, the descending sorting processing results are as follows: server A (monitoring indicator 1), server B (monitoring indicator 2), server A (monitoring indicator 2), server C (monitoring indicator 2), server B (monitoring indicator 1), server C (monitoring indicator 2), according to the abnormal descending sorting processing results, the abnormal servers are subjected to fault processing operations based on the monitoring indicators. First, the abnormal server A is subjected to fault processing operations based on monitoring indicator 1, and then the abnormal server B is subjected to fault processing operations based on monitoring indicator 2, and so on. Through the above embodiment, servers with more serious potential faults and the corresponding recommended indicators can be preferentially located, and the processing order can be divided in a fine-grained manner in a priority manner, thereby improving the fault processing efficiency and ensuring the stable operation of the business system.

[0127] The following describes an exemplary application of the embodiments of the present application in a practical application scenario.

[0128] In some embodiments, in a business monitoring scenario of a cloud server cluster, cloud servers in the cluster are monitored through a terminal used by operation and maintenance personnel, and the smart dashboard on the terminal can visualize the data of various monitoring indicators during the business monitoring process.

[0129] See also Figure 8 , Figure 8 This is an interface diagram of the artificial intelligence-based business monitoring method provided in an embodiment of the present application. In the curve display of the intelligent dashboard of the business monitoring system, taking cloud virtual machines as an example, many cloud virtual machines (servers) are needed under the same business system. Users can select the indicator monitoring curves of the cloud virtual machines to be displayed according to their needs (they can select one, multiple, or all). For example, there are originally 90 cloud virtual machines, corresponding to multiple indicator monitoring curves. When the operation and maintenance / developer chooses to display only the first 10 indicator monitoring curves, calculations can be performed based on the degree of outliers to display the 10 indicator monitoring curves with the largest degree of outliers.

[0130] See also Figure 9 , the outlier prediction model is trained offline. For a sample set with an outlier degree (including a curve set sample of multiple monitoring indicator curve samples and a pre-labeled outlier curve sample in the curve set sample), a feature extraction network is used to extract at least one outlier feature of each sample relative to the sample set. According to the features extracted by the feature extraction network and combined with a linear regression algorithm, the predicted outlier curve sample of the sample set is obtained. Based on the difference between the predicted outlier curve sample and the pre-labeled outlier curve sample, the outlier prediction model including the feature extraction network is trained.

[0131] See also Figure 10 , Figure 10 This is a schematic diagram of the principle of the online application stage of the artificial intelligence-based business monitoring method provided in an embodiment of the present application. After the input outlier curve sample is passed through the feature extraction network to extract the corresponding outlier features, the outlier program prediction model calculates the anomaly score (degree of outlier) of each outlier curve sample and sorts them according to the size of the anomaly score. At the same time, since there may be many similar curves with relatively high anomaly scores, in order to avoid this situation, a time series similarity algorithm is used for clustering processing. The outlier curve samples are first classified by a feature-based classifier, and then the similarity is used to perform more detailed classification in each pre-classified category. In the display results, the curves of the same category are deduplicated. The feature-based classifier model is combined with the time series similarity algorithm to dedupe, thereby effectively realizing the display of outlier curve samples.

[0132] Figure 11 This is a deduplication diagram of the artificial intelligence-based business monitoring method provided in an embodiment of the present application. The two monitoring indicator curves corresponding to cluster label 1 in the clustering results are curves that need to be deduplicated, and only one of them is displayed during presentation.

[0133] In some embodiments, the feature extraction network can adopt a tool for calculating characteristic values, for example, the tsfresh toolkit in the Python language, which mainly extracts the indicator characteristics of the monitoring indicator curve, for example, whether it has periodicity, degree of fluctuation, maximum value, minimum value, average value, quantile, etc. Based on the indicator characteristics of each monitoring indicator curve, the outlier characteristics of the monitoring indicator curve relative to the curve set can be determined, and the outlier degree can be calculated using a linear regression network. After the outlier degree prediction model, the abnormal value score (outlier degree) of each monitoring indicator curve can be obtained and sorted in descending order from large to small. The linear regression network can also be replaced by a decision tree, a support vector machine and other structures. In statistics, the linear regression network uses a least squares function called a linear regression equation to model the relationship between one or more independent variables and a dependent variable. This function is a linear combination of one or more regression coefficients (model parameters). The case with only one independent variable is called a simple regression, and the case with more than one independent variable is called a multiple regression. The calculation formula (2) of the linear regression is as follows:

[0134] Y i =β0+β1X i1 +β2X i2 +β3X i3 +...+β p X ip +ε i (2);

[0135] Here, i is a natural number, X represents the outlier feature of the input, and β is a parameter that needs to be trained iteratively offline.

[0136] In some embodiments, curve classification is performed using similarity measurement and clustering algorithm to remove duplicates based on the classification results. A coefficient r is selected to measure the similarity between two monitoring indicator curves. The calculation formula (3) of the coefficient r is as follows:

[0137]

[0138] For the two time series X = (x1, ..., xn) and Y = (y1, ..., yn) corresponding to the two monitoring indicator curves, their similarity value is represented by r. The closer r is to 1, the more similar X and Y are. The closer r is to -1, the more negatively correlated X and Y are. The closer r is to 0, the more uncorrelated X and Y are.

[0139] In some embodiments, the monitoring indicators are clustered based on a one-pass clustering algorithm, and each cluster is labeled with a corresponding cluster label. Figure 12 , Figure 12This is a clustering diagram of the artificial intelligence-based business monitoring method provided in an embodiment of the present application. A similarity calculation is performed between each monitoring indicator curve to be determined and the representative element of the current cluster. After the similarity calculation is performed with the representative elements of all clusters, the cluster corresponding to the maximum similarity is determined. If the maximum similarity is greater than the set similarity threshold, the monitoring indicator curve to be determined is added to the cluster corresponding to the maximum similarity. Otherwise, the monitoring indicator curve to be determined forms a new cluster by itself, and the monitoring indicator curve to be determined is used as the representative element of the new cluster. The difference from the clustering algorithm of the related technology is that only the similarity threshold is set, and the number of clusters does not need to be set. The first monitoring indicator curve that becomes a cluster by itself is used as the representative element of the current cluster, and the representative element is not updated. In practice, the applicant found that the effect of updating the representative element is limited and time-consuming, so the representative element is not updated to improve processing efficiency.

[0140] See also Figures 13A-13B ,The human-computer interaction interface originally presents multiple monitoring indicator curves. ,After outlier degree determination and duplicate removal processing, the 5 most representative monitoring indicator curves are presented. ,The trends of these 5 monitoring indicator curves are different.

[0141] The artificial intelligence-based business monitoring method provided by the embodiment of the present application can achieve the following beneficial effects: clear display, high user-friendliness, users do not need to delete curves from multiple complex monitoring indicator curves, but adaptively calculate outlier monitoring indicator curves for clearer display; problem locating is faster, by sorting the degree of outliers, operation and maintenance personnel can give priority to solving abnormal monitoring curves with higher outlier degrees, so as to find problematic servers more quickly, and it has good versatility. In addition to being used in multi-instance scenarios of cloud virtual machines, it can be expanded to various scenarios that require the display of multiple monitoring indicator curves.

[0142] The following continues to describe the exemplary structure of the artificial intelligence-based business monitoring device 455 provided in the embodiment of the present application as a software module. In some embodiments, such as Figure 6As shown, the software modules in the artificial intelligence-based business monitoring device 455 stored in the memory 450 may include: an acquisition module 4551, used to acquire multiple monitoring indicator curves corresponding to multiple servers in the business system to form a curve set; wherein each server corresponds to at least one monitoring indicator curve; a sorting module 4552, used to determine the outlier degree of each monitoring indicator curve relative to the curve set, and based on the outlier degree, perform descending sorting processing on the multiple monitoring indicator curves based on the outlier degree; a clustering module 4553, used to perform clustering processing on the multiple monitoring indicator curves to obtain at least one curve cluster of the corresponding curve set; a deduplication module 4554, used to perform deduplication processing on the descending sorting processing results of the multiple monitoring indicator curves based on at least one curve cluster to obtain an abnormal monitoring curve.

[0143] In some embodiments, each monitoring indicator curve is used to characterize the data changes of the corresponding server for the indicator, and the acquisition module 4551 is also used to: perform the following processing for each server: receive a monitoring indicator reporting request; extract the data of the corresponding monitoring indicator and the time of the corresponding data from the monitoring indicator reporting request; based on the data and the time of the corresponding data, generate a monitoring indicator curve for the corresponding monitoring indicator of the server.

[0144] In some embodiments, the sorting module 4552 is also used to: perform the following processing for each monitoring indicator curve: extract at least one indicator feature of the monitoring indicator curve; determine at least one type of outlier feature of each monitoring indicator curve relative to the curve set based on at least one indicator feature of each monitoring indicator curve; determine the degree of outlier of each monitoring indicator curve based on at least one type of outlier feature of each monitoring indicator curve relative to the curve set.

[0145] In some embodiments, the sorting module 4552 is also used to: query the feature type corresponding to the indicator type, and obtain at least one indicator feature of the monitoring indicator curve that is consistent with the feature type; wherein the indicator feature includes at least one of the following: the fluctuation indicator feature of the monitoring indicator curve, the periodic indicator feature of the monitoring indicator curve, the extreme value indicator feature of the monitoring indicator curve, the average indicator feature of the monitoring indicator curve, and the percentile indicator feature of the monitoring indicator curve.

[0146] In some embodiments, the sorting module 4552 is also used to: when the number of types of outlier features is one, perform linear processing on one outlier feature based on the outlier influence factor of the corresponding outlier feature to obtain the outlier degree of the corresponding monitoring index curve; when the number of types of outlier features is multiple, use the outlier influence factors corresponding to the multiple types of outlier features of the monitoring index curve as weights, perform weighted summation processing on the multiple outlier features, and bias the weighted summation processing result to obtain the outlier degree of the corresponding monitoring index curve.

[0147] In some embodiments, when there are multiple types of outlier features, the sorting module 4552 is further used to: perform the following processing for each monitoring index curve: combine multiple types of outlier features of the monitoring index curve to obtain multiple combination features of the monitoring index curve, wherein the outlier features used in each combination are partially different or completely different; use the outlier influence factor of each combination feature of the monitoring index curve as a weight parameter, perform weighted summation processing on each combination feature of the monitoring index curve to obtain the outlier degree of the monitoring index curve; wherein the outlier influence factor of the combination feature is the product of the outlier association influence factors of the outlier features included in the combination feature.

[0148] In some embodiments, the clustering module 4553 is also used to: when the number of multiple monitoring indicator curves exceeds a number threshold, classify the multiple monitoring indicator curves to obtain the type of each monitoring indicator curve, and cluster the monitoring indicator curves belonging to each type to obtain at least one curve cluster corresponding to each type of monitoring indicator curve; when the number of multiple monitoring indicator curves does not exceed a number threshold, cluster the multiple monitoring indicator curves to obtain at least one curve cluster of the corresponding curve set.

[0149] In some embodiments, the clustering module 4553 is also used to: use any monitoring indicator curve as a representative element to initialize the curve cluster corresponding to the representative element; use the monitoring indicator curves other than the representative element in the curve set as candidate monitoring indicator curves, and perform the following processing for each candidate monitoring indicator curve: when the candidate monitoring indicator curve and the representative element of any curve cluster meet the clustering conditions, the candidate monitoring indicator curve is classified into any curve cluster; when the candidate monitoring indicator curve does not meet the clustering conditions with each curve cluster, the candidate monitoring indicator curve is used as a new representative element to initialize the curve cluster corresponding to the new representative element.

[0150] In some embodiments, the clustering module 4553 is also used to: determine the similarity between the candidate monitoring indicator curve and the representative element of each curve cluster before classifying the candidate monitoring indicator curve into any curve cluster; when the maximum similarity exceeds the similarity threshold, determine that the candidate monitoring indicator curve and the representative element of the curve cluster corresponding to the maximum similarity meet the clustering condition, and determine any curve cluster by the curve cluster corresponding to the maximum similarity.

[0151] In some embodiments, the clustering module 4553 is also used to: perform the following processing on the representative element of each curve cluster: obtain multiple first data corresponding to each timestamp of the candidate monitoring indicator curve, and multiple second data corresponding to each timestamp of the representative element; obtain the first average data corresponding to multiple timestamps of the candidate monitoring indicator curve, and the second average data corresponding to multiple timestamps of the representative element; based on the difference between each first data and the first average data, and the difference between each second data and the second average data, determine the similarity between the candidate monitoring indicator curve and the representative element.

[0152] In some embodiments, the deduplication module 4554 is also used to: determine the monitoring indicator curve ranked first in the descending sorting processing result as an abnormal monitoring curve; perform the following processing on each remaining monitoring indicator curve in the order represented by the descending sorting result: when the remaining monitoring indicator curves and the abnormal monitoring curves belong to different curve clusters, determine the remaining monitoring indicator curves as abnormal monitoring curves; when the remaining monitoring indicator curves and the abnormal monitoring curves belong to the same curve cluster, remove the remaining monitoring indicator curves from the descending sorting processing result; wherein, the remaining monitoring indicator curves are the monitoring indicator curves other than the monitoring indicator curve ranked first in the descending sorting processing result.

[0153] In some embodiments, the degree of outlier is achieved through a feature extraction network and a regression network; the device also includes: a training module 4555, which is used to: before determining the outlier degree of each monitoring indicator curve relative to the curve set, obtain a curve set sample including multiple monitoring indicator curve samples and a pre-labeled outlier curve sample in the curve set sample; wherein the multiple monitoring indicator curve samples correspond to the same monitoring indicator; the following processing is performed through the feature extraction network: from the curve set sample, extract at least one type of outlier feature sample of each monitoring indicator curve sample relative to the curve set sample; the following processing is performed through the regression network: regression processing is performed on at least one type of outlier feature sample of each monitoring indicator curve sample relative to the curve set sample to obtain the outlier degree of each monitoring indicator curve sample; based on the outlier degree of each monitoring indicator curve sample, a predicted outlier curve sample is determined from the curve set sample; the predicted outlier curve sample and the pre-labeled outlier curve sample are back-propagated in the feature extraction network and the regression network to update the parameters of the feature extraction network and the regression network.

[0154] In some embodiments, based on at least one curve cluster, the descending sorting processing results of multiple monitoring indicator curves are deduplicated to obtain the abnormal monitoring curve, and the device also includes: a human-computer interaction module 4556, which is used to: display the abnormal monitoring curve corresponding to the monitoring indicator; in response to the detail trigger operation of the abnormal monitoring curve, display the monitoring indicator curve belonging to the same curve cluster as the abnormal monitoring curve; in response to the merging operation of the abnormal monitoring curve, based on the target curve of the merging operation, adjust the similarity threshold used for clustering processing, and based on at least one new curve cluster corresponding to the new similarity threshold, deduplicate the descending sorting processing results of multiple monitoring indicator curves to obtain a new abnormal monitoring curve corresponding to the monitoring indicator.

[0155] In some embodiments, after obtaining multiple monitoring indicator curves corresponding to multiple servers in the business system to form a curve set, the human-computer interaction module 4556 is also used to: display the curve set; in response to an outlier display operation on the curve set, determine to perform descending sorting, clustering, and deduplication processing to obtain abnormal monitoring curves; in the displayed curve set, hide the monitoring indicator curves that are not identified as abnormal monitoring curves.

[0156] In some embodiments, after deduplication processing is performed on the descending sorting results of multiple monitoring indicator curves to obtain the abnormal monitoring curve, the human-computer interaction module 4556 is also used to: when the number of abnormal monitoring curves is one, query the abnormal server and monitoring indicator corresponding to the abnormal monitoring curve to perform fault handling operations on the abnormal server based on the monitoring indicator; when the number of abnormal monitoring curves is multiple, perform the following processing: query the abnormal server and monitoring indicator corresponding to each abnormal monitoring curve, and perform abnormal descending sorting processing on the abnormal server based on the outlier degree of each abnormal monitoring curve; perform fault handling operations on the abnormal server based on the monitoring indicator according to the abnormal descending sorting processing results.

[0157] The embodiment of the present application provides a computer-readable storage medium storing executable instructions, wherein the executable instructions are stored. When the executable instructions are executed by a processor, the processor will execute the artificial intelligence-based business monitoring method provided by the embodiment of the present application, for example, Figures 7A-7C The business monitoring method based on artificial intelligence is shown.

[0158] In some embodiments, the computer-readable storage medium may be a memory such as FRAM, ROM, PROM, EPROM, EEPROM, flash memory, magnetic surface memory, optical disk, or CD-ROM; or various devices including one or any combination of the above memories.

[0159] In some embodiments, executable instructions may be in the form of a program, software, software module, script, or code, written in any form of programming language (including compiled or interpreted languages, or declarative or procedural languages), and may be deployed in any form, including as a stand-alone program or as a module, component, subroutine, or other unit suitable for use in a computing environment.

[0160] As an example, executable instructions may, but need not, correspond to a file in a file system, may be stored as part of a file that stores other programs or data, such as in one or more scripts in a HyperText Markup Language (HTML) document, in a single file dedicated to the program in question, or in multiple coordinating files (e.g., files storing one or more modules, subroutines, or code portions).

[0161] By way of example, executable instructions may be deployed to be executed on one computing device, or on multiple computing devices at one site, or on multiple computing devices distributed across multiple sites and interconnected by a communication network.

[0162] In summary, by evaluating the outlier degree of each monitoring indicator curve through the embodiment of the present application, the monitoring indicator curves with abnormal data change patterns can be effectively screened out. Through clustering processing, the number of monitoring indicator curves with abnormal data change patterns can be effectively controlled to obtain abnormal monitoring curves, thereby effectively improving business monitoring efficiency while conducting comprehensive monitoring.

[0163] The above are merely examples of the present application and are not intended to limit the scope of protection of the present application. Any modifications, equivalent replacements, and improvements made within the spirit and scope of the present application are included in the scope of protection of the present application.

Claims

1. A business monitoring method based on artificial intelligence, characterized in that: include: Acquire multiple monitoring indicator curves corresponding to multiple servers in the business system to form a curve set; Wherein, each of the servers corresponds to at least one monitoring indicator curve; Determining the outlier degree of each monitoring indicator curve relative to the curve set, and sorting the plurality of monitoring indicator curves in descending order based on the outlier degree; performing clustering processing on the plurality of monitoring indicator curves to obtain at least one curve cluster corresponding to the curve set; Based on the at least one curve cluster, duplicate removal is performed on the descending sorting results of the multiple monitoring indicator curves to obtain an abnormal monitoring curve.

2. The method according to claim 1, characterized in that Determining the degree of outlier of each monitoring indicator curve relative to the curve set includes: The following processing is performed for each monitoring indicator curve: Extracting at least one indicator feature of the monitoring indicator curve; Determining, based on at least one indicator feature of each of the monitoring indicator curves, at least one type of outlier feature of each of the monitoring indicator curves relative to the curve set; The outlier degree of each monitoring indicator curve is determined based on at least one type of outlier feature of each monitoring indicator curve relative to the curve set.

3. The method according to claim 2, characterized in that The determining the outlier degree of each monitoring indicator curve based on at least one type of outlier feature of each monitoring indicator curve relative to the curve set includes: When the number of types of the outlier feature is one, linear processing is performed on one of the outlier features based on the outlier influence factor corresponding to the outlier feature to obtain an outlier degree corresponding to the monitoring index curve; When there are multiple types of outlier features, the outlier impact factors corresponding to the multiple types of outlier features of the monitoring index curve are used as weights, and a weighted summation process is performed on the multiple outlier features. The weighted summation process result is biased to obtain the outlier degree corresponding to the monitoring index curve.

4. The method according to claim 1, wherein The clustering process of the plurality of monitoring indicator curves to obtain at least one curve cluster corresponding to the curve set includes: Classifying the multiple monitoring indicator curves to obtain a type of each monitoring indicator curve; Clustering is performed on the monitoring indicator curves belonging to each of the types to obtain at least one curve cluster corresponding to each of the monitoring indicator curves of the type.

5. The method according to claim 1, wherein The clustering process of the plurality of monitoring indicator curves to obtain at least one curve cluster corresponding to the curve set includes: Taking any one of the monitoring indicator curves as a representative element, initializing a curve cluster corresponding to the representative element; The monitoring indicator curves other than the representative element in the curve set are taken as candidate monitoring indicator curves, and the following processing is performed on each candidate monitoring indicator curve: When the candidate monitoring indicator curve and the representative element of any curve cluster meet the clustering condition, the candidate monitoring indicator curve is classified into the any curve cluster; When the candidate monitoring indicator curve and each of the curve clusters do not meet the clustering condition, the candidate monitoring indicator curve is used as a new representative element, and a curve cluster corresponding to the new representative element is initialized.

6. The method according to claim 5, characterized in that Before classifying the candidate monitoring indicator curve into any one of the curve clusters, the method further includes: Determining the similarity between the candidate monitoring indicator curve and the representative element of each curve cluster; When the maximum similarity exceeds the similarity threshold, it is determined that the representative element of the cluster of the candidate monitoring indicator curve and the curve corresponding to the maximum similarity meets the clustering condition, and The curves corresponding to the maximum similarity are clustered to determine the arbitrary curve cluster.

7. The method according to claim 6, characterized in that The candidate monitoring indicator curve and the representative element have the same multiple timestamps, and determining the similarity between the candidate monitoring indicator curve and the representative element of each curve cluster includes: The following processing is performed on the representative element of each curve cluster: Acquire a plurality of first data corresponding to each of the timestamps of the candidate monitoring indicator curve, and a plurality of second data corresponding to each of the timestamps of the representative element; Obtaining first average data of the candidate monitoring indicator curve corresponding to the multiple timestamps, and second average data of the representative element corresponding to the multiple timestamps; Based on the difference between each first data and the first average data, and the difference between each second data and the second average data, the similarity between the candidate monitoring indicator curve and the representative element is determined.

8. The method according to claim 1, characterized in that The step of performing deduplication processing on the descending sorting results of the plurality of monitoring indicator curves based on the at least one curve clustering to obtain an abnormal monitoring curve includes: Determine the monitoring indicator curve that ranks first in the descending sorting result as the abnormal monitoring curve; For each remaining monitoring indicator curve, perform the following processing in the order represented by the descending sorting result: When the remaining monitoring indicator curve and the abnormal monitoring curve belong to different curve clusters, determining the remaining monitoring indicator curve as the abnormal monitoring curve; When the remaining monitoring indicator curve and the abnormal monitoring curve belong to the same curve cluster, removing the remaining monitoring indicator curve from the descending sorting processing result; The remaining monitoring indicator curves are monitoring indicator curves other than the monitoring indicator curve ranked first in the descending sorting result.

9. The method according to claim 1, characterized in that The outlier degree is achieved through a feature extraction network and a regression network; Before determining the degree of outlier of each monitoring indicator curve relative to the curve set, the method further includes: Acquire a curve set sample including a plurality of monitoring indicator curve samples and a pre-labeled outlier curve sample in the curve set sample; Wherein, the multiple monitoring indicator curve samples correspond to the same monitoring indicator; The feature extraction network performs the following processing: extracting at least one type of outlier feature sample of each monitoring indicator curve sample relative to the curve set sample from the curve set sample; The following processing is performed by the regression network: regression processing is performed on at least one type of outlier feature sample of each monitoring indicator curve sample relative to the curve set sample to obtain the outlier degree of each monitoring indicator curve sample; Determining a predicted outlier curve sample from the curve set samples based on the outlier degree of each monitoring indicator curve sample; The predicted outlier curve samples and the pre-labeled outlier curve samples are back-propagated in the feature extraction network and the regression network to update the parameters of the feature extraction network and the regression network.

10. The method according to claim 1, characterized in that After performing deduplication processing on the descending sorting results of the plurality of monitoring indicator curves based on the at least one curve clustering to obtain an abnormal monitoring curve, the method further includes: Displaying an abnormal monitoring curve corresponding to the monitoring indicator; In response to a triggering operation on the details of the abnormal monitoring curve, displaying a monitoring indicator curve belonging to the same curve cluster as the abnormal monitoring curve; In response to the merging operation of the abnormal monitoring curves, adjusting the similarity threshold for clustering processing based on the target curve of the merging operation, and Based on at least one new curve cluster corresponding to the new similarity threshold, deduplication processing is performed on the descending sorting processing results of the multiple monitoring indicator curves to obtain a new abnormal monitoring curve corresponding to the monitoring indicator.

11. The method according to claim 1, wherein After obtaining a plurality of monitoring indicator curves corresponding to a plurality of servers in the business system to form a curve set, the method further includes: displaying the set of curves; In response to an outlier display operation on the curve set, determining to perform the descending sorting process, the clustering process, and the deduplication process to obtain an abnormal monitoring curve; In the displayed curve set, monitoring indicator curves that are not identified as abnormal monitoring curves are hidden.

12. The method according to claim 1, characterized in that After performing deduplication processing on the descending sorting results of the plurality of monitoring indicator curves to obtain an abnormal monitoring curve, the method further includes: When the number of the abnormal monitoring curve is one, querying the abnormal server and monitoring indicators corresponding to the abnormal monitoring curve to perform a fault handling operation on the abnormal server based on the monitoring indicators; When there are multiple abnormal monitoring curves, the following processing is performed: Query the abnormal server and monitoring indicators corresponding to each of the abnormal monitoring curves, Based on the outlier degree of each of the abnormal monitoring curves, the abnormal servers are sorted in descending order of abnormality; According to the abnormal descending sorting processing results, a fault processing operation based on the monitoring indicators is performed on the abnormal server.

13. A business monitoring device based on artificial intelligence, characterized in that: include: An acquisition module, configured to acquire a plurality of monitoring indicator curves corresponding to a plurality of servers in a business system to form a curve set; wherein each of the servers corresponds to at least one of the monitoring indicator curves; a sorting module, configured to determine an outlier degree of each monitoring indicator curve relative to the curve set, and sort the plurality of monitoring indicator curves in descending order based on the outlier degree; A clustering module, configured to perform clustering processing on the plurality of monitoring indicator curves to obtain at least one curve cluster corresponding to the curve set; The deduplication module is used to perform deduplication processing on the descending sorting processing results of the multiple monitoring indicator curves based on the at least one curve cluster to obtain an abnormal monitoring curve.

14. An electronic device, characterized in that: include: a memory for storing executable instructions; The processor is configured to implement the artificial intelligence-based business monitoring method according to any one of claims 1 to 12 when executing the executable instructions stored in the memory.

15. A computer-readable storage medium, characterized in that Executable instructions are stored for implementing the artificial intelligence-based business monitoring method described in any one of claims 1 to 12 when executed by a processor.

Images