An abnormality positioning method, device, apparatus, and storage medium

Abstract

The present specification discloses a method, device, equipment and storage medium for locating an exception, when an exception event of a target application program is monitored, each data dimension involved in the associated data associated with the exception event can be investigated, so as to determine the data dimension that may be the cause of the exception event as an exception data dimension, and then the specific exception cause is determined according to the investigated exception data dimension, thereby improving the efficiency of investigating the fault cause.

Description

Technical Field

[0001] This specification relates to the field of computer technology, and in particular to a method, apparatus, device, and storage medium for anomaly localization. Background Technology

[0002] To ensure the normal operation of internet application services and the security of private data, developers typically collect and aggregate performance-related metrics during application service runtime to obtain Service Level Objectives (SLOs). These SLO metrics are used to promptly identify anomalies in the application service, thereby ensuring its normal operation. For example, metrics such as the number of requests, response time, and number of request errors obtained from application service interfaces or request logs can be aggregated to obtain SLO health metrics such as request success rate and average response time. These SLO health metrics can then reflect the overall service performance and quality of the application service to developers.

[0003] However, since the SLO health metric is obtained by aggregating data during application service runtime, it reflects the overall performance of the application service. Therefore, developers can often only use the SLO health metric to determine whether there are problems with the application service, but cannot use it to determine the specific reasons that cause the application service to malfunction.

[0004] Therefore, how to pinpoint the cause of anomalies and improve the efficiency of anomaly detection is an urgent problem to be solved. Summary of the Invention

[0005] This specification provides a method, apparatus, device, and storage medium for anomaly localization, in order to partially solve the problem of the inability to locate the cause of anomalies in the prior art.

[0006] The following technical solution is adopted in this specification:

[0007] This manual provides a method for anomaly localization, including:

[0008] When an abnormal event is detected in the target object, data associated with the abnormal event is acquired as the associated data.

[0009] For each data dimension involved in the associated data, based on the data under that data dimension contained in the associated data, the data sequence corresponding to that data dimension is obtained, abnormal data existing in the data sequence corresponding to that data dimension is filtered, and based on the abnormal data, it is determined whether that data dimension is an abnormal data dimension.

[0010] Based on the identified abnormal data dimensions, locate the specific abnormality generated by the target object.

[0011] Optionally, filtering out anomalies in the data sequence corresponding to this data dimension, specifically including:

[0012] The data sequence corresponding to this data dimension is smoothed using a preset smoothing algorithm to obtain the baseline sequence corresponding to this data dimension.

[0013] Based on the baseline sequence, abnormal data in the data sequence corresponding to this data dimension are filtered out.

[0014] Optionally, a baseline sequence of the data sequence corresponding to the data dimension is obtained by smoothing the data sequence corresponding to the data dimension using a preset smoothing algorithm, specifically including:

[0015] By using a preset filter, the filtered data sequence corresponding to the data dimension is obtained, and the distribution parameters of the filtered data sequence are determined.

[0016] Based on the distribution parameters and the preset smoothing optimization algorithm, the data sequence corresponding to the data dimension is optimized to obtain the baseline sequence corresponding to the data dimension.

[0017] Optionally, determining the distribution parameters of the filtered data sequence specifically includes:

[0018] Confidence intervals are constructed in the filtered data sequence based on the preset quantiles;

[0019] Based on the data in the confidence interval, determine the distribution parameters of the filtered data sequence.

[0020] Optionally, based on the baseline sequence, outlier data in the data sequence corresponding to that data dimension is filtered out, specifically including:

[0021] Determine the residual sequence between the data sequence corresponding to this data dimension and the baseline sequence;

[0022] For each data point in the residual sequence, determine whether the data point exceeds a preset threshold;

[0023] If so, then the data corresponding to that data in the data sequence is determined to be abnormal data existing in the data sequence.

[0024] Optionally, determining whether a data dimension is an anomalous data dimension based on the anomalous data specifically includes:

[0025] Based on the abnormal data, determine the confidence level of the data sequence corresponding to the data dimension;

[0026] Based on the confidence level of the data sequence corresponding to the data dimension, determine whether the data dimension is an anomalous data dimension.

[0027] Optionally, based on the abnormal data, the confidence level of the data sequence corresponding to the data dimension is determined, specifically including:

[0028] The confidence level of the data sequence corresponding to the abnormal data dimension as an abnormal data sequence is determined based on the difference between the time corresponding to the abnormal data determined by the timestamp of the abnormal data and the time when the abnormal event was detected.

[0029] Optionally, based on the abnormal data, the confidence level of the data sequence corresponding to the data dimension is determined, specifically including:

[0030] The confidence level of a data sequence corresponding to a data dimension as an anomalous data sequence is determined based on the number of anomalous data contained in the data sequence corresponding to that data dimension and its proportion among all anomalous data contained in the data sequences corresponding to each data dimension.

[0031] Optionally, based on the abnormal data, the confidence level of the data sequence corresponding to the data dimension is determined, specifically including:

[0032] Based on the similarity between the function graph formed by the data in the data sequence corresponding to the data dimension and the function graph formed by the associated data, the confidence level of the data sequence corresponding to the data dimension as an abnormal data sequence is determined.

[0033] Optionally, retrieve the associated data, specifically including:

[0034] Obtain each original associated data, as well as the dependent data that have a dependency relationship with each original associated data;

[0035] The dependency data of each original associated data is supplemented into each original associated data to obtain each associated data. This specification provides an anomaly localization device, including:

[0036] The acquisition module is used to acquire data associated with the abnormal event when an abnormal event is detected in the target object, as the associated data.

[0037] The determination module is used to, for each data dimension involved in the associated data, obtain the data sequence corresponding to the data dimension based on the data under the data dimension contained in the associated data, filter out abnormal data in the data sequence corresponding to the data dimension, and determine whether the data dimension is an abnormal data dimension based on the abnormal data.

[0038] The location module is used to locate the specific anomaly generated by the target object based on the determined abnormal data dimensions.

[0039] This specification provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described method for anomaly localization.

[0040] This specification provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the above-described method for anomaly localization.

[0041] The above-mentioned technical solutions adopted in this specification can achieve the following beneficial effects:

[0042] The anomaly localization method provided in this specification, when an anomaly event is detected in a target object, acquires data associated with the anomaly event as each associated data. For each data dimension involved in each associated data, based on the data under that data dimension contained in each associated data, a data sequence corresponding to that data dimension is obtained. Abnormal data existing in the data sequence corresponding to that data dimension is filtered out. Based on the filtered abnormal data, it is determined whether the data dimension is an abnormal data dimension. Based on the determined abnormal data dimension, the specific anomaly generated by the target object is located.

[0043] As can be seen from the above method, when an abnormal event is detected in the target application, each data dimension involved in the associated data related to the abnormal event can be investigated to determine the data dimension that may be the cause of the abnormal event. This data dimension is then used as the abnormal data dimension. Based on the abnormal data dimension that has been investigated, the specific cause of the abnormality can be determined, thereby improving the efficiency of troubleshooting. Attached Figure Description

[0044] The accompanying drawings, which are included to provide a further understanding of this specification and form part of this specification, illustrate exemplary embodiments and are used to explain this specification, but do not constitute an undue limitation thereof. In the drawings:

[0045] Figure 1 This is a flowchart illustrating a method for anomaly localization provided in this specification;

[0046] Figure 2 This is a schematic diagram of a single piece of associated data provided in this specification;

[0047] Figure 3 This is a schematic diagram of the two data sequences provided in this specification;

[0048] Figure 4 This is a schematic diagram illustrating the process of filtering out abnormal data from a data sequence, as provided in this specification.

[0049] Figure 5 This is a schematic diagram illustrating the location result of an anomaly provided in this specification;

[0050] Figure 6 This is a schematic diagram of an anomaly location device provided in this specification;

[0051] Figure 7 This specification provides a corresponding Figure 1 A schematic diagram of an electronic device. Detailed Implementation

[0052] To make the objectives, technical solutions, and advantages of this specification clearer, the technical solutions of this specification will be clearly and completely described below in conjunction with specific embodiments and corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of this specification, and not all of them. Based on the embodiments in this specification, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this specification.

[0053] The technical solutions provided in the various embodiments of this specification are described in detail below with reference to the accompanying drawings.

[0054] Figure 1 This is a flowchart illustrating a method for anomaly localization provided in this specification, including the following steps:

[0055] S100: When an abnormal event is detected in the target object, acquire the data associated with the abnormal event as the associated data.

[0056] Currently, because internet application services often have the characteristics of large request volume and high concurrency, websites generally adopt a distributed deployment scheme, deploying application services on multiple nodes, and using load balancing technology to distribute requests to each node according to a round-robin algorithm, thereby reducing the operating pressure on individual nodes.

[0057] However, since each node may fail during operation, monitoring and data collection scripts need to be deployed on each computing node to periodically obtain performance-related metrics of the application service. These metrics include the number of requests, response time, and number of request errors obtained from the application service's interface or request logs. These metrics can then be aggregated according to different time units to obtain Service Level Objective (SLO) health metrics. For example, based on the number of requests and request errors in the past month, the application service's request success rate (SLO health metric) can be aggregated. Similarly, based on the response time of each request to the application service in the past month, the average response time of requests to the application service in the past month (SLO health metric) can be aggregated.

[0058] In the above content, SLO health metrics can include metrics such as: request success rate, average request time, and application service availability (determined based on the application service's runtime and the number of exceptions).

[0059] Furthermore, once the business platform detects that any SLO health metric exceeds the preset range, it can be considered as detecting an abnormal event. The business platform can obtain the data associated with the abnormal SLO health metric from the application service's request logs as the associated data.

[0060] For example, if the business platform detects that the "average request time" in the SLO health metric of an application service exceeds a preset threshold, the data associated with the average request time could be such as: the timestamp of each request to the application service, the response time of each request, the client's Internet Protocol (IP) address corresponding to each request, the browser version corresponding to each request, the geographical location of the device corresponding to each request, and the response code corresponding to each request. In this case, the business platform would obtain one piece of associated data such as... Figure 2 As shown.

[0061] Figure 2 This is a schematic diagram of a piece of associated data provided in this specification.

[0062] from Figure 2As can be seen, a piece of associated data contains the timestamp "1650422651" corresponding to a request to access the application service, the response time "100ms", the client IP address "10.0.0.1" corresponding to the request, the browser version "IE" corresponding to the request, the geographical location of the device "City A" corresponding to the request, and the response code "404" corresponding to the request.

[0063] In the above context, without time constraints, the amount of related data acquired by the business platform could be substantial. However, data that is significantly older than the time the platform detected the anomaly is not particularly helpful in pinpointing the cause of the anomaly and can negatively impact the efficiency of anomaly localization methods. Therefore, when an anomaly is detected, the business platform can acquire data from a period of time close to the time of the detected anomaly as related data (e.g., data from the month immediately preceding the time of the detected anomaly) to improve the efficiency of anomaly localization.

[0064] In practical applications, the reasons for abnormal SLO health indicators may include not only abnormalities in the data dimensions involved in the data associated with the abnormal SLO health indicator, but also abnormalities in the data dimensions involved in other data that are dependent on the data associated with the abnormal SLO health indicator. (This can be understood as follows: in practical applications, relying solely on the data dimensions involved in the data associated with the alarm SLO health indicator to locate the cause of the abnormality may not be sufficient to pinpoint all the causes of the abnormality. Therefore, it is also necessary to investigate the anomalies in other data that are dependent on the data associated with the alarm SLO health indicator to improve the accuracy of the anomaly location results.) Therefore, the business platform can also use the data associated with the abnormal SLO health indicator as the original associated data, then obtain the dependent data of these original associated data, and supplement the original associated data with the dependent data of each original associated data to obtain the associated data. For example, as we can see from the above, a piece of associated data corresponds to a request related to an application service. When an application service responds to a request, it usually needs to send a request to the database to retrieve the data. The data recorded in the database that is associated with the data retrieval request (such as the response time of the data retrieval request, the type of method for requesting data, etc.) is the dependent data of the original associated data mentioned above.

[0065] In this specification, the executing entity of the method for anomaly location can refer to a designated device set up on the business platform, such as a server, or a terminal device such as a desktop computer or a laptop computer. For ease of description, the following description will only use the server as the executing entity to illustrate the anomaly location method provided in this specification.

[0066] S102: For each data dimension involved in the associated data, based on the data under that data dimension contained in the associated data, obtain the data sequence corresponding to that data dimension, filter out the abnormal data in the data sequence corresponding to that data dimension, and determine whether the data dimension is an abnormal data dimension based on the abnormal data.

[0067] After obtaining the associated data, the server can use a preset aggregation function to divide the data in each associated data into data dimensions for each data dimension, so as to obtain the data sequence corresponding to the data dimension. Then, it can filter out the abnormal data in the data sequence corresponding to the data dimension, and determine whether the data dimension is an abnormal data dimension based on the filtered abnormal data.

[0068] Each data dimension involved in the associated data can be such as: client IP dimension, browser version dimension, geographical location dimension, response code dimension, etc.

[0069] In the above content, the data sequence corresponding to a data dimension can be of two types. The first type is a data sequence containing all data under a data dimension. The second type is a data sequence obtained by dividing the data corresponding to a single value under that data dimension and sorting them according to the chronological order of each data point. The following will combine... Figure 3 These two data sequences will be explained in detail.

[0070] Figure 3 This is a schematic diagram of the two data sequences provided in this specification.

[0071] Combination Figure 3As can be seen, the server can segment the data under the "client IP address" data dimension from the associated data to obtain the data sequence corresponding to the "client IP address" data dimension. In the data sequence corresponding to the "client IP address" data dimension, a data item contains only three values: timestamp, monitoring value, and data dimension. The timestamp is used to represent time information, and the monitoring value is determined by the SLO health metric corresponding to the detected abnormal event. For example, if the SLO health metric corresponding to the detected abnormal event is the average response time of the request, then the corresponding monitoring value can be the response time. As another example, if the SLO health metric corresponding to the detected abnormal event is the request success rate, then the corresponding monitoring value can be the response code (different response codes correspond to the response status of the request, for example: 200 represents a successful request, 404 represents a request address not found, 500 represents an internal server error, etc.).

[0072] from Figure 3 As can be seen, the first type of data sequence divides all data under a data dimension into a data sequence. This data sequence can contain all data corresponding to client IP addresses: 10.0.0.1, 10.0.0.2, and 10.0.0.3. In this case, anomaly investigation can be carried out on the client IP address data dimension, and it can be determined whether there are any anomalies in the client IP address data dimension.

[0073] The second type of data sequence involves dividing the data corresponding to each value under this data dimension to obtain multiple data sequences, such as... Figure 3 The client IP addresses in the data are as follows: 10.0.0.1 corresponds to one data sequence, 10.0.0.2 corresponds to another data sequence, and 10.0.0.3 corresponds to yet another data sequence. Therefore, for each value in the client IP address data dimension, anomaly checks can be performed on each corresponding data sequence to determine if there are any anomalies in the clients with IP addresses of 10.0.0.1, 10.0.0.2, and 10.0.0.3.

[0074] Furthermore, after obtaining the data sequences corresponding to each data dimension, the server can filter out abnormal data in the data sequences corresponding to each data dimension. Then, based on the filtered abnormal data, the confidence level of the data sequence corresponding to the data dimension can be determined. Finally, based on the confidence level of the data sequence corresponding to the data dimension, it can be determined whether the data dimension is an abnormal data dimension.

[0075] Specifically, the server can obtain an initial filtered data sequence for each data dimension's corresponding data sequence using a preset filter (e.g., a Butterworth low-pass filter). Based on this initial filtered data sequence, the server determines the residual sequence between the original data sequence and the initial filtered data sequence, which serves as the filtered data sequence for that data dimension. The server also determines the standard deviation and mean of the filtered data sequence, as shown in the following formula:

[0076]

[0077] In the above formula, For data sequences, This is the initial filtered data sequence. This is the filtered data sequence.

[0078] As can be seen from the above formula, the server can use a filter to filter each data sequence, thereby obtaining a filtered data sequence.

[0079] In addition, to avoid the influence of some abnormal data in the filtered data sequence on the final location result (for example, a filtered data sequence may contain a small number of abnormal data, but among these abnormal data is an abnormal data with an extremely high residual value. In this case, the filtered data sequence may be identified as an abnormal data sequence because of this abnormal data with an extremely high residual value), the server can also filter each data in the filtered data sequence and determine the distribution parameters of each data in the filtered data sequence based on the filtered data.

[0080] One method for filtering is to construct confidence intervals in the filtered data sequence based on preset quantiles, and then determine the distribution parameters of the filtered data sequence based on the data falling within the confidence intervals. The preset quantiles can be, for example, the upper quartile and the lower quartile (after sorting an array from smallest to largest, the number in the 1 / 4 position is the upper quartile, and the number in the 3 / 4 position is the lower quartile). Confidence intervals are then constructed based on these upper and lower quartiles, as shown in the following formula:

[0081] D=[2.5q1-1.5q3, 2.5q3-1.5q1]

[0082] In the above formula, q1 is the filtered data sequence. The upper quartile, q3 is the filtered data sequence. The lower quartile of the data, D is the confidence interval. The server can determine the distribution parameters of the filtered data based on the data in the confidence interval of the filtered data sequence. The distribution parameters of the filtered data sequence can be, for example, the standard deviation and the mean.

[0083] It should be noted that the average standard deviation in this specification refers to the average standard deviation of the monitored values ​​in each data point of the data series.

[0084] Furthermore, based on the determined standard deviation of the filtered data sequence, the data sequence is optimized to obtain the corresponding baseline sequence, as shown in the following formula:

[0085]

[0086] In the above formula, y(t) is the baseline sequence, α is the forgetting factor, and N is the hyperparameter.

[0087] As can be seen from the above formula, the server can use a smoothing algorithm and the determined standard deviation of the filtered data sequence to smooth the data sequence (which can be understood as reducing the fluctuation of data with large fluctuations in the data sequence) to obtain a baseline sequence.

[0088] Furthermore, the residual sequence between the data sequence and the baseline sequence is determined, and the confidence interval of the residual sequence is constructed according to the preset quantile. The distribution parameters of the residual sequence are obtained based on the data in the residual sequence that are within the confidence interval.

[0089] It should be noted that each data point in the residual sequence corresponds one-to-one with each data point in the data sequence. For example, suppose there is a data sequence {4, 5, 6} and the baseline sequence of the data sequence is {2, 3, 4}. Then the residual sequence between the data sequence and the baseline sequence is {2, 2, 2}.

[0090] Furthermore, based on the mean and variance of the residual sequence, a normalization transformation is performed on the residual sequence between the data sequence and the baseline sequence to obtain the normalized residual sequence. The specific formula can be found in the following formula:

[0091]

[0092] In the above formula, This is the normalized residual sequence, u(i) is the residual sequence, μ is the mean of the residual sequence, and σ is the standard deviation of the residual sequence.

[0093] Furthermore, for each data point in the normalized residual sequence, it is determined whether the data exceeds a preset threshold. If so, the corresponding data in the data sequence is identified as an outlier in the data sequence. Figure 4 As shown.

[0094] Figure 4 This is a schematic diagram illustrating the process of filtering out abnormal data from a data sequence, as provided in this specification.

[0095] exist Figure 4 In the graph, the horizontal axis represents the time corresponding to the timestamp of a data point, and the vertical axis represents the monitored value of that data point. The darker, more volatile solid line x(t) represents the data sequence, the lighter, smoother solid line y(t) represents the baseline sequence, and the two dashed lines represent the data range corresponding to preset thresholds. Figure 4 As can be seen, the server can filter out data with large fluctuations in the data sequence as outliers.

[0096] Furthermore, the server can determine the confidence level of the data sequence based on the filtered abnormal data, and determine whether the data dimension is an abnormal data dimension based on the confidence level of the data sequence corresponding to the data dimension.

[0097] Specifically, there are three methods for a server to determine the confidence level of a data sequence based on abnormal data, which will be explained in detail below.

[0098] The first method involves the server determining the confidence level of a data sequence corresponding to a data dimension as an anomalous data sequence based on the difference between the time corresponding to the anomalous data determined by the timestamp of the anomalous data and the time of occurrence of the detected anomalous event. The specific formula can be found in the following formula:

[0099] t delta =|t alert -t anomaly |

[0100]

[0101] In the above formula, t alert To correlate with the time of occurrence of the detected abnormal events, t anomaly The time corresponding to the outlier data is determined based on the timestamp of the outlier data. t0 and τ are hyperparameters, and score is... time The score of a data sequence is determined by the difference between the time corresponding to the abnormal data and the time when the abnormal event was detected.

[0102] As can be seen from the above formula, scoretime ∈(0,1), score time The higher the value, the greater the likelihood that the data sequence is the cause of the abnormal SLO health index corresponding to the detected abnormal event, and the lower the confidence level of the data sequence.

[0103] The second method involves the server determining the confidence level of a data sequence corresponding to a data dimension as an anomalous data sequence based on the proportion of anomalous data contained in the data sequence corresponding to that data dimension among all anomalous data contained in the data sequences corresponding to each data dimension. The specific formula can be found in the following formula:

[0104]

[0105]

[0106] In the above formula, sum i It is the number of outliers in any given data sequence. γ is the total number of outliers in the entire data sequence, γ is the percentage of outliers in the entire data sequence, γ0 and τ are hyperparameters, and score error_abs The score of a data sequence is determined by the proportion of the number of outliers in the data sequence to all outliers in the corresponding data dimensions.

[0107] As can be seen from the above, score error_abs ∈(0,1), score error_abs The higher the value, the greater the likelihood that the data sequence is the cause of the abnormal SLO health index corresponding to the detected abnormal event, and the lower the confidence level of the data sequence.

[0108] In addition, the server can determine the confidence level of a data sequence corresponding to a data dimension as an anomalous data sequence by measuring the normalized value of the data sequence among all anomalous data in the data sequence corresponding to each data dimension. The specific formula can be found in the following formula:

[0109]

[0110]

[0111] In the above formula, sum iS is the number of outliers in any given data sequence. max(S) is the maximum number of outliers in a given data sequence, min(S) is the minimum number of outliers in a given data sequence, δ is the normalized value of the number of outliers in the given data sequence compared to all outliers, and δ0 and τ are hyperparameters. error_per The score of a data sequence is determined by the normalized value of the number of outliers in the data sequence for each data dimension.

[0112] As can be seen from the above, score error_per ∈(0,1), score error_per The higher the value, the greater the likelihood that the data sequence is the cause of the abnormal SLO health index corresponding to the detected abnormal event, and the lower the confidence level of the data sequence.

[0113] Furthermore, the server can also determine the confidence level of a data sequence corresponding to a data dimension as an anomalous data sequence based on the proportion of the number of anomalous data contained in the data sequence corresponding to that data dimension among all anomalous data contained in the data sequences corresponding to each data dimension. Additionally, it can determine the confidence level of the data sequence based on the normalized value of the number of anomalous data contained in the data sequence corresponding to that data dimension among all anomalous data contained in the data sequences corresponding to each data dimension. See the following formula for details:

[0114] score error =score error_abs ×score error_per

[0115] In the above formula, score error The score is determined by the number of outliers corresponding to the data sequence, where if the score error The higher the value, the greater the likelihood that the data sequence is the cause of the abnormal SLO health index corresponding to the detected abnormal event, and the lower the confidence level of the data sequence.

[0116] The third method involves the server determining the confidence level of a data sequence corresponding to a data dimension as an anomalous data sequence based on the similarity between the distribution of anomalous data in the data sequence and the distribution of all anomalous data in the associated data. The following formula can be used as a reference:

[0117]

[0118] In the above formula, x(i) is the data sequence, SLO(i) is the sequence of associated data, and μx Let x(i) be the average value of the monitored values ​​in the data sequence x(i), and μSLO be the average value of the monitored values ​​in the sequence composed of related data. shape The score is determined based on the similarity between the function graph composed of the data in the data sequence corresponding to the data dimension and the graph composed of each associated data.

[0119] As can be seen from the above formula, score shape The higher the score (∈[0,1]), the greater the likelihood that the data sequence is the cause of the abnormal SLO health index corresponding to the detected abnormal event, and the lower the confidence level of the data sequence.

[0120] It should be noted that the three methods for determining the confidence level of a data sequence mentioned above can be used individually or in combination. In this case, the server can determine the overall confidence level of the data sequence based on the three confidence levels obtained through the three methods described above, and then determine whether the data sequence is an anomalous data sequence based on the overall confidence level. The following formula can be used as a reference for details:

[0121]

[0122] In the above formula, score represents the overall confidence level of the data sequence. shape score time score error The three confidence levels are determined using the three methods described above for determining the confidence level of the data sequence.

[0123] Furthermore, the server can determine whether the data sequence is an anomalous data sequence based on whether the confidence level of the data sequence exceeds a preset threshold. Then, it can determine whether the data dimension is an anomalous data dimension based on whether the data sequence corresponding to a data dimension is an anomalous data sequence. If any data sequence in the data sequence corresponding to the data dimension is an anomalous data sequence, then the data dimension can be determined to be an anomalous data dimension.

[0124] S104: Based on the determined abnormal data dimensions, locate the specific abnormality generated by the target object.

[0125] After filtering out the abnormal data dimensions, the server can locate the specific anomaly of the target object (i.e., the reason why the target object's SLO health index is abnormal) based on the determined abnormal data dimensions.

[0126] Specifically, the server can organize the information of the data sequence corresponding to the anomaly dimension to obtain the localization result. The information of the data sequence corresponding to the anomaly dimension can be such as: the confidence level of the data sequence, the number of abnormal data in the data sequence, the proportion of the number of abnormal data in the data sequence in all abnormal data, etc. Then, the anomaly localization result can be sent to the client used by the developer so that the developer can perform anomaly handling tasks based on the anomaly localization result.

[0127] It should be noted that in the anomaly localization results, the order of each anomaly data dimension is arranged according to the pre-configured order by the developers. The data dimensions listed earlier in the order have higher importance, such as... Figure 5 As shown.

[0128] Figure 5 This is a schematic diagram illustrating one of the abnormal location results provided in this specification.

[0129] from Figure 5 As can be seen, the service area can organize the obtained anomaly location results, and can list the filtered anomaly data dimensions and the information of the data sequence corresponding to each anomaly data dimension, for example: Figure 5 The client IP address dimension, and the data sequences corresponding to client IP 10.0.0.1 and client IP 10.0.0.3 under this data dimension, are considered anomalous data sequences. Specifically, the number of anomalous data in the data sequence corresponding to client IP 10.0.0.1 is 5, accounting for 5% of all anomalous data; and the number of anomalous data in the data sequence corresponding to client IP 10.0.0.3 is 8, accounting for 8% of all anomalous data. Figure 5 In this context, the higher the data dimension is placed, the more important it becomes. For example: in Figure 5 In this context, the client IP address dimension is more important than the geographic location dimension.

[0130] In the above content, there are three ways for the server to display the anomaly location results to the developers. The following will explain each of these three methods in detail.

[0131] One approach is for the server to generate location results in plain text and JavaScript Object Notation (JSON) data format and provide them to developers via an Application Programming Interface (API) so that developers can access the location results.

[0132] The second method is for the server to send the generated location results to the developers via instant messaging software.

[0133] The third method is for the server to render the location results as rich text and display it to the developers through the browser.

[0134] As can be seen from the above, when the server detects an abnormal event in the application, it can investigate each data dimension in the associated data related to the abnormal event to identify the abnormal data dimensions that may have caused the abnormal event. Then, by combining the identified abnormal data dimensions, the server can derive the localization results, thereby improving the efficiency of troubleshooting.

[0135] The above describes one or more embodiments of the anomaly localization method provided in this specification. Based on the same idea, this specification also provides corresponding anomaly localization devices, such as... Figure 6 As shown.

[0136] Figure 6 A schematic diagram of an anomaly location device provided in this specification includes:

[0137] The acquisition module 601 is used to acquire data associated with the abnormal event when an abnormal event is detected in the target object, as each associated data;

[0138] The determining module 602 is used to, for each data dimension involved in the associated data, obtain the data sequence corresponding to the data dimension based on the data under the data dimension contained in the associated data, filter out abnormal data in the data sequence corresponding to the data dimension, and determine whether the data dimension is an abnormal data dimension based on the abnormal data.

[0139] The positioning module 603 is used to locate the specific anomaly generated by the target object based on the determined abnormal data dimension.

[0140] Optionally, the determining module 602 is specifically used to smooth the data sequence corresponding to the data dimension using a preset smoothing algorithm to obtain the baseline sequence corresponding to the data dimension; and to filter out abnormal data in the data sequence corresponding to the data dimension based on the baseline sequence.

[0141] Optionally, the determining module 602 is specifically used to obtain the filtered data sequence corresponding to the data dimension through a preset filter, and determine the distribution parameters of the filtered data sequence; and optimize the data sequence corresponding to the data dimension according to the distribution parameters and a preset smoothing optimization algorithm to obtain the baseline sequence corresponding to the data dimension.

[0142] Optionally, the determining module 602 is specifically used to construct a confidence interval in the filtered data sequence according to a preset quantile; and to determine the distribution parameters of the filtered data sequence based on the data in the confidence interval.

[0143] Optionally, the determining module 602 is specifically used to: determine the residual sequence between the data sequence corresponding to the data dimension and the baseline sequence; for each data in the residual sequence, determine whether the data exceeds a preset threshold; if so, determine that the data corresponding to the data in the data sequence is abnormal data existing in the data sequence.

[0144] Optionally, the determining module 602 is specifically used to: determine the confidence level of the data sequence corresponding to the data dimension based on the abnormal data; and determine whether the data dimension is an abnormal data dimension based on the confidence level of the data sequence corresponding to the data dimension.

[0145] Optionally, the determining module 602 is specifically used to determine the confidence level of the data sequence corresponding to the data dimension as an abnormal data sequence based on the difference between the time corresponding to the abnormal data determined based on the timestamp of the abnormal data and the time when the abnormal event was detected.

[0146] Optionally, the determining module 602 is specifically used to determine the confidence level of a data sequence corresponding to a data dimension as an anomalous data sequence based on the proportion of the number of anomalous data contained in the data sequence corresponding to the data dimension among all anomalous data contained in the data sequence corresponding to each data dimension.

[0147] Optionally, the determining module 602 determines the confidence level of the data sequence corresponding to the data dimension as an abnormal data sequence based on the similarity between the function graph composed of the data in the data sequence corresponding to the data dimension and the function graph composed of the associated data.

[0148] Optionally, the acquisition module 601 is specifically used to acquire each original associated data and the dependent data that have a dependency relationship with each original associated data; and to supplement the dependent data of each original associated data into each original associated data to obtain each associated data.

[0149] This specification also provides a computer-readable storage medium storing a computer program that can be used to execute the above-described... Figure 1 This provides a method for anomaly localization.

[0150] This instruction manual also provides Figure 7 The one shown corresponds to Figure 1 A schematic diagram of the structure of an electronic device. (e.g.) Figure 7At the hardware level, this electronic device includes a processor, internal bus, network interface, memory, and non-volatile memory, and may also include other hardware required for business operations. The processor reads the corresponding computer program from the non-volatile memory into memory and then executes it to achieve the above. Figure 1 The method for anomaly localization. Of course, in addition to software implementation, this specification does not exclude other implementation methods, such as logic devices or a combination of hardware and software, etc. In other words, the execution subject of the following processing flow is not limited to individual logic units, but can also be hardware or logic devices.

[0151] In the 1990s, improvements to a technology could be clearly distinguished as either hardware improvements (e.g., improvements to the circuit structure of diodes, transistors, switches, etc.) or software improvements (improvements to the methodology). However, with technological advancements, many methodological improvements today can be considered direct improvements to the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved methodology into the hardware circuit. Therefore, it cannot be said that a methodological improvement cannot be implemented using hardware physical modules. For example, a Programmable Logic Device (PLD) (such as a Field Programmable Gate Array (FPGA)) is such an integrated circuit whose logic function is determined by the user programming the device. Designers can program and "integrate" a digital system onto a PLD themselves, without needing chip manufacturers to design and manufacture dedicated integrated circuit chips. Furthermore, nowadays, instead of manually manufacturing integrated circuit chips, this programming is mostly implemented using "logic compiler" software. Similar to the software compiler used in program development, the original code before compilation must be written in a specific programming language, called a Hardware Description Language (HDL). There are many HDLs, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, and RHDL (Ruby Hardware Description Language). Currently, the most commonly used are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should understand that by simply performing some logic programming on the method flow using one of these hardware description languages ​​and programming it into an integrated circuit, the hardware circuit implementing the logical method flow can be easily obtained.

[0152] The controller can be implemented in any suitable manner. For example, it can take the form of a microprocessor or processor and a computer-readable medium storing computer-readable program code (e.g., software or firmware) executable by the (micro)processor, logic gates, switches, application-specific integrated circuits (ASICs), programmable logic controllers, and embedded microcontrollers. Examples of controllers include, but are not limited to, the following microcontrollers: ARC625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicon Labs C8051F320. A memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art will also recognize that, in addition to implementing the controller in purely computer-readable program code form, the same functionality can be achieved by logically programming the method steps to make the controller take the form of logic gates, switches, ASICs, programmable logic controllers, and embedded microcontrollers. Therefore, such a controller can be considered a hardware component, and the means included therein for implementing various functions can also be considered as structures within the hardware component. Alternatively, the means for implementing various functions can be considered as both software modules implementing the method and structures within the hardware component.

[0153] The systems, devices, modules, or units described in the above embodiments can be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, a computer can be, for example, a personal computer, laptop computer, cellular phone, camera phone, smartphone, personal digital assistant, media player, navigation device, email device, game console, tablet computer, wearable device, or any combination of these devices.

[0154] For ease of description, the above devices are described in terms of function, divided into various units. Of course, in implementing this specification, the functions of each unit can be implemented in one or more software and / or hardware components.

[0155] Those skilled in the art will understand that embodiments of this specification can be provided as methods, systems, or computer program products. Therefore, this specification may take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this specification may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0156] This specification is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this specification. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create a machine for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0157] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0158] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0159] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0160] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0161] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0162] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0163] Those skilled in the art will understand that the embodiments of this specification can be provided as methods, systems, or computer program products. Therefore, this specification may take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this specification may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0164] This specification can be described in the general context of computer-executable instructions that are executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform a specific task or implement a specific abstract data type. This specification can also be practiced in distributed computing environments, where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0165] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to interchangeably. Each embodiment focuses on describing the differences from other embodiments. In particular, the system embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments.

[0166] The above are merely embodiments of this specification and are not intended to limit this specification. Various modifications and variations can be made to this specification by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this specification should be included within the scope of the claims of this specification.

Claims

1. A method for anomaly localization, comprising: When an abnormal event is detected in the target object, data associated with the abnormal event is acquired as the associated data. For each data dimension involved in the associated data, based on the data under that data dimension contained in the associated data, a data sequence corresponding to that data dimension is obtained. Abnormal data in the data sequence corresponding to that data dimension is then filtered out, and the confidence level of the data sequence corresponding to that data dimension is determined based on the abnormal data. Based on the confidence level of the data sequence corresponding to that data dimension, it is determined whether that data dimension is an abnormal data dimension. The lower the confidence level of the data sequence corresponding to that data dimension, the greater the likelihood that the data sequence corresponding to that data dimension is the cause of the abnormal health index corresponding to the detected abnormal event. Based on the identified abnormal data dimensions, locate the specific abnormality generated by the target object.

2. The method as described in claim 1, specifically including: filtering out abnormal data in the data sequence corresponding to the data dimension, comprising: The data sequence corresponding to this data dimension is smoothed using a preset smoothing algorithm to obtain the baseline sequence corresponding to this data dimension. Based on the baseline sequence, abnormal data in the data sequence corresponding to this data dimension are filtered out.

3. The method as described in claim 2, wherein a baseline sequence of the data sequence corresponding to the data dimension is obtained by smoothing the data sequence corresponding to the data dimension using a preset smoothing algorithm, specifically including: By using a preset filter, the filtered data sequence corresponding to the data dimension is obtained, and the distribution parameters of the filtered data sequence are determined. Based on the distribution parameters and the preset smoothing optimization algorithm, the data sequence corresponding to the data dimension is optimized to obtain the baseline sequence corresponding to the data dimension.

4. The method as described in claim 3, wherein determining the distribution parameters of the filtered data sequence specifically includes: Confidence intervals are constructed in the filtered data sequence based on the preset quantiles; Based on the data in the confidence interval, determine the distribution parameters of the filtered data sequence.

5. The method as described in claim 2, wherein abnormal data is filtered out from the data sequence corresponding to the data dimension based on the baseline sequence, specifically including: Determine the residual sequence between the data sequence corresponding to this data dimension and the baseline sequence; For each data point in the residual sequence, determine whether the data point exceeds a preset threshold; If so, then the data corresponding to that data in the data sequence is determined to be abnormal data existing in the data sequence.

6. The method as described in claim 1, wherein determining the confidence level of the data sequence corresponding to the data dimension based on the abnormal data specifically includes: The confidence level of the data sequence corresponding to the abnormal data dimension as an abnormal data sequence is determined based on the difference between the time corresponding to the abnormal data determined by the timestamp of the abnormal data and the time when the abnormal event was detected.

7. The method as described in claim 1, wherein determining the confidence level of the data sequence corresponding to the data dimension based on the abnormal data specifically includes: The confidence level of a data sequence corresponding to a data dimension as an anomalous data sequence is determined based on the number of anomalous data contained in the data sequence corresponding to that data dimension and its proportion among all anomalous data contained in the data sequences corresponding to each data dimension.

8. The method as described in claim 1, wherein determining the confidence level of the data sequence corresponding to the data dimension based on the abnormal data specifically includes: Based on the similarity between the function graph formed by the data in the data sequence corresponding to the data dimension and the function graph formed by the associated data, the confidence level of the data sequence corresponding to the data dimension as an abnormal data sequence is determined.

9. The method as described in claim 1, specifically including: obtaining each associated data, comprising: Obtain each original associated data, as well as the dependent data that have a dependency relationship with each original associated data; The dependent data of each original associated data is added to each original associated data to obtain each associated data.

10. An apparatus for anomaly localization, comprising: The acquisition module is used to acquire data associated with the abnormal event when an abnormal event is detected in the target object, as the associated data. The determination module is used to, for each data dimension involved in the associated data, obtain the data sequence corresponding to the data dimension based on the data under that data dimension contained in the associated data, filter out abnormal data in the data sequence corresponding to the data dimension, and determine the confidence level of the data sequence corresponding to the data dimension based on the abnormal data; and determine whether the data dimension is an abnormal data dimension based on the confidence level of the data sequence corresponding to the data dimension. If the confidence level of the data sequence corresponding to the data dimension is lower, the greater the possibility that the data sequence corresponding to the data dimension is the cause of the abnormal health index corresponding to the detected abnormal event. The location module is used to locate the specific anomaly generated by the target object based on the determined abnormal data dimensions.

11. A computer-readable storage medium storing a computer program that, when executed by a processor, implements the method described in any one of claims 1 to 9.

12. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the method described in any one of claims 1 to 9.

Images