Clock deviation adjustment method and device, electronic equipment and storage medium

Abstract

Embodiments of the present application provide a clock deviation adjustment method and device, electronic equipment and storage medium, the method comprises: obtaining a tracking link corresponding to a user behavior event; if an abnormal event is detected in a data processing event, obtaining an event characteristic value corresponding to the abnormal event, a first probability value of the event characteristic value existing in the abnormal event in the data processing event, and a second probability value of the event characteristic value existing in a normal event in the data processing event; determining whether the data processing event appears Span index abnormality according to the event characteristic value, the first probability value and the second probability value, if the result of the determination is that the data processing event appears Span index abnormality, obtaining a request duration and a response duration corresponding to the data processing event, and adjusting the response duration to a time period corresponding to the request duration to complete the timestamp adjustment of the data processing event according to the request duration and the response duration.

Description

Technical Field

[0001] This invention relates to the field of Internet technology, and in particular to a method for adjusting clock skew, a device for adjusting clock skew, an electronic device, and a computer-readable storage medium. Background Technology

[0002] In recent years, with the rise of big data, research on consumer behavior analysis has flourished. Scholars from many fields, including databases and data mining, information systems and information management, image processing and computer vision, social network analysis, and e-commerce, have joined the ranks of consumer behavior researchers. Simultaneously, this research field has also attracted significant attention from enterprises operating in the digital economy, such as e-commerce and social networks. Consumer behavior analysis is considered one of the effective means for enterprises to understand their consumers and conduct marketing activities in the digital economy. However, in the process of tracking user behavior or events, the timestamps corresponding to these behaviors or events often become offset, reducing the accuracy of the data and making it difficult to effectively analyze user behavior or events in subsequent data analysis. Summary of the Invention

[0003] The present invention provides a method, apparatus, electronic device, and computer-readable storage medium for adjusting clock skew, in order to solve or partially solve the problem of low accuracy in data analysis caused by clock skew.

[0004] This invention discloses a method for adjusting clock skew, comprising:

[0005] Obtain the tracking link corresponding to the user behavior event. The tracking link corresponds to a tracking identifier. The tracking link consists of several Span nodes. Each Span node corresponds to a span identifier. The Span node includes a first Span node located on the client and a second Span node located on the server. The first Span node and the second Span node constitute a data processing event.

[0006] If an abnormal event is detected in the data processing event, then the event feature value corresponding to the abnormal event, the first probability value of the abnormal event having the event feature value in the data processing event, and the second probability value of the normal event having the event feature value in the data processing event are obtained.

[0007] Based on the event feature value, the first probability value, and the second probability value, it is determined whether the data processing event has an abnormal Span indicator. If the determination result is that the data processing event has an abnormal Span indicator, the request duration and response duration corresponding to the data processing event are obtained. The request duration is the time when the first Span node initiates a request to the second Span node, and the response duration is the time when the second Span node responds to the request initiated by the first Span node.

[0008] The response duration is adjusted to fall within the time period corresponding to the request duration based on the request duration, thereby completing the adjustment of the timestamp of the data processing event.

[0009] Optionally, the step of determining whether the data processing event exhibits an abnormal Span metric based on the event feature value, the first probability value, and the second probability value, and if the determination result indicates that the data processing event exhibits an abnormal Span metric, then obtaining the request duration and response duration corresponding to the data processing event includes:

[0010] Obtain the first proportion of the abnormal event in the tracking link and the second proportion of the normal event in the tracking link;

[0011] The probability of an anomaly occurring in the data processing event is calculated using the event feature value, the first weight, and the first probability value.

[0012] Using the event feature value, the second weight, and the second probability value, calculate the normal probability that the data processing event did not occur abnormally;

[0013] If the abnormal probability is greater than the normal probability, it is determined that the data processing event has an abnormal Span index, and the request duration and response duration corresponding to the data processing event are obtained.

[0014] Optionally, it also includes:

[0015] If the abnormal probability is less than the normal probability, it is determined that the data processing event does not show any abnormality in the Span index, and the processing flow ends.

[0016] Optionally, adjusting the response duration to fall within the time period corresponding to the request duration based on the request duration and the response duration to complete the adjustment of the timestamp of the data processing event includes:

[0017] The difference between the request duration and the response duration is obtained, and the average of the difference is taken to obtain the offset value relative to the response duration.

[0018] The offset value is used to adjust the response duration to the time period corresponding to the request duration in order to complete the adjustment of the timestamp of the data processing event.

[0019] This invention also discloses a clock offset adjustment device, comprising:

[0020] The tracking link acquisition module is used to acquire the tracking link corresponding to the user behavior event. The tracking link corresponds to a tracking identifier. The tracking link is composed of several Span nodes. Each Span node corresponds to a span identifier. The Span node includes a first Span node located on the client and a second Span node located on the server. The first Span node and the second Span node constitute a data processing event.

[0021] The data acquisition module is used to acquire, if an abnormal event is detected in the data processing event, an event feature value corresponding to the abnormal event, a first probability value of the presence of the event feature value in the abnormal event in the data processing event, and a second probability value of the presence of the event feature value in the normal event in the data processing event.

[0022] The detection module is used to determine whether the data processing event has an abnormal Span index based on the event feature value, the first probability value and the second probability value. If the determination result is that the data processing event has an abnormal Span index, the module obtains the request duration and response duration corresponding to the data processing event. The request duration is the time when the first Span node initiates a request to the second Span node, and the response duration is the time when the second Span node responds to the request initiated by the first Span node.

[0023] The adjustment module is used to adjust the response duration to fall within the time period corresponding to the request duration based on the request duration and the response duration, so as to complete the adjustment of the timestamp of the data processing event.

[0024] Optionally, the detection module is specifically used for:

[0025] Obtain the first proportion of the abnormal event in the tracking link and the second proportion of the normal event in the tracking link;

[0026] The probability of an anomaly occurring in the data processing event is calculated using the event feature value, the first weight, and the first probability value.

[0027] Using the event feature value, the second weight, and the second probability value, calculate the normal probability that the data processing event did not occur abnormally;

[0028] If the abnormal probability is greater than the normal probability, it is determined that the data processing event has an abnormal Span index, and the request duration and response duration corresponding to the data processing event are obtained.

[0029] Optionally, it also includes:

[0030] The judgment module is used to determine that the data processing event does not have an abnormal Span index if the abnormal probability is less than the normal probability, and then end the processing flow.

[0031] Optionally, the adjustment module is specifically used for:

[0032] The difference between the request duration and the response duration is obtained, and the average of the difference is taken to obtain the offset value relative to the response duration.

[0033] The offset value is used to adjust the response duration to the time period corresponding to the request duration in order to complete the adjustment of the timestamp of the data processing event.

[0034] This invention also discloses an electronic device, including a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus;

[0035] The memory is used to store computer programs;

[0036] When the processor executes a program stored in the memory, it implements the method described in the embodiments of the present invention.

[0037] This invention also discloses a computer-readable storage medium storing instructions that, when executed by one or more processors, cause the processors to perform the methods described in this invention.

[0038] The embodiments of the present invention have the following advantages:

[0039] In this embodiment of the invention, by acquiring the tracking link corresponding to the user behavior event, the tracking link corresponds to a tracking identifier and consists of several Span nodes. Each Span node corresponds to a span identifier. The Span node includes a first Span node located on the client and a second Span node located on the server. The first Span node and the second Span node constitute a data processing event. If an abnormal event is detected in the data processing event, the event feature value corresponding to the abnormal event, the first probability value of the abnormal event having the event feature value, and the second probability value of the normal event having the event feature value are acquired. Then, it can be determined whether the data processing event has an abnormal Span index based on the event feature value, the first probability value, and the second probability value. If the determination result is that the data processing event has an abnormal Span index, the Span index is determined. If an indicator is abnormal, the request duration and response duration corresponding to the data processing event are obtained. The request duration is the time when the client initiates a request to the server, and the response duration is the time when the server responds to the client's request. Then, based on the request duration and response duration, the response duration is adjusted to fall within the time period corresponding to the request duration to complete the adjustment of the timestamp of the data processing event. Thus, in the process of analyzing user behavior events, a corresponding distributed tracing link is built, and the status of the tracing link is monitored to ensure that the distributed tracing link can operate normally. At the same time, by adjusting the time corresponding to the abnormal event between the server and the client, the server and the client can maintain relative time synchronization, ensuring clock synchronization and the accuracy of data in subsequent data analysis. Attached Figure Description

[0040] Figure 1 This is a flowchart illustrating the steps of a clock offset adjustment method provided in an embodiment of the present invention;

[0041] Figure 2 This is a schematic diagram of the tracking link provided in an embodiment of the present invention;

[0042] Figure 3 This is a schematic diagram of clock adjustment provided in an embodiment of the present invention;

[0043] Figure 4 This is a structural block diagram of a clock deviation adjustment device provided in an embodiment of the present invention;

[0044] Figure 5 This is a block diagram of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0045] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0046] As an example, in recent years, with the rise of big data, research on consumer behavior analysis has flourished. Scholars from many fields, including databases and data mining, information systems and information management, image processing and computer vision, social network analysis, and e-commerce, have joined the ranks of consumer behavior researchers. Simultaneously, this research field has also attracted significant attention from enterprises operating in the digital economy, such as e-commerce and social networks. Consumer behavior analysis is considered one of the effective means for enterprises to understand their consumers and conduct marketing activities in the digital economy. However, in the process of tracking user behavior or events, the timestamps corresponding to these behaviors or events often become offset, reducing the accuracy of the data and making it difficult to effectively analyze user behavior or events in subsequent data analysis.

[0047] One of the core inventive points of this invention lies in acquiring the tracking link corresponding to a user behavior event. Each tracking link corresponds to a tracking identifier and consists of several Span nodes, each corresponding to a span identifier. The Span nodes include a first Span node located on the client side and a second Span node located on the server side. The first and second Span nodes constitute a data processing event. If an abnormal event is detected in the data processing event, the event feature value corresponding to the abnormal event, a first probability value indicating the presence of the event feature value in the abnormal event, and a second probability value indicating the presence of the event feature value in the normal event are acquired. Then, based on the event feature value, the first probability value, and the second probability value, it can be determined whether the data processing event exhibits an abnormal Span indicator. If the determination result is that the data processing event... If an anomaly occurs in the Span metric, the request duration and response duration corresponding to the data processing event are obtained. The request duration is the time when the client initiates a request to the server, and the response duration is the time when the server responds to the client's request. Then, based on the request duration and response duration, the response duration is adjusted to fall within the time period corresponding to the request duration to complete the adjustment of the timestamp of the data processing event. Thus, during the analysis of user behavior events, a corresponding distributed tracing link is constructed, and the status of the tracing link is monitored to ensure that the distributed tracing link can operate normally. At the same time, by adjusting the time corresponding to the abnormal events between the server and the client, the server and the client can maintain relative time synchronization, ensuring clock synchronization and the accuracy of data in subsequent data analysis.

[0048] Reference Figure 1 The diagram illustrates a flowchart of a clock offset adjustment method provided in an embodiment of the present invention, which may specifically include the following steps:

[0049] Step 101: Obtain the tracking link corresponding to the user behavior event. The tracking link corresponds to a tracking identifier. The tracking link consists of several Span nodes. Each Span node corresponds to a span identifier. The Span node includes a first Span node located on the client and a second Span node located on the server. The first Span node and the second Span node constitute a data processing event.

[0050] In this embodiment of the invention, user behavior events can be events corresponding to user behavior, such as events generated by the user using a terminal or application. By analyzing these events, user preferences can be obtained, so as to provide users with more targeted and personalized services.

[0051] It should be noted that the collection of user data can be carried out in accordance with relevant laws, with clear notification to the user and with the user's authorization, in order to ensure the security of user data.

[0052] In a specific implementation, a user behavior event can include requests and responses. A "request" can be a user performing a corresponding operation on the client. The client then generates corresponding request information based on the user's operation and sends the request information to the server to obtain the corresponding service. The server can respond to the request information and return corresponding response information or resources. By processing the request and response processes corresponding to the user behavior event, the corresponding distributed tracing chain can be obtained. Then, the distributed tracing chain is analyzed to ensure its stability.

[0053] Specifically, distributed tracing involves two important concepts: trace and span. The trace represents the entire chain view of a request within the distributed system, while the span represents the internal view of different services within that chain. The combined span views constitute the overall trace view. Furthermore, throughout the request's call chain, the request continuously carries the traceid (clock skew adjustment) downstream to services. Each service also generates its own spanid (clock skew adjustment) to create its internal call view, which is then passed downstream along with the traceid. The traceid remains constant throughout the entire call chain, allowing you to query all logs recorded during the entire request period using the traceid.

[0054] Upon reaching each service, a spanid is generated for the request. The clock skew adjustment from the upstream service, transmitted along with the request, is recorded as the parent-spanid or the pspanid. When the current service's generated spanid is transmitted to downstream services along with the request, this spanid adjustment is recorded as the pspanid. Optionally, by recording the traceid, spanid, and pspanid clock skew adjustments in the access logs and business logs, a complete view of the entire request's call chain can be reconstructed, greatly aiding in error troubleshooting.

[0055] In one example, refer to Figure 2 This diagram illustrates a tracing link provided in an embodiment of the present invention. The client can send corresponding request information to the server through a microservice gateway (Gataway). The Gataway can include a RESTflu API (Representational State Transfer, business interface) and an RPC (Remote Procedure Call). The former can be used to initiate corresponding business requests to the server, and the latter can be used for authentication. Specifically, the server can include a Resource and an Auth Service (authentication). The former can return corresponding resources or data based on requests sent via the RESTflu API, and the latter can verify the client's identity to ensure the security of data transmission. In the above process, the traceid corresponding to the request trace for the entire event can be A. For the client, the pspanid corresponding to its Span node (i.e., the node composed of client and Gataway) can be 0, Span can be 1, and traceid can be A. For the two nodes on the server side, Resource and Auth Service, the pspanid corresponding to Resource can be 1, Span can be 2, and traceid can be A, and the pspanid corresponding to Auth Service can be 1, Span can be 3, and traceid can be A. Thus, the above process can construct a corresponding distributed tracing link, so that by analyzing the distributed tracing link, errors involved in the user behavior event can be investigated.

[0056] It should be noted that, as Figure 2As shown, the client and Gataway can form a first Span node, and the Resource and Auth Service can be the second Span nodes corresponding to the server. The first Span node and the Resource node can form a business request event, and the first Span node and the Auth Service node can form an authentication event. The two can form corresponding user behavior events, that is, when the user performs corresponding operations on the client, after authentication based on the user operation, the server can return the corresponding resources or data. This invention does not impose any restrictions on this.

[0057] Step 102: If an abnormal event is detected in the data processing event, then obtain the event feature value corresponding to the abnormal event, the first probability value of the abnormal event having the event feature value in the data processing event, and the second probability value of the normal event having the event feature value in the data processing event.

[0058] In practical implementation, data processing events involved in user behavior events can be detected to determine whether there are any abnormal events, such as whether there are span interruptions, request delays, or response delays during the data request process. If a corresponding abnormal event is detected in the data processing event, the event feature value corresponding to the abnormal event can be obtained. Different abnormal events can correspond to different event feature values. For example, a span interruption can correspond to event feature value ①, a request delay can correspond to event feature value ②, and a response delay can correspond to event feature value ③, etc. Different abnormal events can be identified through event feature values, and event feature values ​​can also facilitate subsequent error analysis of the tracing chain.

[0059] Specifically, after detecting an abnormal event in a data processing event, the system can obtain the corresponding event feature value, as well as the first probability value of the abnormal event having the event feature value and the second probability value of the normal event having the event feature value. Notably, abnormal events do not necessarily have corresponding event feature values; some anomalies may not affect the tracking link. Conversely, normal events can be events where no anomalies occur.

[0060] Step 103: Determine whether the data processing event has an abnormal Span index based on the event feature value, the first probability value, and the second probability value. If the determination result is that the data processing event has an abnormal Span index, then obtain the request duration and response duration corresponding to the data processing event. The request duration is the time when the first Span node initiates a request to the second Span node, and the response duration is the time when the second Span node responds to the request initiated by the first Span node.

[0061] In this embodiment of the invention, after obtaining the corresponding event feature value, first probability value, and second probability value, it is possible to determine whether the data processing event exhibits an abnormal Span indicator, such as clock asynchrony. If the determination result indicates that the data processing event exhibits an abnormal Span indicator, the request duration and response duration corresponding to the data processing event can be obtained to adjust the clock based on these two values. The request duration is the time it takes for the first Span node to initiate a request to the second Span node, and the response duration is the time it takes for the second Span node to respond to the request initiated by the first Span node.

[0062] In practical implementation, the following can be used: first proportion of abnormal events in the tracing chain and second proportion of normal events in the tracing chain. Then, using event feature values, first proportions, and first probability values, the abnormal probability of the data processing event occurring abnormally is calculated. Similarly, using event feature values, second proportions, and second probability values, the normal probability of the data processing event not occurring abnormally is calculated. If the abnormal probability is greater than the normal probability, the data processing event is determined to have an abnormal Span indicator, and the request duration and response duration corresponding to the data processing event are obtained. If the abnormal probability is less than the normal probability, the data processing event is determined not to have an abnormal Span indicator, and the processing flow ends.

[0063] In one example, for a data processing event, there are only two corresponding states: anomaly R1 and normal R2. The extracted monitoring indicator feature values ​​are represented as T = {t1, t2, ..., t...} i According to the conditional probability formula, under the condition that the eigenvalue T is satisfied, the probability that the suspected anomaly is classified as R1 is:

[0064]

[0065] Where P(T|R1) represents the probability of feature value T appearing in the abnormal subset of the sample set, P(R1) represents the proportion of the abnormal subset in the entire sample set, and P(T) can be the event feature value.

[0066] Similarly, the probability of a suspected anomaly being classified as R2 given the presence of eigenvalue T is expressed as follows:

[0067]

[0068] Where P(T|R2) represents the probability of the feature value T appearing in the normal subset of the sample set, P(R2) represents the proportion of the normal subset in the entire sample set, and P(T) can be the feature value of the event.

[0069] In the above process, each eigenvalue t iSince the events are independent of each other, the probabilities of the suspected anomalies being classified as R1 and R2 are calculated based on the probabilities of the relatively independent events. The two probabilities are then compared. If P(R1|T) > P(R2|T), the Span index of the monitored data processing event is considered abnormal, and the corresponding request duration and response duration can be obtained for clock adjustment. Otherwise, the Span index of the data processing event is normal, and no further processing is required.

[0070] It should be noted that in the above example, the sample set can be all data processing events involved in user behavior events, the abnormal subset can be abnormal events in data processing events, and the normal subset can be normal events in data processing events. This invention does not impose any limitations on this.

[0071] Step 104: Adjust the response duration to fall within the time period corresponding to the request duration based on the request duration and the response duration to complete the adjustment of the timestamp of the data processing event.

[0072] In this embodiment of the invention, after obtaining the corresponding request duration and response duration through the above process, the response duration can be adjusted based on both. By adjusting the response duration to the time period corresponding to the request duration, the timestamp of the data processing event is adjusted. Thus, during the analysis of user behavior events, a corresponding distributed tracing link is constructed, and the status of the tracing link is detected to ensure that the distributed tracing link can operate normally. At the same time, by adjusting the time corresponding to the occurrence of abnormal events between the server and the client, the server and the client can maintain relatively synchronized time, ensuring clock synchronization and thus ensuring the accuracy of the data during subsequent data analysis.

[0073] In practice, the difference between the request duration and the response duration can be obtained, and the difference can be averaged to obtain the offset value for the response duration. Then, the offset value can be used to adjust the response duration to the time period corresponding to the request duration to complete the adjustment of the timestamp of the data processing event.

[0074] In one example, the timestamps of all events from the server process can be adjusted by shifting the timestamps to the left until their start and end events fall within the larger time range of the client span. After this adjustment, we obtain two variables, δ1 and δ2, which remain unknown to us. If no further client-server interaction occurs in a given trace, and there is no other causal information, we can make arbitrary decisions to set the variables, for example, by precisely positioning the server span in the middle of the client span.

[0075]

[0076] Here, δ1 and δ2 provide us with an estimate of the time spent by RPC in network communication (assuming that the time taken for requests and responses to be transmitted over the network is roughly the same).

[0077] In other cases, we might have additional causal information from the tracing; for example, the server might have called the database, and then two other nodes in the tracing chain might have called the same database server. This gives us two sets of constraints regarding possible clock skew adjustments for the database span.

[0078] For example, we might want to adjust the first parent database span to -2.5ms and the second parent database span to -5.5ms. Since it's the same database server, we only need to adjust its clock skew once. We can try to find an adjustment that works for both calling nodes (perhaps -3.5ms), even if the child span isn't exactly centered on the parent span, as we did in the previous formula.

[0079] Reference Figure 3 This diagram illustrates the clock adjustment method provided in this embodiment of the invention. When the clocks of the client and server are out of sync as determined by the above-mentioned detection of the tracking link, the corresponding request duration and response duration can be obtained. Then, the corresponding adjustment value is calculated based on the above formula, and the response duration is adjusted to fall within the time period corresponding to the request duration to complete the clock adjustment and ensure the synchronization of the clocks between the client and server, thereby ensuring the accuracy of the data during subsequent data analysis.

[0080] In this embodiment of the invention, by acquiring the tracking link corresponding to the user behavior event, the tracking link corresponds to a tracking identifier and consists of several Span nodes. Each Span node corresponds to a span identifier. The Span node includes a first Span node located on the client and a second Span node located on the server. The first Span node and the second Span node constitute a data processing event. If an abnormal event is detected in the data processing event, the event feature value corresponding to the abnormal event, the first probability value of the abnormal event having the event feature value, and the second probability value of the normal event having the event feature value are acquired. Then, it can be determined whether the data processing event has an abnormal Span index based on the event feature value, the first probability value, and the second probability value. If the determination result is that the data processing event has an abnormal Span index, the Span index is determined. If an indicator is abnormal, the request duration and response duration corresponding to the data processing event are obtained. The request duration is the time when the client initiates a request to the server, and the response duration is the time when the server responds to the client's request. Then, based on the request duration and response duration, the response duration is adjusted to fall within the time period corresponding to the request duration to complete the adjustment of the timestamp of the data processing event. Thus, in the process of analyzing user behavior events, a corresponding distributed tracing link is built, and the status of the tracing link is monitored to ensure that the distributed tracing link can operate normally. At the same time, by adjusting the time corresponding to the abnormal event between the server and the client, the server and the client can maintain relative time synchronization, ensuring clock synchronization and the accuracy of data in subsequent data analysis.

[0081] It should be noted that, for the sake of simplicity, the method embodiments are all described as a series of actions. However, those skilled in the art should understand that the embodiments of the present invention are not limited to the described order of actions, because according to the embodiments of the present invention, some steps can be performed in other orders or simultaneously. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions involved are not necessarily essential to the embodiments of the present invention.

[0082] Reference Figure 4 The diagram illustrates a structural block diagram of a clock offset adjustment device provided in an embodiment of the present invention, which may specifically include the following modules:

[0083] The tracking link acquisition module 401 is used to acquire the tracking link corresponding to the user behavior event. The tracking link corresponds to a tracking identifier. The tracking link is composed of several Span nodes. Each Span node corresponds to a span identifier. The Span node includes a first Span node located on the client and a second Span node located on the server. The first Span node and the second Span node constitute a data processing event.

[0084] The data acquisition module 402 is used to acquire, if an abnormal event is detected in the data processing event, an event feature value corresponding to the abnormal event, a first probability value of the presence of the event feature value in the abnormal event in the data processing event, and a second probability value of the presence of the event feature value in the normal event in the data processing event.

[0085] The detection module 403 is used to determine whether the data processing event has an abnormal Span index based on the event feature value, the first probability value and the second probability value. If the determination result is that the data processing event has an abnormal Span index, the module obtains the request duration and response duration corresponding to the data processing event. The request duration is the time when the first Span node initiates a request to the second Span node, and the response duration is the time when the second Span node responds to the request initiated by the first Span node.

[0086] The adjustment module 404 is used to adjust the response duration to fall within the time period corresponding to the request duration based on the request duration and the response duration, so as to complete the adjustment of the timestamp of the data processing event.

[0087] In one alternative embodiment, the detection module 403 is specifically used for:

[0088] Obtain the first proportion of the abnormal event in the tracking link and the second proportion of the normal event in the tracking link;

[0089] The probability of an anomaly occurring in the data processing event is calculated using the event feature value, the first weight, and the first probability value.

[0090] Using the event feature value, the second weight, and the second probability value, calculate the normal probability that the data processing event did not occur abnormally;

[0091] If the abnormal probability is greater than the normal probability, it is determined that the data processing event has an abnormal Span index, and the request duration and response duration corresponding to the data processing event are obtained.

[0092] In one alternative embodiment, it further includes:

[0093] The judgment module is used to determine that the data processing event does not have an abnormal Span index if the abnormal probability is less than the normal probability, and then end the processing flow.

[0094] In one alternative embodiment, the adjustment module 404 is specifically used for:

[0095] The difference between the request duration and the response duration is obtained, and the average of the difference is taken to obtain the offset value relative to the response duration.

[0096] The offset value is used to adjust the response duration to the time period corresponding to the request duration in order to complete the adjustment of the timestamp of the data processing event.

[0097] As the device embodiment is basically similar to the method embodiment, the description is relatively simple, and relevant parts can be found in the description of the method embodiment.

[0098] In addition, this invention also provides an electronic device, including: a processor, a memory, and a computer program stored in the memory and executable on the processor. When the computer program is executed by the processor, it implements the various processes of the above-described clock offset adjustment method embodiments and achieves the same technical effect. To avoid repetition, it will not be described again here.

[0099] This invention also provides a computer-readable storage medium storing a computer program. When executed by a processor, the computer program implements the various processes of the clock offset adjustment method embodiments described above, achieving the same technical effect. To avoid repetition, it will not be described again here. The computer-readable storage medium may be a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, etc.

[0100] Figure 5 A schematic diagram of the hardware structure of an electronic device for implementing various embodiments of the present invention.

[0101] The electronic device 500 includes, but is not limited to, components such as: a radio frequency unit 501, a network module 502, an audio output unit 503, an input unit 504, a sensor 505, a display unit 506, a user input unit 507, an interface unit 508, a memory 509, a processor 510, and a power supply 511. Those skilled in the art will understand that the electronic device structure involved in the embodiments of the present invention does not constitute a limitation on the electronic device. An electronic device may include more or fewer components than illustrated, or combine certain components, or have different component arrangements. In the embodiments of the present invention, the electronic device includes, but is not limited to, mobile phones, tablet computers, laptops, PDAs, in-vehicle terminals, wearable devices, and pedometers.

[0102] It should be understood that, in this embodiment of the invention, the radio frequency unit 501 can be used for receiving and transmitting signals during information transmission or calls. Specifically, it receives downlink data from the base station and processes it with the processor 510; additionally, it transmits uplink data to the base station. Typically, the radio frequency unit 501 includes, but is not limited to, an antenna, at least one amplifier, a transceiver, a coupler, a low-noise amplifier, a duplexer, etc. Furthermore, the radio frequency unit 501 can also communicate with networks and other devices through a wireless communication system.

[0103] The electronic device provides users with wireless broadband internet access through the network module 502, such as helping users send and receive emails, browse web pages, and access streaming media.

[0104] The audio output unit 503 can convert audio data received by the radio frequency unit 501 or the network module 502 or stored in the memory 509 into audio signals and output them as sound. Furthermore, the audio output unit 503 can also provide audio output related to specific functions performed by the electronic device 500 (e.g., call signal reception sound, message reception sound, etc.). The audio output unit 503 includes a speaker, a buzzer, and a receiver, etc.

[0105] Input unit 504 is used to receive audio or video signals. Input unit 504 may include a graphics processing unit (GPU) 5041 and a microphone 5042. The GPU 5041 processes image data of still images or videos acquired by an image capture device (such as a camera) in video capture mode or image capture mode. The processed image frames can be displayed on display unit 506. The image frames processed by GPU 5041 can be stored in memory 509 (or other storage medium) or transmitted via radio frequency unit 501 or network module 502. Microphone 5042 can receive sound and process such sound into audio data. The processed audio data can be converted into a format that can be transmitted to a mobile communication base station via radio frequency unit 501 in telephone call mode.

[0106] The electronic device 500 also includes at least one sensor 505, such as a light sensor, a motion sensor, and other sensors. Specifically, the light sensor includes an ambient light sensor and a proximity sensor. The ambient light sensor can adjust the brightness of the display panel 5061 according to the ambient light level, and the proximity sensor can turn off the display panel 5061 and / or backlight when the electronic device 500 is moved to the ear. As a type of motion sensor, an accelerometer sensor can detect the magnitude of acceleration in various directions (generally three axes). When stationary, it can detect the magnitude and direction of gravity and can be used to identify the posture of the electronic device (such as landscape / portrait switching, related games, magnetometer posture calibration), vibration recognition related functions (such as pedometer, tapping), etc. The sensor 505 may also include a fingerprint sensor, pressure sensor, iris sensor, molecular sensor, gyroscope, barometer, hygrometer, thermometer, infrared sensor, etc., which will not be described in detail here.

[0107] The display unit 506 is used to display information input by the user or information provided to the user. The display unit 506 may include a display panel 5061, which may be configured in the form of a liquid crystal display (LCD), an organic light-emitting diode (OLED), or the like.

[0108] User input unit 507 can be used to receive input numerical or character information, and to generate key signal inputs related to user settings and function control of electronic devices. Specifically, user input unit 507 includes a touch panel 5071 and other input devices 5072. Touch panel 5071, also known as a touch screen, can collect touch operations performed by the user on or near it (such as operations performed by the user using a finger, stylus, or any suitable object or accessory on or near touch panel 5071). Touch panel 5071 may include two parts: a touch detection device and a touch controller. The touch detection device detects the user's touch position and the signal generated by the touch operation, and transmits the signal to the touch controller; the touch controller receives touch information from the touch detection device, converts it into touch point coordinates, and sends it to the processor 510, which receives and executes commands from the processor 510. In addition, touch panel 5071 can be implemented using various types such as resistive, capacitive, infrared, and surface acoustic wave. Besides touch panel 5071, user input unit 507 may also include other input devices 5072. Specifically, other input devices 5072 may include, but are not limited to, physical keyboards, function keys (such as volume control buttons, power buttons, etc.), trackballs, mice, joysticks, etc., which will not be described in detail here.

[0109] Furthermore, the touch panel 5071 can cover the display panel 5061. When the touch panel 5071 detects a touch operation on or near it, it transmits the information to the processor 510 to determine the type of touch event. Subsequently, the processor 510 provides corresponding visual output on the display panel 5061 according to the type of touch event. It is understood that in one embodiment, the touch panel 5071 and the display panel 5061 are implemented as two independent components to realize the input and output functions of the electronic device. However, in some embodiments, the touch panel 5071 and the display panel 5061 can be integrated to realize the input and output functions of the electronic device. The specific implementation is not limited here.

[0110] Interface unit 508 serves as an interface for connecting external devices to electronic device 500. For example, external devices may include a wired or wireless headphone port, an external power supply (or battery charger) port, a wired or wireless data port, a memory card port, a port for connecting a device with an identification module, an audio input / output (I / O) port, a video I / O port, a headphone port, and so on. Interface unit 508 can be used to receive input from external devices (e.g., data, power, etc.) and transmit the received input to one or more components within electronic device 500, or it can be used to transmit data between electronic device 500 and external devices.

[0111] The memory 509 can be used to store software programs and various data. The memory 509 may primarily include a program storage area and a data storage area. The program storage area may store the operating system, applications required for at least one function (such as sound playback, image playback, etc.), etc.; the data storage area may store data created based on the use of the mobile phone (such as audio data, phonebook, etc.). Furthermore, the memory 509 may include high-speed random access memory, and may also include non-volatile memory, such as at least one disk storage device, flash memory device, or other volatile solid-state storage device.

[0112] The processor 510 is the control center of the electronic device. It connects various parts of the electronic device via various interfaces and lines. By running or executing software programs and / or modules stored in the memory 509, and by calling data stored in the memory 509, it performs various functions and processes data, thereby providing overall monitoring of the electronic device. The processor 510 may include one or more processing units; preferably, the processor 510 may integrate an application processor and a modem processor. The application processor mainly handles the operating system, user interface, and applications, while the modem processor mainly handles wireless communication. It is understood that the modem processor may not be integrated into the processor 510.

[0113] The electronic device 500 may also include a power supply 511 (such as a battery) for supplying power to various components. Preferably, the power supply 511 can be logically connected to the processor 510 through a power management system, thereby enabling functions such as managing charging, discharging, and power consumption through the power management system.

[0114] In addition, the electronic device 500 includes some functional modules not shown, which will not be described in detail here.

[0115] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0116] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes several instructions to cause a terminal (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of the present invention.

[0117] The embodiments of the present invention have been described above with reference to the accompanying drawings. However, the present invention is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of the present invention without departing from the spirit and scope of the claims, and all of these forms are within the protection scope of the present invention.

[0118] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed in this invention can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0119] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0120] In the embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative. For instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0121] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0122] In addition, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0123] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, essentially, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, ROM, RAM, magnetic disks, or optical disks.

[0124] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A method of adjusting a clock skew, characterized by, The method comprises the following steps: obtaining a tracking link corresponding to a user behavior event, the tracking link corresponding to a tracking identifier, the tracking link being composed of a plurality of Span nodes, each Span node corresponding to a span identifier, the Span nodes including a first Span node located at a client and a second Span node located at a server, the first Span node and the second Span node forming a data processing event; if an abnormal event is detected in the data processing event, obtaining an event feature value corresponding to the abnormal event, a first probability value of the event feature value existing in the abnormal event in the data processing event, and a second probability value of the event feature value existing in a normal event in the data processing event; judging whether the data processing event has a Span index abnormality according to the event feature value, the first probability value, and the second probability value, if the judging result is that the data processing event has a Span index abnormality, obtaining a request duration and a response duration corresponding to the data processing event, the request duration being a time when the first Span node initiates a request to the second Span node, and the response duration being a time when the second Span node responds to the request initiated by the first Span node; adjusting the response duration to a time period corresponding to the request duration according to the request duration and the response duration to complete timestamp adjustment of the data processing event.

2. The method of claim 1, wherein, The method for judging whether the data processing event has a Span index abnormality according to the event feature value, the first probability value, and the second probability value, if the judging result is that the data processing event has a Span index abnormality, obtaining a request duration and a response duration corresponding to the data processing event, comprises the following steps: obtaining a first proportion of the abnormal event in the tracking link and a second proportion of the normal event in the tracking link; calculating an abnormal probability of the data processing event occurring abnormally by using the event feature value, the first proportion, and the first probability value; calculating a normal probability of the data processing event not occurring abnormally by using the event feature value, the second proportion, and the second probability value; if the abnormal probability is greater than the normal probability, determining that the data processing event has a Span index abnormality, and obtaining the request duration and the response duration corresponding to the data processing event.

3. The method of claim 2, wherein, The method further comprises the following steps: if the abnormal probability is less than the normal probability, determining that the data processing event does not have a Span index abnormality, and ending the processing flow.

4. The method of claim 1, wherein, The method for adjusting the response duration to the time period corresponding to the request duration according to the request duration and the response duration to complete timestamp adjustment of the data processing event comprises the following steps: obtaining a corresponding difference value by subtracting the response duration from the request duration, and obtaining an offset value for the response duration by averaging the difference value; adjusting the response duration to the time period corresponding to the request duration by using the offset value to complete timestamp adjustment of the data processing event.

5. A clock skew adjustment apparatus, characterized by comprising: The method comprises the following steps: The tracking link acquisition module is configured to acquire a tracking link corresponding to a user behavior event, the tracking link corresponding to a tracking identifier, the tracking link being composed of a plurality of Span nodes, each of the Span nodes corresponding to a span identifier, the Span nodes including a first Span node located at a client and a second Span node located at a server, the first Span node and the second Span node constituting a data processing event; The data acquisition module is configured to acquire, if it is detected that there is an abnormal event in the data processing event, an event feature value corresponding to the abnormal event, a first probability value of the event feature value existing in the abnormal event in the data processing event, and a second probability value of the event feature value existing in a normal event in the data processing event; The detection module is configured to determine whether the data processing event has a Span index abnormality according to the event feature value, the first probability value, and the second probability value, and acquire a request duration and a response duration corresponding to the data processing event if the determination result is that the data processing event has a Span index abnormality, the request duration being a time at which the first Span node initiates a request to the second Span node, and the response duration being a time at which the second Span node responds to the request initiated by the first Span node; The adjustment module is configured to adjust the response duration to a time period corresponding to the request duration according to the request duration and the response duration to complete adjustment of a timestamp of the data processing event.

6. The apparatus of claim 5, wherein, The detection module is specifically configured to: acquire a first proportion of the abnormal event in the tracking link and a second proportion of the normal event in the tracking link; calculate an abnormal probability of the data processing event occurring an abnormality by using the event feature value, the first proportion, and the first probability value; calculate a normal probability of the data processing event not occurring an abnormality by using the event feature value, the second proportion, and the second probability value; if the abnormal probability is greater than the normal probability, determine that the data processing event has a Span index abnormality, and acquire the request duration and the response duration corresponding to the data processing event.

7. The apparatus of claim 6, wherein, Further comprising: a determination module configured to determine that the data processing event does not have a Span index abnormality if the abnormal probability is less than the normal probability, and end the processing procedure.

8. The apparatus of claim 5, wherein, The adjustment module is specifically configured to: obtain a difference value by subtracting the response duration from the request duration, and obtain an offset value for the response duration by averaging the difference value; adjust the response duration to the time period corresponding to the request duration by using the offset value to complete adjustment of the timestamp of the data processing event.

9. An electronic device, comprising: The device comprises a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory complete communication with each other through the communication bus; The memory is configured to store a computer program. The processor is configured to implement the method of any one of claims 1-4 when executing the program stored in the memory.

10. A computer-readable storage medium having stored thereon instructions that, when executed by one or more processors, cause the processors to perform the method of any one of claims 1-4.

Images