A network service anomaly monitoring method, device and electronic equipment

Abstract

The embodiment of the present application provides a network service abnormality monitoring method, device and electronic equipment, the method comprises the following steps: obtaining the distribution proportion of the target value of the target variable from the obtained log data of the network service; according to the distribution proportion, the abnormal probability of the network service triggering the abnormal state is obtained through a preset corresponding relationship formula corresponding to the target value of the target variable; wherein, the corresponding relationship formula is obtained according to the corresponding relationship between each distribution proportion of the target value of the target variable in the historical log data of the network service and each service state of the network service. Through the embodiment of the present application, the accurate judgment of the abnormal state of the network service is realized, and a large amount of manpower and material resources are saved.

Description

Technical Field

[0001] This invention relates to the field of mobile communication technology, and in particular to a method, apparatus, and electronic device for monitoring network service anomalies. Background Technology

[0002] Current network monitoring technologies rely too heavily on the data support provided by the manufacturer's network management northbound interface. While this monitoring method has been used continuously from the Operation Support Subsystem (OSS) 1.0 to OSS 3.0, and with the continuous evolution of alarm compression and alarm correlation location functions in upper-layer applications, network fault monitoring efficiency has been significantly improved. However, with the evolution of operators' future 5G network infrastructure as a service (IaaS) layer from the traditional CT architecture to a cloud-based IT architecture, the monitoring mode will undergo significant changes. Cloud-based devices will no longer have built-in monitoring modules for physical devices in the original CT network. In the era of software-defined networking and virtualized network element technologies, there is a need to build log fault detection capabilities for Network Functions Virtualization (NFV). Furthermore, as the physical network evolves into a virtual network, log-based detection of network or service anomalies will become a necessary means.

[0003] Traditional log extraction relies on operations personnel using rules to label patterns in previously occurring abnormal logs in order to find more abnormal logs at runtime. The simplest method is keyword matching, such as "CRITICAL", "ERROR", "ORA-", and "SEVERE". This keyword-based monitoring method has two limitations: First, many words are ambiguous, and many errors may be expected during program execution, and their occurrence does not necessarily mean that the log is abnormal. Second, it is difficult to label all keywords for different types of logs.

[0004] Therefore, traditional log-based extraction methods cannot accurately identify network service anomalies and will also consume huge human resources costs. Summary of the Invention

[0005] The purpose of this invention is to provide a method, device, and electronic device for monitoring network service anomalies, in order to solve the problem that traditional log extraction-based methods cannot accurately identify network service anomalies and also consume huge human resources.

[0006] To solve the above-mentioned technical problems, the embodiments of the present invention are implemented as follows:

[0007] In a first aspect, embodiments of the present invention provide a method for monitoring network service anomalies, including:

[0008] The distribution ratio of the target value of the target variable is obtained from the log data of the acquired network services;

[0009] Based on the distribution ratio, the probability of the network service causing an abnormal state is obtained through a preset correspondence formula corresponding to the target value of the target variable; wherein, the correspondence formula is obtained based on the correspondence between the distribution ratios of the target value of the target variable in the historical log data of the network service and the service states of the network service.

[0010] Secondly, embodiments of the present invention provide a network service anomaly monitoring device, comprising:

[0011] The acquisition module is used to obtain the distribution ratio of the target value of the target variable from the acquired network service log data;

[0012] The parsing module is used to obtain the probability of the network service causing an abnormal state based on the distribution ratio and a preset correspondence formula corresponding to the target value of the target variable; wherein the correspondence formula is obtained based on the correspondence between the distribution ratio of the target value of the target variable in the historical log data of the network service and the service status of the network service.

[0013] Thirdly, embodiments of the present invention provide an electronic device, including a processor, a communication interface, a memory, and a communication bus; wherein the processor, the communication interface, and the memory communicate with each other via the bus; the memory is used to store computer programs; and the processor is used to execute the programs stored in the memory to implement the network service anomaly monitoring method steps as described in the first aspect.

[0014] Fourthly, embodiments of the present invention provide a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the network service anomaly monitoring method steps as described in the first aspect.

[0015] As can be seen from the technical solutions provided by the above embodiments of the present invention, the embodiments of the present invention obtain the distribution ratio of the target value of the target variable from the acquired log data of network services; based on the distribution ratio, the abnormal probability of the network service causing an abnormal state is obtained through a preset correspondence formula corresponding to the target value of the target variable; wherein, the correspondence formula is obtained based on the correspondence between the distribution ratios of the target value of the target variable in the historical log data of the network service and the correspondence between the service states of the network service. Through the embodiments of the present invention, accurate judgment of the abnormal state of network services is achieved, and a lot of manpower and material resources are saved. Attached Figure Description

[0016] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0017] Figure 1 A flowchart illustrating a network service anomaly monitoring method provided in an embodiment of the present invention;

[0018] Figure 2 Another flowchart illustrating the network service anomaly monitoring method provided in this embodiment of the invention;

[0019] Figure 3 This is a schematic diagram of the network service anomaly monitoring device provided in an embodiment of the present invention;

[0020] Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0021] This invention provides a method, apparatus, and electronic device for monitoring network service anomalies.

[0022] To enable those skilled in the art to better understand the technical solutions of this invention, the technical solutions of the embodiments of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this invention, and not all embodiments. Based on the embodiments of this invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of this invention.

[0023] like Figure 1 As shown, this embodiment of the invention provides a method for monitoring network service anomalies. The executing entity of this method can be a server, which can be a standalone server or a server cluster composed of multiple servers. Furthermore, the server can be a server capable of performing network operation processing. Specifically, the method may include the following steps:

[0024] Step S110: Obtain the distribution ratio of the target value of the target variable from the acquired network service log data.

[0025] It should be understood that the log data of the network service refers to all log information related to the network service collected from the network within a preset sampling period. The log information may originate from various network devices or network nodes.

[0026] It should be understood that the target value of the target variable is a pre-determined value of a key variable that is likely to cause network service anomalies. The target value can be a specific numerical value or a range of values. The method for determining the target value of the target variable can be based on the variation of the distribution ratio of each value of the key variable and the probability of network service being in an abnormal state, or it can be based on the empirical values ​​of each value that actually cause abnormal states.

[0027] In one implementation, after extensive training on log data, the distribution of values ​​within a specific time period can be identified as a discrete distribution tending towards a specific proportion. When this distribution trend changes, it can be used to determine whether it will cause an abnormal state to network services, thereby determining the target variable and target value.

[0028] For example, by analyzing log data from a certain sampling period, the probability of network service anomalies is determined to be 0.01%. In this case, the distribution of values ​​for variable 6 is as follows: 0, 89%; 350, 8%; 700, 3%. By analyzing log data from another sampling period, the probability of network service anomalies is determined to be 90%. In this case, the distribution of values ​​for variable 6 is as follows: 0, 90%; 350, 1%; 700, 9%. Therefore, logically, a value of 0 for variable 6 does not affect the state of network services, and thus, a value of 0 for variable 6 should not be used as the target value for the target variable. When the distribution of variable 6's value of 700 is 3%, the probability of network service anomalies is 0.01%, while when the distribution of variable 6's value of 700 is 9%, the probability of network service anomalies is 90%. At this point, the value of variable 6, 700, can be taken as the target value of the target variable. The probability of network service anomalies can be determined by analyzing the distribution of the value of variable 6, 700.

[0029] Furthermore, prior to step S110, the method further includes:

[0030] The acquired network service log data is normalized according to the preset log template.

[0031] In one implementation, artificial intelligence (AI) natural language processing algorithms can be used to pre-train the log training data. Machine learning is applied to the massive log training data to classify the originally diverse log templates and extract the positions of key information within each template, normalizing them into a unified log template. Before analyzing the acquired log data, the collected log data is normalized based on the unified log template, allowing for the extraction of key information during subsequent analysis. For example, the unified log template is shown below:

[0032] [1][2]user.info syslog: / usr / sbin / ifconfig[3]

[0033] [1][2]ftp.info vsftpd:[3][pid[4][5]]OK DOWNL

[0034] OAD:Client[6],[7],[8]bytes,[9]Kbyte / sec

[0035] Among them, [1], [2], [3], [4], [5], [6], [7], [8], and [9] are all key information, and the key information may include the value of the target variable.

[0036] During the monitoring of network services, the log module is used to normalize the log data generated during the sampling period, extract the values ​​of the target variable from the log data, and further calculate the distribution ratio of the target values ​​of the target variable.

[0037] In one implementation, the unified log module may correspond to the network service, or to one or more abnormal states of the network service, or to the target variable, or to both the target variable and one or more abnormal states of the network service.

[0038] Step S120: Based on the distribution ratio, obtain the abnormal probability of the network service causing an abnormal state through a preset correspondence formula corresponding to the target value of the target variable; wherein, the correspondence formula is obtained based on the correspondence between the distribution ratios of the target value of the target variable in the historical log data of the network service and the service states of the network service.

[0039] The historical log data of network services are analyzed in advance to obtain the correspondence between the distribution ratio of the target value of the target variable and the probability of network service anomalies.

[0040] It should be understood that the correspondence can correspond to the target value of the target variable and a certain abnormal state of the network service.

[0041] The distribution ratio of the target values ​​of the target variable obtained at present is calculated using the corresponding relationship to predict the abnormal probability of the current network service abnormal state, and an abnormal notification message is generated and pushed to the monitoring front end based on the prediction result.

[0042] As can be seen from the technical solutions provided by the above embodiments of the present invention, the embodiments of the present invention obtain the distribution ratio of the target value of the target variable from the acquired log data of network services; based on the distribution ratio, the abnormal probability of the network service causing an abnormal state is obtained through a preset correspondence formula corresponding to the target value of the target variable; wherein, the correspondence formula is obtained based on the correspondence between the distribution ratios of the target value of the target variable in the historical log data of the network service and the correspondence between the service states of the network service. Through the embodiments of the present invention, accurate judgment of the abnormal state of network services is achieved, and a lot of manpower and material resources are saved.

[0043] Based on the above embodiments, the method for obtaining the correspondence formula can be diverse. This application only provides one implementation method, such as... Figure 2 As shown, the method further includes the following steps before step S110 above.

[0044] Step S101: Determine the target variable and the target value of the target variable from the historical log data of the network service.

[0045] Based on a preset log template, historical log data is first normalized, and key information, including key variables and their values, is extracted. Output variables are prioritized over input variables. As shown in the above embodiment, by analyzing the distribution and changes in the values ​​of each key change, and their impact on the service status of network services, target variables and target values ​​that can be used to determine abnormal states of network services are identified.

[0046] Step S102: Calculate the statistical number of each service status of the network service under each target distribution ratio of the target value from the historical log data.

[0047] The target distribution ratio can be a typical ratio value or a ratio range.

[0048] Table 1 below shows the information on the target value 'a' of target variable A extracted from historical log data:

[0049]

[0050] Table 1

[0051] Based on the statistics in Table 1, the number of service states for each network service under each target distribution ratio is shown in Table 2 below:

[0052]

[0053] Table 2

[0054] Step S103: Based on the statistical quantity of each service state of the network service under each target distribution ratio of the target value, the corresponding relationship is calculated using a preset algorithm.

[0055] Furthermore, the preset algorithm can be of various kinds. This embodiment of the application only uses the Bayesian algorithm as an example for illustration.

[0056] In one embodiment, step S103 includes:

[0057] Based on the statistical number of each service state of the network service under each target distribution ratio of the target value, the first relation is calculated using Bayes' theorem; wherein, the first relation is used to calculate the abnormal probability of the network service causing abnormal state under each target distribution ratio.

[0058] Furthermore, the first relation can be expressed as:

[0059]

[0060] Wherein, c indicates that the network service is in an abnormal state, x is the target distribution ratio of the target value of the target variable, p(c) is the prior probability that the network service is in an abnormal state, p(x) is the prior probability that the distribution ratio of the target value of the target variable is the target distribution ratio x, p(x|c) is the posterior probability that the target value of the target variable is the target distribution ratio x when the network service is in an abnormal state, and p(c|x) is the abnormal probability that the network service will cause an abnormal state when the target value of the target variable is known to be the target distribution ratio x.

[0061] For example, based on Table 2, the anomaly probability corresponding to the target value 'a' of the known target variable A under each target distribution proportion can be calculated:

[0062] 1. The probability of an anomaly when the distribution ratio is 10%:

[0063] p(abnormal|10%) = p(10%|abnormal)p(10%) / p(abnormal);

[0064] in,

[0065] We get p(abnormal|10%) = 0.

[0066] 2. The probability of an anomaly when the distribution ratio is 30%:

[0067] p(abnormal|30%) = p(30%|abnormal)p(30%) / p(abnormal);

[0068] in,

[0069]

[0070]

[0071] so

[0072] 3. Probability of anomalies when the distribution ratio is 50%

[0073] p(abnormal|50%) = p(50%|abnormal)p(50%) / p(abnormal);

[0074] in,

[0075]

[0076]

[0077] so

[0078] The first relation is derived from the basic Bayesian calculation formula and is only suitable for considering the independence of the distribution ratio of the target variable's target value on network services. It does not consider the impact of the continuous change of the distribution ratio on the trend of anomaly probability. However, in scenarios where the values ​​of a large number of target variables are discretely distributed, the greater the change in the discrete distribution ratio, the greater the probability of anomalies. Therefore, considering the continuous impact caused by the trend change of data, the first relation can be improved.

[0079] Based on the first relation, a second relation is obtained by adding forward deviation and backward deviation related parts to the first relation.

[0080] The second relation can be expressed as:

[0081] p(c|x)=p(x|c)p(c) / p(x)+x / x1×p(c|x1)-x / x2×p(c|x2)

[0082] Wherein, x1 and x2 are two target distribution ratios adjacent to the target distribution ratio, and x / x1×p(c|x1) and x / x2×p(c|x2) are the forward deviation and backward deviation related parts, respectively.

[0083] Based on Table 2, taking a target distribution ratio x of 30% as an example, target distribution ratio x1 is 50% of the target value distribution at a measurement point after target distribution ratio x, and target distribution ratio x2 is 10% of the target value distribution at a measurement point before target distribution ratio x. Therefore, based on the second relational formula, the following can be calculated:

[0084]

[0085] Taking p(abnormal|50%) = 1 as an example, p(abnormal|30%) = 0.24 + 0.6 - 0 = 0.84.

[0086] If the result p(abnormal|30%) obtained from the second relation is greater than 1, then the value is taken as 1.

[0087] Based on the second relation, a third relation is obtained; wherein, the third relation is used to calculate the probability of the network service causing an abnormal state under the distribution ratio between two adjacent target distribution ratios.

[0088] The third relation can be expressed as:

[0089] p(c|x′)=AVG{[p(c|x1′)+(p(c|x′)-p(c|x1′)) / (x′-x1′)x′]+[p(c|x2′)+(p(c|x′)-p(c|x2′)) / (x2′-x′)x′]}

[0090] Where x′ is the distribution ratio between the distribution ratios x1′ and x2′ of the two adjacent targets.

[0091] Based on Table 2, taking a target distribution ratio x1′ of 30% and a target distribution ratio x2′ of 50% as an example, if p(abnormal|50%) = 1 and p(abnormal|30%) = 0.84, the third relation is obtained as follows:

[0092] p(abnormal|x′)=AVG{[p(abnormal|30%)+(p(abnormal|x′)-p(abnormal|30%)) / (x′-30%)x′]+[p(abnormal|50%)+(p(abnormal|x′)-p(abnormal|50%)) / (50%-x′)x′]}

[0093] Taking a target distribution proportion x′ of 40% as an example, we get:

[0094]

[0095] The corresponding relation is obtained from the third relation, and the third relation can be directly used as the corresponding relation to indicate the distribution ratio of the target value of the target variable and the probability of abnormality of network services.

[0096] As can be seen from the technical solutions provided by the above embodiments of the present invention, the embodiments of the present invention determine the target variable and the target value of the target variable from the historical log data of the network service; statistically obtain the statistical quantity of each service state of the network service under each target distribution ratio of the target value from the historical log data; and calculate the corresponding relationship formula using a preset algorithm based on the statistical quantity of each service state of the network service under each target distribution ratio of the target value. Through the embodiments of the present invention, it is realized that the correspondence formula between the target value of the target variable and the abnormal state of the network service can be obtained by analyzing historical log data, thereby enabling more accurate judgment of the abnormal state of the network service.

[0097] Corresponding to the network service anomaly monitoring method provided in the above embodiments, based on the same technical concept, this embodiment of the invention also provides a network service anomaly monitoring device. Figure 3 This is a schematic diagram of the module composition of the network service anomaly monitoring device provided in an embodiment of the present invention. The network service anomaly monitoring device is used to perform... Figures 1 to 2 The described network service anomaly monitoring method, such as Figure 3 As shown, the network service anomaly monitoring device includes: a data acquisition module 301 and a data parsing module 302.

[0098] The acquisition module 301 is used to obtain the distribution ratio of the target value of the target variable from the acquired log data of the network service; the parsing module 302 is used to obtain the abnormal probability of the network service causing an abnormal state based on the distribution ratio and a preset correspondence formula corresponding to the target value of the target variable; wherein, the correspondence formula is obtained based on the correspondence between the distribution ratio of the target value of the target variable in the historical log data of the network service and the correspondence between the service states of the network service.

[0099] Furthermore, the acquisition module 301 is also used to normalize the acquired log data of network services according to a preset log template.

[0100] As can be seen from the technical solutions provided by the above embodiments of the present invention, the embodiments of the present invention obtain the distribution ratio of the target value of the target variable from the acquired log data of the network service; based on the distribution ratio, and through a preset correspondence formula corresponding to the target value of the target variable, the abnormal probability of the network service causing an abnormal state is obtained; wherein, the correspondence formula is obtained based on the correspondence between the distribution ratios of the target value of the target variable in the historical log data of the network service and the corresponding service states of the network service. Through the embodiments of the present invention, accurate judgment of the abnormal state of the network service is achieved.

[0101] Based on the above embodiments, the parsing module is further configured to:

[0102] The target variable and its target value are determined from the historical log data of the network service.

[0103] The statistical number of each service status of the network service under each target distribution ratio of the target value is obtained from the historical log data.

[0104] Based on the statistical quantity of each service state of the network service under each target distribution ratio of the target value, the corresponding relationship is calculated using a preset algorithm.

[0105] The preset algorithm is the Bayesian algorithm.

[0106] Furthermore, the parsing module is used for:

[0107] Based on the statistical number of each service state of the network service under each target distribution ratio of the target value, the first relation is calculated using Bayes' theorem; wherein, the first relation is used to calculate the abnormal probability of the network service causing abnormal state under each target distribution ratio.

[0108] Based on the first relation, a second relation is obtained by adding forward deviation and backward deviation related parts to the first relation;

[0109] Based on the second relation, a third relation is obtained; wherein, the third relation is used to calculate the probability of the network service causing an abnormal state under the distribution ratio between two adjacent target distribution ratios;

[0110] The corresponding relation is obtained based on the third relation.

[0111] Furthermore, the first relation can be expressed as:

[0112]

[0113] Wherein, c indicates that the network service is in an abnormal state, x is the target distribution ratio of the target value of the target variable, p(c) is the prior probability that the network service is in an abnormal state, p(x) is the prior probability that the distribution ratio of the target value of the target variable is the target distribution ratio x, p(x|c) is the posterior probability that the target value of the target variable is the target distribution ratio x when the network service is in an abnormal state, and p(c|x) is the abnormal probability that the network service will cause an abnormal state when the target value of the target variable is known to be the target distribution ratio x.

[0114] The second relation can be expressed as:

[0115] p(c|x)=p(x|c)p(c) / p(x)+x / x1×p(c|x1)-x / x2×p(c|x2)

[0116] Wherein, x1 and x2 are two target distribution ratios adjacent to the target distribution ratio, and x / x1×p(c|x1) and x / x2×p(c|x2) are the forward deviation and backward deviation related parts, respectively;

[0117] The third relation can be expressed as:

[0118] p(c|x′)=AVG{[p(c|x1′)+(p(c|x′)-p(c|x1′)) / (x′-x1′)x′]+[p(c|x2′)+(p(c|x′)-p(c|x2′)) / (x2′-x′)x′]}

[0119] Where x′ is the distribution ratio between the distribution ratios x1′ and x2′ of the two adjacent targets.

[0120] As can be seen from the technical solutions provided by the above embodiments of the present invention, the embodiments of the present invention determine the target variable and the target value of the target variable from the historical log data of the network service; statistically obtain the statistical quantity of each service state of the network service under each target distribution ratio of the target value from the historical log data; and calculate the corresponding relationship formula using a preset algorithm based on the statistical quantity of each service state of the network service under each target distribution ratio of the target value. Through the embodiments of the present invention, it is realized that the correspondence formula between the target value of the target variable and the abnormal state of the network service can be obtained by analyzing historical log data, thereby enabling more accurate judgment of the abnormal state of the network service.

[0121] The network service anomaly monitoring device provided in this embodiment of the invention can implement the various processes in the embodiments corresponding to the above-mentioned network service anomaly monitoring method. To avoid repetition, these processes will not be described again here.

[0122] It should be noted that the network service anomaly monitoring device provided in this embodiment of the invention and the network service anomaly monitoring method provided in this embodiment of the invention are based on the same inventive concept. Therefore, the specific implementation of this embodiment can refer to the implementation of the aforementioned network service anomaly monitoring method, and repeated details will not be repeated.

[0123] Corresponding to the network service anomaly monitoring method provided in the above embodiments, based on the same technical concept, this embodiment of the invention also provides an electronic device for executing the above-described network service anomaly monitoring method. Figure 4 To illustrate the structure of an electronic device according to various embodiments of the present invention, as shown in the schematic diagram... Figure 4 As shown. Electronic devices can vary considerably due to differences in configuration or performance, and may include one or more processors 401 and memory 402. Memory 402 may store one or more application programs or data. Memory 402 may be temporary or persistent storage. The application programs stored in memory 402 may include one or more modules (not shown), each module may include a series of computer-executable instructions for the electronic device. Furthermore, processor 401 may be configured to communicate with memory 402 and execute the series of computer-executable instructions in memory 402 on the electronic device. The electronic device may also include one or more power supplies 403, one or more wired or wireless network interfaces 404, one or more input / output interfaces 405, and one or more keyboards 406.

[0124] Specifically, in this embodiment, the electronic device includes a processor, a communication interface, a memory, and a communication bus; wherein, the processor, the communication interface, and the memory communicate with each other via the bus; the memory is used to store computer programs; the processor is used to execute the programs stored in the memory to implement the following method steps:

[0125] The distribution ratio of the target value of the target variable is obtained from the log data of the acquired network services;

[0126] Based on the distribution ratio, the probability of the network service causing an abnormal state is obtained through a preset correspondence formula corresponding to the target value of the target variable; wherein, the correspondence formula is obtained based on the correspondence between the distribution ratios of the target value of the target variable in the historical log data of the network service and the service states of the network service.

[0127] This application embodiment also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the following method steps:

[0128] The distribution ratio of the target value of the target variable is obtained from the log data of the acquired network services;

[0129] Based on the distribution ratio, the probability of the network service causing an abnormal state is obtained through a preset correspondence formula corresponding to the target value of the target variable; wherein, the correspondence formula is obtained based on the correspondence between the distribution ratios of the target value of the target variable in the historical log data of the network service and the service states of the network service.

[0130] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, apparatus, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0131] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0132] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0133] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0134] In a typical configuration, an electronic device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0135] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0136] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0137] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0138] Those skilled in the art will understand that embodiments of this application can be provided as methods, apparatus, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0139] The above description is merely an embodiment of this application and is not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A method for monitoring network service anomalies, characterized in that, The method includes: The distribution ratio of the target value of the target variable is obtained from the log data of the acquired network services; Based on the distribution ratio, the probability of the network service causing an abnormal state is obtained through a preset correspondence formula corresponding to the target value of the target variable; wherein, the correspondence formula is obtained based on the correspondence between the distribution ratio of the target value of the target variable in the historical log data of the network service and the service state of the network service. The target variable and its target value are determined from the historical log data of the network service. The statistical number of each service status of the network service under each target distribution ratio of the target value is obtained from the historical log data; Based on the statistical number of each service state of the network service under each target distribution ratio of the target value, the first relation is calculated using Bayes' theorem; wherein, the first relation is used to calculate the abnormal probability of the network service causing abnormal state under each target distribution ratio. Based on the first relation, a second relation is obtained by adding forward deviation and backward deviation related parts to the first relation; Based on the second relation, a third relation is obtained; wherein, the third relation is used to calculate the probability of the network service causing an abnormal state under the distribution ratio between two adjacent target distribution ratios; The corresponding relation is obtained based on the third relation.

2. The method according to claim 1, characterized in that, The first relation is expressed as: in, This indicates that the network service is in an abnormal state. The target distribution proportion of the target value of the target variable. This represents the prior probability that the network service is in an abnormal state. The distribution ratio of the target values ​​of the target variable is the target distribution ratio. The prior probability, The target value of the target variable is the target distribution ratio when the network service is in an abnormal state. The posterior probability, Given that the target value of the target variable is the target distribution ratio The probability of the network service causing an abnormal state under the circumstances; The second relation is expressed as: Among them, the and These are the two target distribution ratios adjacent to the target distribution ratio. and These are the relevant parts for forward deviation and backward deviation, respectively; The third relation is expressed as: in, The distribution ratio of the two adjacent targets and The distribution ratio between them.

3. The method according to any one of claims 1-2, characterized in that, Before obtaining the distribution ratio of the target value of the target variable from the acquired network service log data, the method further includes: The acquired network service log data is normalized according to the preset log template.

4. A network service anomaly monitoring device, characterized in that, include: The acquisition module is used to obtain the distribution ratio of the target value of the target variable from the acquired network service log data; The parsing module is used to obtain the probability of the network service causing an abnormal state based on the distribution ratio and a preset correspondence formula corresponding to the target value of the target variable; wherein the correspondence formula is obtained based on the correspondence between the distribution ratios of the target value of the target variable in the historical log data of the network service and the various service states of the network service; and The target variable and its target value are determined from the historical log data of the network service. The statistical number of each service status of the network service under each target distribution ratio of the target value is obtained from the historical log data; Based on the statistical number of each service state of the network service under each target distribution ratio of the target value, the first relation is calculated using Bayes' theorem; wherein, the first relation is used to calculate the abnormal probability of the network service causing abnormal state under each target distribution ratio. Based on the first relation, a second relation is obtained by adding forward deviation and backward deviation related parts to the first relation; Based on the second relation, a third relation is obtained; wherein, the third relation is used to calculate the probability of the network service causing an abnormal state under the distribution ratio between two adjacent target distribution ratios; The corresponding relation is obtained based on the third relation.

5. An electronic device, characterized in that, The system includes a processor, a communication interface, a memory, and a communication bus; wherein the processor, the communication interface, and the memory communicate with each other via the bus; the memory is used to store computer programs; and the processor is used to execute the programs stored in the memory to implement the steps of the network service anomaly monitoring method as described in any one of claims 1-3.

6. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the network service anomaly monitoring method as described in any one of claims 1-3.

Images