Business index anomaly monitoring method, device and equipment and storage medium

Abstract

Embodiments of the present application provide a service index exception monitoring method, device and equipment and a storage medium, wherein the service index exception monitoring method comprises: obtaining an index element set corresponding to a service index of a service to be monitored; dividing the index element set into a to-be-detected sequence and a sample sequence; dividing the sample sequence into a plurality of first sub-sequences according to a first time period; performing processing to determine an index type based on the plurality of first sub-sequences to obtain an index type of the sample sequence; generating an exception parameter of the sample sequence according to the index type, the to-be-detected sequence and the sample sequence, and outputting an exception monitoring result of the to-be-detected service based on the exception parameter of the sample sequence. By using the embodiments of the present application, the monitoring workload of the service index can be reduced, thereby improving the exception monitoring efficiency.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of data processing, and in particular to a business index abnormality monitoring method and device, equipment and a storage medium. BACKGROUND

[0002] In the actual operation process of a business, random faults are very common. The occurrence of a fault is often accompanied by negative effects of the fault on multiple dimensions of the business. Each business is often pre-configured with multiple business indexes of different dimensions, each of which has its own characteristics. Abnormality monitoring of each business index can enable timely discovery of the impact range of the fault on the business index and timely resolution of the impact of the fault to ensure normal operation of the business.

[0003] As described above, each business is often configured with multiple indexes of different dimensions. How to specially configure a corresponding monitoring process for each business index is a large workload and involves many redundant operations. Therefore, how to reduce the monitoring workload for each business index of a to-be-monitored business and improve the monitoring efficiency of the business index is increasingly valued. SUMMARY

[0004] Embodiments of the present application provide a business index abnormality monitoring method, device, equipment and storage medium, which can reduce the monitoring workload of the business index and thus improve the abnormality monitoring efficiency of the index.

[0005] In a first aspect, embodiments of the present application provide a business index abnormality monitoring method, comprising:

[0006] obtaining an index element set corresponding to a business index of a to-be-monitored business; the index element set comprises a plurality of index elements arranged in order of generation time; the index element set is generated based on a business index generation rule and trace data of the to-be-monitored business;

[0007] dividing the index element set into a to-be-detected sequence and a sample sequence; the to-be-detected sequence comprises a preset number of index elements with generation times close to a current time point; the sample sequence comprises other index elements in the index element set except the to-be-detected sequence; the generation time of the first index element in the sample sequence is after the generation time of the last index element in the to-be-detected sequence;

[0008] dividing the sample sequence into a plurality of first sub-sequences according to a first time period;

[0009] performing a processing of determining an index category based on the plurality of first sub-sequences to obtain an index category of the sample sequence;

[0010] Based on the indicator type, the sequence to be detected, and the sample sequence, anomaly parameters of the sample sequence are generated, and anomaly monitoring results of the service to be detected are output based on the anomaly parameters of the sample sequence.

[0011] Secondly, embodiments of this application provide an anomaly monitoring device for business metrics, comprising:

[0012] The acquisition unit is used to acquire the set of indicator elements corresponding to the business indicators of the business to be monitored; the set of indicator elements includes multiple indicator elements arranged in order of generation time; the set of indicator elements is generated based on the business indicator generation rules and the embedded data of the business to be monitored.

[0013] The first partitioning unit is used to partition the indicator element set into a sequence to be detected and a sample sequence; the sequence to be detected includes a preset number of indicator elements whose generation time is close to the current time point; the sample sequence includes other indicator elements in the indicator element set besides the sequence to be detected; the generation time of the first indicator element in the sample sequence is after the generation time of the last indicator element in the sequence to be detected.

[0014] The second partitioning unit is used to divide the sample sequence into multiple first subsequences according to the first time period;

[0015] The processing unit is used to determine the index type based on the plurality of first sub-sequences to obtain the index type of the sample sequence;

[0016] The output unit is used to generate abnormal parameters of the sample sequence according to the indicator type, the sequence to be detected and the sample sequence, and output the abnormal monitoring results of the service to be detected based on the abnormal parameters of the sample sequence.

[0017] Thirdly, embodiments of this application provide an anomaly monitoring device for business metrics, including: a processor; and a memory configured to store computer-executable instructions, which, when executed, cause the processor to perform the anomaly monitoring method for business metrics described in the first aspect.

[0018] Fourthly, embodiments of this application provide a computer-readable storage medium for storing computer-executable instructions, which, when executed by a processor, implement the anomaly monitoring method for business metrics as described in the first aspect.

[0019] As can be seen in this embodiment, when it is necessary to perform anomaly monitoring on the business to be monitored, the indicator element set corresponding to the business indicator of the business to be monitored is first obtained; the indicator element set includes multiple indicator elements arranged in order of generation time; the indicator element set is generated based on the business indicator generation rules and the embedded data of the business to be monitored; secondly, the indicator element set is divided into a sequence to be detected and a sample sequence; the sequence to be detected includes a preset number of indicator elements whose generation time is close to the current time point; the sample sequence includes other indicator elements in the indicator element set other than the sequence to be detected; the generation time of the first indicator element in the sample sequence is after the generation time of the last indicator element in the sequence to be detected; then, according to the first time period, the sample sequence is divided into multiple first subsequences; next, processing is performed based on the multiple first subsequences to determine the indicator type, thereby obtaining the indicator type of the sample sequence; finally, according to the indicator type, the sequence to be detected, and the sample sequence, the abnormal parameters of the sample sequence are generated, and the anomaly monitoring result of the business to be monitored is output based on the abnormal parameters of the sample sequence. Therefore, after dividing the set of indicator elements corresponding to the business indicators of the business to be monitored into the detection sequence and the sample sequence, and further dividing the sample sequence into multiple first subsequences, the indicator type of the business indicators of the business to be monitored can be determined by the characteristics of the first subsequences. Thus, in the case of different indicator types, abnormal parameters corresponding to the sample sequence can be generated by combining the indicator types. By determining the indicator types and generating abnormal parameters of the sample sequence based on the indicator types, the detection sequence, and the sample sequence, each indicator type can correspond to a different method of generating abnormal parameters. This significantly reduces the configuration workload of the business indicator monitoring process, eliminates the need to configure a dedicated monitoring process for each business indicator, reduces the monitoring workload for each business indicator of the business to be monitored, and ensures that the generation method of business indicators of the same indicator type is the same, which is beneficial for horizontal comparison of the abnormal situations of various business indicators. Attached Figure Description

[0020] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this specification. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0021] Figure 1 A flowchart illustrating a method for monitoring anomalies in business metrics provided in this application embodiment;

[0022] Figure 2 A schematic diagram illustrating the framework of a method for monitoring anomalies in business metrics provided in this application embodiment;

[0023] Figure 3 A schematic diagram of an anomaly monitoring device for business indicators provided in an embodiment of this application;

[0024] Figure 4 This is a schematic diagram of the structure of an anomaly monitoring device for business indicators provided in an embodiment of this application. Detailed Implementation

[0025] To enable those skilled in the art to better understand the technical solutions in the embodiments of this application, the technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments in this specification, and not all of the embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort should fall within the protection scope of this application.

[0026] Random failures can impact business operations across different dimensions to varying degrees. For example, some business data may become significantly abnormal, rendering them completely unusable; others may be moderately affected, continuing to operate but with reduced effectiveness; and still others may be virtually unaffected. Business operations often possess different metrics across different dimensions, each with its own characteristics. Configuring dedicated monitoring processes for each metric is labor-intensive and involves numerous redundant operations. To overcome this problem, this application provides a method for monitoring anomalies in business metrics.

[0027] Figure 1 A flowchart illustrating a method for monitoring anomalies in business metrics provided in this application embodiment. Figure 1 The anomaly monitoring method for business metrics can be executed by an anomaly monitoring device for business metrics. This device can be a terminal device, such as a mobile phone, laptop, or smart interactive device; alternatively, it can be a server, such as a standalone physical server, a server cluster, or a cloud server capable of cloud computing. The anomaly monitoring method for business metrics provided in this embodiment specifically includes steps S102 to S110:

[0028] Step S102: Obtain the indicator element set corresponding to the business indicator of the business to be monitored; the indicator element set includes multiple indicator elements arranged in order of generation time; the indicator element set is generated based on the business indicator generation rules and the data points of the business to be monitored.

[0029] A buried point is a record of user behavior data. Based on business or product requirements, a page, location, attribute, etc. corresponding to each event of user behavior in the product are implanted with relevant codes, and the collected data can be used to analyze the use of the website / APP (application), user habits, etc. and extend to user portrait, user preference, conversion path, and a series of data products.

[0030] A buried point SDK (software development kit) is a dependent package that can output standard data at key business nodes for a business system. The business system needs to add the dependent package to the core business code to construct buried point data during the running of the core business code. The core business code is a code that can be used to execute various preset business tasks when the business system runs.

[0031] The to-be-monitored business can be any business that has monitoring requirements. The buried point data of the to-be-monitored business can be user data that can reflect user behavior related to the to-be-monitored business collected by an abnormal monitoring device of a business index when the to-be-monitored business runs. For example, the to-be-monitored business can be an application form business, and the buried point data includes, but is not limited to, the creation time of the application form, the application form number for uniquely identifying the application form, the approval start time and the approval end time of the application form, the approval result of the application form, etc.

[0032] In specific implementation, the corresponding buried point data code can be added to the core business code of the to-be-monitored business by running the buried point SDK. Then, when the to-be-monitored business runs, that is, when the core business code after adding the buried point data code runs, the abnormal monitoring device of the business index can collect the buried point data of the to-be-monitored business and output the buried point data in the form of a log to a standard log directory. Then, the buried point log is collected by a log collection component and transmitted to a distributed message system.

[0033] Exemplarily, the log collection component can be a filebeat component, which is a lightweight log collection component with the characteristics of stable performance, breakpoint recovery, concurrent reading, and multi-channel support. The distributed message system can be a kafka system, which is a distributed, partitioned, multi-replica, and multi-subscriber distributed message system; it has the characteristics of high throughput, low delay, scalability, and high concurrency. The kafka system supports 100,000-level message reading and writing and millisecond-level delay; messages are persisted to local disks and support data backup to prevent data loss; and the system allows node failure in the cluster and supports thousands of clients to read and write simultaneously.

[0034] Furthermore, the anomaly monitoring equipment for business metrics can read the event tracking data of the business to be monitored from the event tracking logs through a distributed messaging system.

[0035] By implementing event tracking on business data, different business scenarios can be visualized through configuration rules. Furthermore, business metrics data can be used for alerts, operational analysis, and other scenarios. Separating event tracking from metric calculation allows for the reuse of event tracking data and enables joint calculation of business metrics with other event tracking data, reducing intrusion into business systems.

[0036] In practice, each business function can be pre-configured with corresponding business indicator generation rules. These rules specify how to generate business indicators that reflect the business status of the corresponding function based on the event tracking data. Each business function can have one or more business indicators. These business indicator generation rules can be applied to the business indicator monitoring system of the corresponding business function.

[0037] For example, suppose the business to be monitored is an application form business, whose core business performance is the number of application forms, the application form approval rate, and the application form approval time. Then, we can configure a total number indicator for the data points of received application forms, an approval rate indicator for the data points of approval results and the number of received application forms, and an approval time indicator for the data points of approval results and the time of received application forms. Then, we can associate these indicators with the corresponding business domains in the business indicator monitoring system.

[0038] Furthermore, the anomaly monitoring device for business metrics can read the event tracking data of the business to be monitored from the event tracking logs through a distributed message system, based on the various business metrics configured in the business metric generation rules; the event tracking data of the business to be monitored includes the parameter values ​​of the event tracking parameters.

[0039] After reading the data points, the anomaly monitoring device for business metrics can generate the business metric value for each business metric based on the data points and the business metric generation rules.

[0040] Specifically, for each indicator element, the closer its generation time is to the current time, the earlier it appears in the indicator element set; conversely, the further its generation time is from the current time, the later it appears in the indicator element set. For example, if the business to be monitored is an approval order business, the data points for this business include the approval result parameters of the application form. These parameters include n parameter values: Approval Result 1, Approval Result 2, Approval Result 3… Approval Result n. These n parameter values ​​are arranged sequentially according to their generation time. Approval Result 1 is the earliest generated approval result among these n parameter values, followed by Approval Result 2, Approval Result 3, and so on, until Approval Result n is generated after Approval Result n-1. Based on these n parameter values ​​and the approval pass rate calculation rules in the business indicator generation rules, m business indicator values ​​for the business indicator "Approval Pass Rate" can be calculated: S1, S2, S3… S… m-1 and S m The m business indicator values ​​are arranged sequentially according to their generation time, with S1 being the earliest generated business indicator value, S2 being generated after S1, S3 being generated after S2, and so on. m The generation time is located in S m-1 Then, n and m can be any natural numbers.

[0041] After generating multiple business indicator values ​​for each business indicator, each business indicator value can be identified as an indicator element to form an indicator element set that includes multiple indicator elements arranged in order of generation time.

[0042] Arrange them in order of generation time. The first arrangement is: the further away the generation time is from the current time, the smaller the index number of the index element in the index element set; the closer the generation time is to the current time, the larger the index number of the index element in the index element set. The second arrangement is: the closer the generation time is to the current time, the smaller the index number of the index element in the index element set; the further away the generation time is from the current time, the larger the index number of the index element in the index element set.

[0043] In the first and second permutations, "first" and "second" are merely for distinguishing between the two different orders and have no actual meaning.

[0044] The indicator element sets mentioned below will be explained using the second arrangement order as an example. Examples of the first arrangement order can be found in the corresponding descriptions of the second arrangement order examples, and will not be repeated here.

[0045] The entity that executes the generation of indicator element sets can be an anomaly monitoring device for business indicators or other electronic devices.

[0046] In one implementation, before step S102 is executed, an anomaly monitoring device for business metrics or other electronic devices may generate a set of indicator elements based on the business metric generation rules and the embedded data of the business to be monitored, and store it in a preset storage space. Obtaining the set of indicator elements corresponding to the business metrics of the business to be monitored may be achieved by reading the set of indicator elements from the preset storage space.

[0047] In conjunction with this implementation, step S102 can be replaced by reading the indicator element set from a preset storage space. Alternatively, step S102 can also be replaced by: generating an indicator element set based on the business indicator generation rules and the embedded data of the business to be monitored, and storing it in a preset storage space; then reading the indicator element set from the preset storage space.

[0048] In another implementation, obtaining the set of indicator elements corresponding to the business indicators of the business to be monitored can be achieved by the anomaly monitoring device of the business indicators generating the set of indicator elements based on the business indicator generation rules and the embedded data of the business to be monitored. Step S102 can be replaced by this step in this implementation.

[0049] In practice, the tracking data can be read from the tracking data, which includes multiple parameter values ​​of the tracking parameters, arranged in order of reading time. The multiple parameter values ​​are divided into multiple parameter value groups, each of which includes at least one parameter value. Based on each parameter value group and the business indicator generation rules, corresponding indicator elements are generated to form an indicator element set that includes multiple indicator elements arranged in order of generation time.

[0050] Furthermore, in practical implementation, considering that the monitored service may run continuously for a long time, the indicator element set can be continuously expanded during the operation of the monitored service, so that the number of indicator elements included in the indicator element set is greater than the first preset number of indicator elements required to meet the anomaly monitoring needs. Obtaining the indicator element set corresponding to the service indicator of the monitored service can be achieved by obtaining a subset of indicator elements formed by a second preset number of indicator elements from the indicator element set. This subset includes a second preset number of indicator elements whose generation time is close to the current time point, and these second preset number of indicator elements are arranged sequentially according to their generation time. The second preset number can be equal to or greater than the first preset number. Here, "first" and "second" are merely for distinguishing two quantities with different functions and do not have any actual meaning.

[0051] In one embodiment, the business metric anomaly monitoring device can use Flink to generate a set of metric elements based on business metric generation rules and event tracking data. A new metric element is calculated every minute, and then the new metric element is stored in Elasticsearch and added to the metric element set.

[0052] Flink is an open-source stream processing framework developed by the Apache Software Foundation (ASF). Its core is a distributed streaming data stream engine written in Java and Scala. Flink executes arbitrary streaming programs in a data-parallel and pipelining manner. Flink's pipelining runtime system can execute both batch and stream processing programs. Furthermore, Flink's runtime itself also supports the execution of iterative algorithms.

[0053] Elasticsearch (ES) is an open-source search and data analysis engine, as well as a distributed real-time document store and full-text search engine. It can handle the expansion of hundreds of service nodes and supports petabyte-level structured or unstructured data.

[0054] Step S104: Divide the indicator element set into a detection sequence and a sample sequence. The detection sequence includes a preset number of indicator elements whose generation time is close to the current time. The sample sequence includes other indicator elements in the indicator element set that are not in the detection sequence. The generation time of the first indicator element in the sample sequence is after the generation time of the last indicator element in the detection sequence. The detection sequence can be a sequence of indicator elements used to detect whether business indicators are abnormal. The detection sequence may include a preset number of indicator elements whose generation time is close to the current time, i.e., the latest preset number of indicator elements. The preset number can be 5 or other values.

[0055] Multiple indicator elements in the sequence to be detected are arranged sequentially according to their generation time. Specifically, for each indicator element, the closer its generation time is to the current time, the earlier its position in the sequence to be detected; the further its generation time is from the current time, the later its position in the sequence to be detected.

[0056] A sample sequence can be a sequence of indicator elements from which business indicator samples can be extracted. The sample sequence may include multiple indicator elements arranged sequentially according to their generation time. Specifically, for each indicator element, the closer its generation time is to the current time, the earlier its position in the sample sequence; the further its generation time is from the current time, the later its position in the sample sequence.

[0057] The generation time of the first index element in the sample sequence can be after the generation time of the last index element in the to-be-detected sequence.

[0058] Each index element in the index element set can correspond to a sequence number. For example, the index element set includes: a1, a2, a3, a4, …, aL. L L is the number of index elements included in the index element set, and L can be any natural number. The index element set is arranged according to a second arrangement order: the closer the generation time is to the current time point, the smaller the sequence number of the index element in the index element set, and the farther the generation time is from the current time point, the larger the sequence number of the index element in the index element set. The sequence number of a1 is 1, the sequence number of a1 is 1, the sequence number of a2 is 2, the sequence number of a3 is 3, …, and the sequence number of aL is L. L

[0059] The index element set can be divided into a to-be-detected sequence and a sample sequence, which can be based on a preset number to determine a target sequence number, and the index element set is divided into the to-be-detected sequence and the sample sequence according to the target sequence number. For example, the preset number is 5, and the target sequence number can be determined as 5 according to the preset number. The index element set is divided into two subsets according to the target sequence number 5: the first subset includes a1, a2, a3, a4, and a5, and the first subset can be determined as the to-be-detected sequence; and the second subset includes a6, a7, a8, …, aL, and the second subset can be determined as the sample sequence. L

[0060] In step S106, the sample sequence is divided into a plurality of first sub-sequences according to a first time period.

[0061] For example, the sample sequence can include data of the nearest 28 days to the current time point. The sample sequence can be a sample sequence corresponding to a core business index of the to-be-monitored business, and each index element in the sample sequence is an index value of the core business index. The first time period can be 7 days. Then, according to the first time period, the sample sequence including the index elements corresponding to 28 days can be divided into 4 first sub-sequences, and each first sub-sequence includes a plurality of index elements corresponding to 7 days.

[0062] The time length corresponding to each first sub-sequence obtained by division is the same, and the time length is determined by the total time length corresponding to the sample sequence and the first time period. Each first sub-sequence obtained by division includes an equal number of index elements. There is no interval index element between adjacent two first sub-sequences, for example, the last index element of the first first sub-sequence is adjacent to the first index element of the second first sub-sequence.

[0063] ​​In step S108, the processing of determining the index type based on the plurality of first subsequences is performed to obtain the index type of the sample sequence.

[0064] According to the characteristics of the index relative to time, the business index can be divided into a periodic index and a fluctuation index. The index type of the sample sequence can be a periodic index or a fluctuation index.

[0065] For example, the index calculated by statistical counting, including the number of application forms, the amount of loans, etc., is a periodic sequence, and the difference in values between 08:00-20:00 during the day and 20:00-08:00 at night is obvious, and is related to the human work and rest time. The value usually increases from 08:00 and reaches a peak around 11:00, then decreases, increases from 13:00 and reaches a peak around 17:00, then decreases, and continuously decreases at night and reaches a trough around 04:00, showing a periodic sequence according to the change every day. The success rate, time length, and other indexes have no obvious relationship with time, and are only affected by the business system capacity, so they show a fluctuation sequence.

[0066] The processing of determining the index type can be a processing mode of obtaining the index type of the sample sequence.

[0067] Optionally, the index type of the sample sequence includes one of a periodic index and a fluctuation index. The processing of determining the index type based on the plurality of first subsequences to obtain the index type of the sample sequence includes: generating a difference sequence corresponding to each first subsequence according to the difference between each adjacent two index elements in each first subsequence; calculating the standard deviation of the difference sequence corresponding to each first subsequence; determining a standard deviation parameter of the sample sequence according to the standard deviation of the difference sequence corresponding to each first subsequence; if the standard deviation parameter is greater than a preset threshold, determining that the index type of the sample sequence is a periodic index; and if the standard deviation is less than or equal to the preset threshold, determining that the index type of the sample sequence is a fluctuation index.

[0068] According to the difference between the two index elements arranged adjacent to each other in each first subsequence, a difference sequence corresponding to the first subsequence is generated.

[0069] For example, the first subsequence includes x1, x2, …, x a , and the difference sequence corresponding to the first subsequence is: x1-x2, x2-x3, …, x a-1 -x a .

[0070] After obtaining the difference sequence corresponding to each first sub-sequence, the standard deviation of the difference sequence corresponding to each first sub-sequence is calculated. Since the standard deviation can well reflect the discrete degree of data, the degree of sequence change in a period can be judged according to the standard deviation, and the smaller the standard deviation is, the smaller the fluctuation of the first sub-sequence is, and vice versa.

[0071] According to the standard deviation of each difference sequence, the standard deviation parameter of the sample sequence can be determined, which can be one of the average value, the median value and the maximum value of the standard deviation of the difference sequence corresponding to each first sub-sequence, to obtain the standard deviation parameter of the sample sequence.

[0072] Exemplarily, the preset threshold value can be 0.005.

[0073] It is judged whether the standard deviation parameter is greater than the preset threshold value: if yes, it is determined that the index type of the sample sequence is a periodic index; if not, it is determined that the index type of the sample sequence is a fluctuant index.

[0074] By calculating the difference sequence corresponding to each first sub-sequence, and calculating the standard deviation of each difference sequence, it can be determined whether the fluctuation of each first sub-sequence is severe. By calculating the standard deviation parameter of the sample sequence, the degree of sequence change of the entire sample sequence can be determined. If the value of the standard deviation parameter is large, it indicates that the degree of sequence change of the entire sample sequence is large, and in this case, it can be determined that the index type of the sample sequence is a periodic index. If the value of the standard deviation parameter is small, it indicates that the degree of sequence change of the entire sample sequence is small, and in this case, it can be determined that the index type of the sample sequence is a fluctuant index. Accordingly, by comparing the size of the standard deviation parameter and the preset threshold value, the index type of the sample sequence can be determined.

[0075] In specific implementation, according to each first sub-sequence in the plurality of first sub-sequences, a corresponding difference sequence is generated, which includes: performing normalization processing on the index elements in each first sub-sequence to obtain a normalized first sub-sequence; and generating a difference sequence corresponding to the normalized first sub-sequence according to the difference value between any two adjacent index elements in each normalized first sub-sequence.

[0076] Exemplarily, a first sub-sequence includes x1, x2, …, x a , a total of a index elements. The normalization processing on the index elements in the first sub-sequence can be to sum the element values of x1, x2, …, x a to obtain A, and to obtain the ratio of each index element in the first sub-sequence to A to obtain the normalized index element. The normalized first sub-sequence includes x1 / A, x2 / A, …, x a / A.

[0077] By normalization processing, the index elements in the first sub-sequence can be converted into the numerical interval [0, 1], but the original change trend is kept unchanged, and the data processing difficulty of the difference sequence step can be reduced.

[0078] Further, according to the difference between any two adjacent arranged index elements in each normalized first sub-sequence, a difference sequence corresponding to the normalized first sub-sequence is generated.

[0079] For example, the normalized first sub-sequence includes x1 / A, x2 / A……x a / A, then the difference sequence corresponding to the first sub-sequence is: x1 / A-x2 / A, x2 / A–x3 / A……x a-1 / A-x a / A.

[0080] The value ranges of the index values of different business indexes are different. By normalizing each first sub-sequence, the influence of the value range of the index value on the calculation of the standard deviation parameter can be reduced, and the data processing difficulty is reduced.

[0081] In step S110, according to the index category, the to-be-detected sequence and the sample sequence, an abnormal parameter of the sample sequence is generated, and an abnormal monitoring result of the to-be-detected business is output based on the abnormal parameter of the sample sequence.

[0082] The abnormal parameter of the sample sequence can be a parameter for reflecting whether the business index corresponding to the sample sequence of the to-be-detected business is abnormal.

[0083] The abnormal monitoring result of the to-be-detected business can be a detection result of whether a business index of the to-be-detected business is abnormal. Based on the comparison result of the abnormal parameter of the sample sequence and the preset abnormal threshold, the abnormal monitoring result of the to-be-detected business is determined and output.

[0084] Optionally, the abnormality parameter of the sample sequence is generated according to the index category, the to-be-detected sequence and the sample sequence, including: if the index category is a periodic index, the sample sequence is interval sampled according to a second time period to obtain a plurality of second sub-sequences arranged in the order of generation time; each second sub-sequence includes a preset number of index elements; a same-position element set of each index element in the to-be-detected sequence is determined, and the same-position element set of any index element includes a same-position element corresponding to the any index element determined from each second sub-sequence, and the same-position element corresponding to the any index element in any second sub-sequence refers to an index element with the same sequence number as the any index element in the any second sub-sequence; the sequence number of each index element in each second sub-sequence and the sequence number of each index element in the to-be-detected sequence are both determined according to the time sequence of generation; and the abnormality parameter of the sample sequence is generated based on the same-position element set of each index element in the to-be-detected sequence.

[0085] Exemplarily, the second time period can be 7 days, one month or other preset time periods. The first time period and the second time period can have the same time length or different time lengths, and there is no direct relationship between the two, and the first and the second are only used to distinguish the time periods used in two different steps. Moreover, the first time period is used to divide the sample sequence into a plurality of first sub-sequences, and there is no interval between adjacent first sub-sequences, while the second time period is used for interval sampling processing of the sample sequence to obtain second sub-sequences, and there is an interval between adjacent second sub-sequences.

[0086] If the index category is a periodic index, the sample sequence is interval sampled according to a second time period to obtain a plurality of second sub-sequences arranged in the order of generation time, which can be specifically implemented by the following steps:

[0087] Firstly, the sample sequence is divided into a plurality of to-be-processed sub-sequences according to the second time period, and each to-be-processed sub-sequence has the same time length, which is determined by the total time length of the sample sequence and the second time period. Each to-be-processed sub-sequence includes an equal number of index elements. There is no interval between adjacent two to-be-processed sub-sequences, for example, the last index element of the first to-be-processed sub-sequence is adjacent to the first index element of the second to-be-processed sub-sequence.

[0088] Then, in each to-be-processed sub-sequence, a second sub-sequence corresponding to each to-be-processed sub-sequence is generated based on the last k index elements of the to-be-processed sub-sequence, k is greater than 1 and less than the number of index elements included in the to-be-processed sub-sequence, and is used to represent the number of index elements included in each second sub-sequence, i.e. the aforementioned preset number.

[0089] For example, the sample sequence includes 3 to-be-processed subsequences, and each second subsequence includes 10080 index elements. To-be-processed subsequence 1 includes the 1st-10080th index elements, to-be-processed subsequence 2 includes the 10081st-20160th index elements, and to-be-processed subsequence 3 includes the 20161st-30240th index elements. In addition, k = 5, the second subsequence corresponding to to-be-processed subsequence 1 includes the 10076th-10080th index elements, the second subsequence corresponding to to-be-processed subsequence 2 includes the 20156th-20160th index elements, and the second subsequence corresponding to to-be-processed subsequence 3 includes the 30236th-30240th index elements. In the plurality of second subsequences arranged in the order of generation time, there are 10080 index elements between two second subsequences arranged adjacently, which are interval index elements between the two second subsequences.

[0090] Alternatively, in each to-be-processed subsequence, the second subsequence corresponding to each to-be-processed subsequence is generated based on the first k index elements of the to-be-processed subsequence.

[0091] For example, the sample sequence includes 3 to-be-processed subsequences, and each second subsequence includes 10080 index elements. To-be-processed subsequence 1 includes the 1st-10080th index elements, to-be-processed subsequence 2 includes the 10081st-20160th index elements, and to-be-processed subsequence 3 includes the 20161st-30240th index elements. In addition, k = 5, the second subsequence corresponding to to-be-processed subsequence 1 includes the 1st-5th index elements, the second subsequence corresponding to to-be-processed subsequence 2 includes the 10081st-10085th index elements, and the second subsequence corresponding to to-be-processed subsequence 3 includes the 20161st-20165th index elements. In the plurality of second subsequences arranged in the order of generation time, there are 10080 index elements between two second subsequences arranged adjacently, which are interval index elements between the two second subsequences.

[0092] Alternatively, in each to-be-processed subsequence, the second subsequence corresponding to each to-be-processed subsequence is generated based on the preset data selection rule and k.

[0093] The preset data selection rule can be configured with the sequence number of the first index element in each second subsequence in the corresponding to-be-processed subsequence, and then the second subsequence corresponding to each to-be-processed subsequence can be generated according to the sequence number and k.

[0094] The number of index elements included in the to-be-detected sequence is the same as the number of index elements included in each second sub-sequence, and is the preset number.

[0095] For example, the sample sequence includes four second sub-sequences, and the to-be-detected sequence includes five index elements, and each second sub-sequence includes five index elements. The to-be-detected sequence is separated from the first second sub-sequence by 10080 elements, the to-be-detected sequence is separated from the second second sub-sequence by 20160 elements, the to-be-detected sequence is separated from the third second sub-sequence by 30240 elements, and the to-be-detected sequence is separated from the fourth second sub-sequence by 40320 elements. The serial numbers of each index element in the to-be-detected sequence are determined by the order of generation time, for example, the to-be-detected sequence includes x1, x2, x3, x4, and x5, the serial number of x1 is 1, the serial number of x2 is 2, the serial number of x3 is 3, the serial number of x4 is 4, and the serial number of x5 is 5.

[0096] The serial numbers of each index element in each second sub-sequence are determined by the order of generation time. For example, a second sub-sequence includes x 201 ,x 202 ,x 203 ,x 204 ,x 205 , and a second sub-sequence includes x 201 , x 202 , x 203 , x 204 , and x 205 .

[0097] The same element set of the bth index element in the to-be-detected sequence is determined, which can include the same element corresponding to the bth index element in the to-be-detected sequence determined from each second sub-sequence. The same element corresponding to the bth index element in the to-be-detected sequence in each second sub-sequence is the bth index element in each second sub-sequence.

[0098] For example, the to-be-detected sequence includes: x1, x2, x3, x4, and x5, the sample sequence includes a second sub-sequence 1 and a second sub-sequence 2, the second sub-sequence 1 includes: x 201 ,x 202 ,x 203 ,x 204 ,x 205 , and the second sub-sequence 2 includes: x 401 ,x 402 ,x403 x 404 x 405 x1, x 201 x2, x 401 x3, x 201 x4, x 401 x5, x 202 x6, x 402 x7, x 202 x8, x 402 x9, x 203 x10, x 403 x11, x 203 x12, x 403 x13, x 204 x14, x 404 x15, x 204 x16, x 404 x17, x 205 x18, x 405 x19, x 205 x20, x 405 x21, x

[0099] Optionally, based on the paragenic element set of each index element in the to-be-detected sequence, the abnormal parameter of the sample sequence is generated, including: based on each paragenic element in the paragenic element set of each index element in the to-be-detected sequence and each index element in the to-be-detected sequence, determining a ring ratio value of each index element in the to-be-detected sequence; summing the ring ratio value of each index element in the to-be-detected sequence to obtain the abnormal parameter of the sample sequence.

[0100] Based on each paragenic element in the paragenic element set of each index element in the to-be-detected sequence and each index element in the to-be-detected sequence, the ring ratio value of each index element in the to-be-detected sequence can be calculated, that is, the ratio between each index element in the to-be-detected sequence and each paragenic element in the paragenic element set of the index element is calculated to obtain a plurality of homologous ratio values of the index element, the number of the plurality of homologous ratio values is equal to the number of paragenic elements in the paragenic element set, and each homologous ratio value corresponds to a paragenic element; then, the plurality of homologous ratio values of the index element are averaged to obtain the average value of the plurality of homologous ratio values of the index element, and the average value is determined as the ring ratio value of the index element. After calculating the ring ratio value of each index element in the to-be-detected sequence, the sum of each ring ratio value can be calculated to obtain the abnormal parameter of the sample sequence.

[0101] The link ratio value can be used to determine whether the business index of the periodic index type is abnormal. By summing up the link ratio values of each index element in the to-be-detected sequence, the influence of the calculation error of the link ratio value of the individual index element on the abnormal parameter can be reduced. Optionally, the to-be-detected sequence includes N index elements; the number of the plurality of second sub-sequences is M; the to-be-detected sequence includes an index element with an index number i; the link ratio value of the index element with the index number i is determined based on each homologous element in the homologous element set corresponding to the index element with the index number i and the index element with the index number i, i is greater than 0 and less than or equal to N, comprising: calculating the ratio between the index element with the index number i in the to-be-detected sequence and each homologous element in the homologous element set corresponding to the index element with the index number i, to obtain M homologous ratio values; M is a positive integer; and performing an average operation on the M homologous ratio values to obtain the link ratio value of the index element with the index number i in the to-be-detected sequence.

[0102] The number of the plurality of second sub-sequences is M, and the homologous element set corresponding to each index element in the to-be-detected sequence includes M homologous elements. M is a positive integer.

[0103] The ratio between the index element with the index number i in the to-be-detected sequence and each homologous element in the homologous element set corresponding to the index element with the index number i is calculated, to obtain M homologous ratio values, for example, the ratio between the index element x1 with the index number 1 in the to-be-detected sequence and the index element x 201 with the index number 1 in the first second sub-sequence is calculated to obtain the first homologous ratio value x1 / x 201 The ratio between the index element x1 with the index number 1 in the to-be-detected sequence and the index element x z with the index number 1 in the Mth second sub-sequence is calculated to obtain the Mth homologous ratio value x1 / x z Z is a natural number, and the value of Z can be determined by the value of M, for example, when M is 2, Z=M*200+1=401, so the second homologous ratio value is x1 / x 401 .

[0104] The average operation on the M homologous ratio values can be calculating the average value of the M homologous ratio values, and the link ratio value of the index element with the index number i in the to-be-detected sequence can be obtained.

[0105] Optionally, the abnormal parameter of the sample sequence is generated according to the index type, the to-be-detected sequence and the sample sequence, comprising: if the index type is a volatility index, calculating the standard deviation of the sample sequence and the average value of the sample sequence based on the values of the plurality of index elements in the sample sequence; and generating the abnormal parameter of the sample sequence according to the standard deviation of the sample sequence, the average value of the sample sequence and each index element in the to-be-detected sequence.

[0106] If the index type is volatility index, a standard deviation of the sample sequence is calculated according to the element values of the index elements in the sample sequence, and a mean value of the sample sequence is calculated.

[0107] Further, according to the standard deviation of the sample sequence and the mean value of the sample sequence, it can be determined whether each index element in the to-be-detected sequence conforms to a normal distribution trend generated by the sample sequence. If yes, it indicates that the business index does not exist abnormality in the index element closest to the current time point, i.e., the business index at the current time point is normal. If no, it indicates that the business index exists abnormality.

[0108] In specific implementation, since the numerical magnitude of each business index is different, for example, the numerical magnitude of the pass rate is in the order of 100, and the time length index is in the order of 100,000 (in millisecond unit), before calculating the standard deviation of the sample sequence and the mean value of the sample sequence, the sample sequence can be normalized. For example, the Z-score standardization method can be used to normalize the sample sequence.

[0109] The Z-score standardization can convert two or more groups of data into Z-Score scores without units through a calculation formula

(element value-mean value) / variance

[0110] Optionally, according to the standard deviation of the sample sequence, the mean value of the sample sequence, and each index element in the to-be-detected sequence, an abnormality parameter of the sample sequence is generated, including: calculating a first ratio corresponding to each index element in the to-be-detected sequence based on the mean difference between each index element in the to-be-detected sequence and the sample sequence and the standard deviation of the sample sequence; and performing an average operation on the first ratio corresponding to each index element in the to-be-detected sequence to obtain the abnormality parameter of the sample sequence.

[0111] In specific implementation, a first difference value corresponding to each index element is obtained by performing a difference operation on each index element in the to-be-detected sequence and the mean value of the sample sequence; a first ratio corresponding to each index element is obtained by calculating the ratio of the absolute value of the first difference value corresponding to each index element and the standard deviation of the sample sequence. The first ratio corresponding to each index element in the to-be-detected sequence is averaged to obtain the abnormality parameter of the sample sequence.

[0112] Optionally, the to-be-detected sequence comprises N index elements; a first ratio corresponding to an index element with a sequence number j in the to-be-detected sequence is calculated based on an average difference between the index element with the sequence number j in the to-be-detected sequence and the sample sequence and a standard deviation of the sample sequence, comprising: performing a difference operation on an average value of the index element with the sequence number j in the to-be-detected sequence and the sample sequence to obtain a first difference value corresponding to the index element with the sequence number j; j is greater than 0 and less than or equal to N; and calculating a ratio of an absolute value of the first difference value corresponding to the index element with the sequence number j and the standard deviation of the sample sequence to obtain the first ratio corresponding to the index element with the sequence number j.

[0113] For example, a difference between the first index element in the to-be-detected sequence and the average value of the sample sequence is obtained to obtain a first difference value corresponding to the first index element, the absolute value of the first difference value corresponding to the first index element is calculated, and then a ratio of the absolute value and the standard deviation of the sample sequence is calculated to obtain a first ratio corresponding to the first index element. The first ratio of the second index element in the to-be-detected sequence is obtained by using the foregoing method, and the first ratio of the Nth index element in the to-be-detected sequence is obtained by using the foregoing method. The average value of the N first ratios is obtained to obtain the abnormal parameter of the sample sequence. The abnormal parameter can be used to reflect the abnormal degree of the business index with the index type being the fluctuation index.

[0114] By analyzing the data anomaly of the business index through the algorithm, the manual intervention can be reduced. The abnormal monitoring device of the business index analyzes whether the current latest element index is abnormal every minute. When a fault occurs, the monitoring staff can obtain the index abnormal data in time to determine the fault influence range.

[0115] Optionally, the abnormal monitoring result of the to-be-detected business is output based on the abnormal parameter of the sample sequence, comprising: determining an abnormal level to which the to-be-detected business index belongs according to a comparison result of the abnormal parameter and a preset parameter threshold; and displaying the to-be-detected business index according to an alarm color corresponding to the abnormal level.

[0116] The abnormal level to which the to-be-detected business index belongs is determined according to a comparison result of the abnormal parameter and a preset parameter threshold; and the to-be-detected business index is displayed according to an alarm color corresponding to the abnormal level.

[0117] In specific implementation, the absolute value of the abnormal parameter can be calculated, and then the abnormal level to which the to-be-detected business index belongs is determined according to a comparison result of the absolute value of the abnormal parameter and one or more preset threshold values.

[0118] In an embodiment, each abnormality level can be preconfigured with a corresponding alarm color. After determining the abnormality level to which the business index to be monitored belongs, the business index to be monitored can be displayed in the alarm color corresponding to the abnormality level, for example, the background color of the area in the index monitoring page for displaying the business index of the business to be monitored is the alarm color corresponding to the abnormality level.

[0119] For example, when the absolute value of the abnormality parameter is less than 3, it can be determined that the abnormality level is level 1, and the business index of the business to be monitored on the index monitoring page is marked in blue; when the absolute value of the abnormality parameter is greater than or equal to 3 and less than 6, it can be determined that the abnormality level is level 2, and the business index of the business to be monitored on the index monitoring page is marked in yellow; and when the absolute value of the abnormality parameter is greater than 6, it can be determined that the abnormality level is level 3, and the business index of the business to be monitored on the index monitoring page is marked in red.

[0120] Further, when the plurality of business indexes of the business to be monitored are monitored by the abnormality monitoring method of the business index provided in the embodiments of the present application, and at least one business index fails, the background colors of the areas corresponding to each business index on the index monitoring page are different, which can intuitively present the influence range of the current failure on the business to be monitored in different dimensions to the monitoring staff, saving time and having a striking visual effect.

[0121] In some other embodiments, each abnormality level can be preconfigured with a display mode. In each display mode, the area in the index monitoring page for displaying the corresponding business index can present a background color, or a flashing display effect, or other preconfigured display effects.

[0122] For example, when the absolute value of the abnormality parameter is less than 3, it can be determined that the abnormality level is level 1, and the area of the business index of the business to be monitored on the index monitoring page can present blue; when the absolute value of the abnormality parameter is greater than or equal to 3 and less than 6, it can be determined that the abnormality level is level 2, and the area of the business index of the business to be monitored on the index monitoring page can present a light flashing effect; and when the absolute value of the abnormality parameter is greater than 6, it can be determined that the abnormality level is level 3, and the area of the business index of the business to be monitored on the index monitoring page can play an alarm animation.

[0123] Further, when the plurality of service indexes of the to-be-monitored service are monitored by the service index abnormality monitoring method provided in the embodiments of the present application, and at least one service index fails, the display effects of the areas corresponding to the respective service indexes on the index monitoring page are different, which can intuitively present the influence range of the current failure on the to-be-monitored service in different dimensions to the monitoring staff, saving time and having a striking visual effect. In addition, the accurate influence range of the failure on the service indexes in different dimensions is intuitively presented, which is conducive to determining the repair sequence, for example, preferentially processing the maintenance work of the service index with a higher abnormality level. In addition, after obtaining the abnormality level to which the to-be-monitored service index belongs, an alarm rule can also be pre-configured, and if it is determined that the alarm rule is triggered according to the abnormality level, alarm information corresponding to the abnormality level is generated to prompt the monitoring staff of the abnormality of the corresponding service index.

[0124] In addition, the service index abnormality monitoring method provided in the embodiments of the present application can be applied not only to the abnormality monitoring scene, but also to the business operation analysis scene. In the business operation analysis scene, the service index abnormality monitoring method can further include the following steps: displaying one or more of the following parameters of each service index in the plurality of service indexes on the index analysis page: the to-be-detected sequence, the average value of the element values of the plurality of index elements included in the to-be-detected sequence, the sum of the ratio values of each index element in the to-be-detected sequence, and the like.

[0125] In another embodiment, the sample sequence can be labeled to generate sample data, and the One-Class SVM model is trained based on the sample data, so that the trained One-Class SVM model can be used for abnormality detection processing of the service indexes of the to-be-monitored service, to obtain the abnormality parameters of the service indexes, so as to determine whether the service indexes are abnormal.

[0126] In the embodiments of the present application, the One-Class SVM model is trained based on the sample data, so that the trained One-Class SVM model can be used for abnormality detection processing of the service indexes of the to-be-monitored service, to obtain the abnormality parameters of the service indexes, so as to determine whether the service indexes are abnormal. Figure 1In an embodiment of the anomaly monitoring method for business metrics shown, firstly, a set of metric elements corresponding to the business metrics of the business to be monitored is obtained; the set of metric elements includes multiple metric elements arranged sequentially according to their generation time; the set of metric elements is generated based on the business metric generation rules and the embedded data of the business to be monitored; secondly, the set of metric elements is divided into a sequence to be detected and a sample sequence; the sequence to be detected includes a preset number of metric elements whose generation time is close to the current time point; the sample sequence includes other metric elements in the set of metric elements that are not in the sequence to be detected; the generation time of the first metric element in the sample sequence is after the generation time of the last metric element in the sequence to be detected; then, according to a first time period, the sample sequence is divided into multiple first subsequences; next, processing is performed based on the multiple first subsequences to determine the metric type, thereby obtaining the metric type of the sample sequence; finally, based on the metric type, the sequence to be detected, and the sample sequence, anomaly parameters of the sample sequence are generated, and the anomaly monitoring results of the business to be monitored are output based on the anomaly parameters of the sample sequence. Therefore, after dividing the set of indicator elements corresponding to the business indicators of the business to be monitored into the detection sequence and the sample sequence, and further dividing the sample sequence into multiple first subsequences, the indicator type of the business indicators of the business to be monitored can be determined by the characteristics of the first subsequences. Thus, in the case of different indicator types, abnormal parameters corresponding to the sample sequence can be generated by combining the indicator types. By determining the indicator types and generating abnormal parameters of the sample sequence based on the indicator types, the detection sequence, and the sample sequence, each indicator type can correspond to a different method of generating abnormal parameters. This significantly reduces the configuration workload of the business indicator monitoring process, eliminates the need to configure a dedicated monitoring process for each business indicator, reduces the monitoring workload for each business indicator of the business to be monitored, and ensures that the generation method of business indicators of the same indicator type is the same, which is beneficial for horizontal comparison of the abnormal situations of various business indicators.

[0127] Based on the same technical concept as the aforementioned method embodiments, this application also provides an embodiment of another method for anomaly monitoring of business indicators. Figure 2 This is a schematic diagram illustrating the framework of an anomaly monitoring method for business metrics provided in an embodiment of this application.

[0128] See Figure 2 The distributed messaging system 201 reads event tracking data from event tracking logs of multiple business scenarios. These business scenarios include Business Scenario 1, Business Scenario 2, and Business Scenario 3. After obtaining the event tracking data, it calculates metrics based on the data to obtain the business metric values ​​for the business to be monitored, and stores them in the search server 202. The distributed messaging system 201 can be a Kafka system.

[0129] The anomaly monitoring device for business metrics retrieves a set of metric elements from the business metric values ​​of the business to be monitored stored in the search server 202. The search server 202 can be the aforementioned Elasticsearch (ES). This step is equivalent to... Figure 1 Step S102 in the embodiment.

[0130] After obtaining the indicator element set, the indicator element set is divided into the sequence to be detected and the sample sequence. This step is equivalent to... Figure 1 Step S104 in the embodiment.

[0131] like Figure 2 As shown, algorithmic analysis is performed on the sequence to be detected and the sample sequence to calculate the abnormal parameters of the sequence to be detected. Specifically, this process involves dividing the sample sequence into multiple first sub-sequences according to a first time period; determining the indicator types based on these first sub-sequences to obtain the indicator types of the sample sequence; and generating the abnormal parameters of the sample sequence based on the indicator types, the sequence to be detected, and the sample sequence. After generating the abnormal parameters of the sample sequence, the abnormal monitoring results of the business to be detected can be output based on these parameters. Furthermore, based on the abnormality level corresponding to the abnormal monitoring results of each business to be detected, each business to be detected is displayed separately on the indicator monitoring page 203. The above steps are equivalent to... Figure 1 Steps S106-S110 in the embodiment can be referred to Figure 1 The corresponding explanatory section.

[0132] Since the technical concept is the same, the description in this embodiment is relatively simple. For the relevant parts, please refer to the corresponding descriptions of the method embodiments provided above.

[0133] In the above embodiments, an anomaly monitoring method for business indicators is provided, and correspondingly, an anomaly monitoring device for business indicators is also provided, which will be described below with reference to the accompanying drawings.

[0134] Figure 3 This is a schematic diagram of an anomaly monitoring device for business indicators provided in an embodiment of this application.

[0135] This embodiment provides an anomaly monitoring device 300 for business indicators, including:

[0136] The acquisition unit 301 is used to acquire the indicator element set corresponding to the business indicators of the business to be monitored; the indicator element set includes multiple indicator elements arranged in order of generation time; the indicator element set is generated based on the business indicator generation rules and the embedded data of the business to be monitored.

[0137] The first dividing unit 302 is configured to divide the set of index elements into a to-be-detected sequence and a sample sequence; the to-be-detected sequence includes a preset number of index elements generated at a time close to a current time point; the sample sequence includes other index elements in the set of index elements except the to-be-detected sequence; a first index element in the sample sequence is generated after a last index element in the to-be-detected sequence;

[0138] The second dividing unit 303 is configured to divide the sample sequence into a plurality of first sub-sequences according to a first time period.

[0139] The processing unit 304 is configured to perform processing to determine the index category based on the plurality of first sub-sequences, to obtain the index category of the sample sequence.

[0140] The output unit 305 is configured to generate an abnormal parameter of the sample sequence according to the index category, the to-be-detected sequence and the sample sequence, and output an abnormal monitoring result of the to-be-detected service based on the abnormal parameter of the sample sequence.

[0141] Optionally, the index category of the sample sequence includes one of a periodic index and a volatility index; when the processing unit 304 performs processing to determine the index category based on the plurality of first sub-sequences to obtain the index category of the sample sequence, the following steps are performed:

[0142] According to a difference between each adjacent two index elements in each first sub-sequence, a difference sequence corresponding to each first sub-sequence is generated.

[0143] A standard deviation of the difference sequence corresponding to each first sub-sequence is calculated.

[0144] A standard deviation parameter of the sample sequence is determined according to the standard deviation of the difference sequence corresponding to each first sub-sequence.

[0145] If the standard deviation parameter is greater than a preset threshold, it is determined that the index category of the sample sequence is a periodic index.

[0146] If the standard deviation is less than or equal to the preset threshold, it is determined that the index category of the sample sequence is a volatility index.

[0147] Optionally, when the output unit 305 generates the abnormal parameter of the sample sequence according to the index category, the to-be-detected sequence and the sample sequence, the following steps are performed:

[0148] If the index category is the periodic index, interval sampling processing is performed on the sample sequence according to a second time period, to obtain a plurality of second sub-sequences arranged in order of generation time; each second sub-sequence includes a preset number of index elements.

[0149] determining a homologous element set of each index element in the to-be-detected sequence, wherein the homologous element set of any index element comprises homologous elements corresponding to the any index element determined from each second sub-sequence, and the homologous elements corresponding to the any index element in any second sub-sequence are index elements with the same sequence number as the any index element in the any second sub-sequence; the sequence number of each index element in each second sub-sequence and the sequence number of each index element in the to-be-detected sequence are determined according to the generated time sequence;

[0150] generating the abnormal parameter of the sample sequence based on the homologous element set of each index element in the to-be-detected sequence.

[0151] Optionally, the output unit 305 performs the following steps when generating the abnormal parameter of the sample sequence based on the homologous element set of each index element in the to-be-detected sequence.

[0152] determining a same-period ratio value of each index element in the to-be-detected sequence based on each homologous element in the homologous element set of each index element in the to-be-detected sequence and each index element in the to-be-detected sequence;

[0153] summing the same-period ratio values of each index element in the to-be-detected sequence to obtain the abnormal parameter of the sample sequence.

[0154] Optionally, the to-be-detected sequence comprises N index elements; the number of the plurality of second sub-sequences is M; the to-be-detected sequence comprises an index element with a sequence number i; and the output unit 305 performs the following steps when determining the same-period ratio value of the index element with the sequence number i based on each homologous element in the homologous element set of the index element with the sequence number i and the index element with the sequence number i.

[0155] calculating a ratio between the index element with the sequence number i in the to-be-detected sequence and each homologous element in the homologous element set corresponding to the index element with the sequence number i to obtain M same-period ratio values; M is a positive integer; i is greater than 0 and less than or equal to N;

[0156] performing an averaging operation on the M same-period ratio values to obtain the same-period ratio value of the index element with the sequence number i in the to-be-detected sequence.

[0157] Optionally, the output unit 305 performs the following steps when generating the abnormal parameter of the sample sequence according to the index category, the to-be-detected sequence and the sample sequence.

[0158] if the index category is the volatility index, calculating a standard deviation of the sample sequence and an average value of the sample sequence based on the numerical values of the plurality of index elements in the sample sequence;

[0159] The output unit 305 generates an abnormality parameter of the sample sequence according to a standard deviation of the sample sequence, an average value of the sample sequence, and each index element in the to-be-detected sequence.

[0160] Optionally, when the output unit 305 generates the abnormality parameter of the sample sequence according to the standard deviation of the sample sequence, the average value of the sample sequence, and each index element in the to-be-detected sequence, the output unit 305 performs the following steps:

[0161] The output unit 305 calculates a first ratio corresponding to each index element in the to-be-detected sequence based on the average difference between each index element in the to-be-detected sequence and the sample sequence and the standard deviation of the sample sequence.

[0162] The output unit 305 calculates a first ratio corresponding to each index element in the to-be-detected sequence based on the average difference between each index element in the to-be-detected sequence and the sample sequence and the standard deviation of the sample sequence.

[0163] Optionally, the to-be-detected sequence includes N index elements; the to-be-detected sequence includes an index element with a serial number j; and when the output unit 305 calculates a first ratio corresponding to the index element with the serial number j based on the average difference between the index element with the serial number j in the to-be-detected sequence and the sample sequence and the standard deviation of the sample sequence, the output unit 305 performs the following steps:

[0164] The output unit 305 calculates a first difference value corresponding to the index element with the serial number j by performing a difference operation on the average value of the sample sequence and the index element with the serial number j in the to-be-detected sequence; j is greater than 0 and less than or equal to N.

[0165] The output unit 305 calculates a first ratio corresponding to the index element with the serial number j by calculating a ratio of an absolute value of the first difference value corresponding to the index element with the serial number j and the standard deviation of the sample sequence.

[0166] Optionally, when the output unit 305 outputs an abnormality monitoring result of the to-be-detected service based on the abnormality parameter of the sample sequence, the output unit 305 performs the following steps:

[0167] The output unit 305 determines an abnormality level to which a to-be-monitored service index belongs according to a comparison result of the abnormality parameter and a preset parameter threshold.

[0168] The output unit 305 displays the to-be-monitored service index in an alarm color corresponding to the abnormality level.

[0169] The business index abnormality monitoring device provided in the embodiments of the present application comprises an acquisition unit, a first division unit, a second division unit, a processing unit and an output unit, wherein the acquisition unit is configured to acquire an index element set corresponding to a business index of a to-be-monitored business; the index element set comprises a plurality of index elements arranged in sequence according to generation time; the index element set is generated based on a business index generation rule and trace data of the to-be-monitored business; the first division unit is configured to divide the index element set into a to-be-detected sequence and a sample sequence; the to-be-detected sequence comprises a preset number of index elements with generation time close to a current time point; the sample sequence comprises other index elements in the index element set except the to-be-detected sequence; the generation time of the first index element in the sample sequence is after the generation time of the last index element in the to-be-detected sequence; the second division unit is configured to divide the sample sequence into a plurality of first sub-sequences according to a first time period; the processing unit is configured to perform processing to determine an index type based on the plurality of first sub-sequences, to obtain an index type of the sample sequence; and the output unit is configured to generate an abnormality parameter of the sample sequence according to the index type, the to-be-detected sequence and the sample sequence, and output an abnormality monitoring result of the to-be-detected business based on the abnormality parameter of the sample sequence. After the index element set corresponding to the business index of the to-be-monitored business is divided into the to-be-detected sequence and the sample sequence, and the sample sequence is divided into the plurality of first sub-sequences, the index type of the business index of the to-be-monitored business can be determined through the characteristics of the first sub-sequences, so that the abnormality parameter corresponding to the sample sequence is generated in combination with the index type in the case where the index types are different. Through the processing to determine the index type and the generation of the abnormality parameter of the sample sequence according to the index type, the to-be-detected sequence and the sample sequence, each index type corresponds to a generation mode of an abnormality parameter, the configuration workload of the monitoring process of the business index is greatly reduced, a special monitoring process does not need to be configured for each business index, the monitoring workload of each business index of the to-be-monitored business is reduced, and the generation mode of the business index of the same index type is the same, which is conducive to the horizontal comparison of the abnormality of each business index.

[0170] Corresponding to the above description, based on the same technical concept, the embodiments of the present application further provide a business index abnormality monitoring device for executing the above-provided business index abnormality monitoring method, Figure 4 A structural schematic diagram of a business index abnormality monitoring device provided in the embodiments of the present application.

[0171] As Figure 4As shown, the anomaly monitoring device for business metrics can vary significantly due to differences in configuration or performance. It may include one or more processors 401 and a memory 402, with the memory 402 storing one or more application programs or data. The memory 402 can be temporary or persistent storage. The application programs stored in the memory 402 may include one or more modules (not shown), each module including a series of computer-executable instructions from the anomaly monitoring device. Furthermore, the processor 401 may be configured to communicate with the memory 402, executing the series of computer-executable instructions in the memory 402 on the anomaly monitoring device. The anomaly monitoring device may also include one or more power supplies 403, one or more wired or wireless network interfaces 404, one or more input / output interfaces 405, one or more keyboards 406, etc.

[0172] In one specific embodiment, the anomaly monitoring device for business metrics includes a memory and one or more programs, wherein the one or more programs are stored in the memory, and the one or more programs may include one or more modules, and each module may include a series of computer-executable instructions for the anomaly monitoring device for business metrics, and is configured to be executed by one or more processors. The one or more programs include computer-executable instructions for performing the following:

[0173] Obtain the set of indicator elements corresponding to the business indicators of the business to be monitored; the set of indicator elements includes multiple indicator elements arranged in order of generation time; the set of indicator elements is generated based on the business indicator generation rules and the event tracking data of the business to be monitored.

[0174] The indicator element set is divided into a sequence to be detected and a sample sequence. The sequence to be detected includes a preset number of indicator elements whose generation time is close to the current time point. The sample sequence includes other indicator elements in the indicator element set that are not in the sequence to be detected. The generation time of the first indicator element in the sample sequence is after the generation time of the last indicator element in the sequence to be detected.

[0175] The sample sequence is divided into multiple first subsequences according to the first time period;

[0176] The index types of the sample sequence are obtained by processing multiple first subsequences to determine the index types.

[0177] Based on the indicator type, the sequence to be detected, and the sample sequence, abnormal parameters of the sample sequence are generated, and the abnormal monitoring results of the business to be detected are output based on the abnormal parameters of the sample sequence.

[0178] Corresponding to the above-described method for monitoring anomalies in business metrics, based on the same technical concept, this application also provides a computer-readable storage medium.

[0179] The computer-readable storage medium provided in this embodiment is used to store computer-executable instructions, which, when executed by a processor, implement the following process:

[0180] Obtain the set of indicator elements corresponding to the business indicators of the business to be monitored; the set of indicator elements includes multiple indicator elements arranged in order of generation time; the set of indicator elements is generated based on the business indicator generation rules and the event tracking data of the business to be monitored.

[0181] The indicator element set is divided into a sequence to be detected and a sample sequence. The sequence to be detected includes a preset number of indicator elements whose generation time is close to the current time point. The sample sequence includes other indicator elements in the indicator element set that are not in the sequence to be detected. The generation time of the first indicator element in the sample sequence is after the generation time of the last indicator element in the sequence to be detected.

[0182] The sample sequence is divided into multiple first subsequences according to the first time period;

[0183] The index types of the sample sequence are obtained by processing multiple first subsequences to determine the index types.

[0184] Based on the indicator type, the sequence to be detected, and the sample sequence, abnormal parameters of the sample sequence are generated, and the abnormal monitoring results of the business to be detected are output based on the abnormal parameters of the sample sequence.

[0185] It should be noted that the embodiments of computer-readable storage media in this specification and the embodiments of the abnormal monitoring method of business indicators in this specification are based on the same inventive concept. Therefore, the specific implementation of this embodiment can be referred to the implementation of the corresponding method described above, and the repeated parts will not be described again.

[0186] The foregoing has described specific embodiments of this specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims may be performed in a different order than that shown in the embodiments and may still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require the specific or sequential order shown to achieve the desired result. In some embodiments, multitasking and parallel processing are possible or may be advantageous.

[0187] Those skilled in the art will appreciate that embodiments of the application can be supplied as a method, a system, or a computer program product. Accordingly, embodiments of the application can take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the specification can take the form of a computer program product on one or more computer-readable storage media (including, but not limited to, disk storage, CD-ROMs, optical storage devices, etc.) embodying computer readable instructions.

[0188] The specification is presented with reference to flow diagrams and / or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the application. It will be understood that each block of the flow diagrams and / or block diagrams, and combinations of blocks in the flow diagrams and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processing device, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flow diagrams and / or block diagrams block or blocks. Figure 1 one or more functions specified in the flow diagram and / or block diagram block or blocks. Figure 1 one or more functions specified in the flow diagram and / or block diagram block or blocks.

[0189] These computer program instructions can also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instructions which implement the flow diagram and / or block diagram block or blocks. Figure 1 one or more functions specified in the flow diagram and / or block diagram block or blocks. Figure 1 one or more functions specified in the flow diagram and / or block diagram block or blocks.

[0190] These computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the flow diagram and / or block diagram block or blocks. Figure 1 one or more functions specified in the flow diagram and / or block diagram block or blocks. Figure 1 one or more functions specified in the flow diagram and / or block diagram block or blocks.

[0191] In one typical configuration, a computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0192] The memory can include non-persistent memory and / or persistent memory, such as flash memory, read-only memory (ROM), and / or random access memory (RAM), among others. The memory is an example of computer-readable media.

[0193] Computer-readable media includes permanent and non-permanent, movable and non-movable media that can be implemented by any method or technology to store information. The information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassette, magnetic disk storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information accessible to a computing device. According to the definition herein, computer-readable media does not include transitory media such as modulated data signals and carriers.

[0194] It should also be noted that the terms "comprising", "containing", or any other variant thereof are intended to cover non-exclusive inclusion, so that processes, methods, articles or devices that include a series of elements not only include those elements, but also include other elements not explicitly listed or inherent to such processes, methods, articles or devices. Without more limitations, the element defined by the statement "comprising a" does not exclude the presence of additional identical elements in the process, method, article or device comprising the element.

[0195] Embodiments of the present application can be described in the general context of computer-executable instructions, such as program modules, being executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, and the like, which perform particular tasks or implement particular abstract data types. One or more embodiments of the present specification can also be practiced in a distributed computing environment, in which tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules can be located in local and remote computer storage media, including storage devices.

[0196] Each embodiment in the specification is described in a progressive manner, and the same or similar parts between each embodiment can be referred to each other. Each embodiment focuses on the difference from other embodiments. In particular, for system embodiments, since they are basically similar to method embodiments, the description is relatively simple, and the relevant parts can be referred to the part of the method embodiment.

[0197] The above merely provides the example of the present document and is not intended to limit the present document. For those skilled in the art, the present document can have various modifications and changes. Any modification, equivalent replacement, improvement, etc. within the spirit and principle of the present document shall be included in the scope of claims of the present document.

Claims

1. A method for anomaly monitoring of business indicators, characterized in that, include: Obtain the set of indicator elements corresponding to the business indicators of the business to be monitored; the set of indicator elements includes multiple indicator elements arranged in order of generation time. The set of indicator elements is generated based on the business indicator generation rules and the data points of the business to be monitored. The set of indicator elements is divided into a sequence to be detected and a sample sequence. The sequence to be detected includes a preset number of indicator elements whose generation time is close to the current time point. The sample sequence includes other indicator elements in the set of indicator elements besides the sequence to be detected. The generation time of the first indicator element in the sample sequence is after the generation time of the last indicator element in the sequence to be detected. According to the first time period, the sample sequence is divided into multiple first subsequences; Based on the multiple first subsequences, the index types are determined to obtain the index types of the sample sequence; Based on the indicator type, the sequence to be detected, and the sample sequence, anomaly parameters of the sample sequence are generated, and anomaly monitoring results for the service to be monitored are output based on the anomaly parameters of the sample sequence.

2. The method according to claim 1, characterized in that, The sample sequence's indicator types include either periodic indicators or volatility indicators; the process of determining the indicator types based on the multiple first sub-sequences to obtain the indicator types of the sample sequence includes: Generate a difference sequence for each first subsequence based on the difference between every two adjacent index elements in each first subsequence. Calculate the standard deviation of the difference sequence corresponding to each first subsequence; The standard deviation parameter of the sample sequence is determined based on the standard deviation of the difference sequence corresponding to each first subsequence; If the standard deviation parameter is greater than a preset threshold, then the index type of the sample sequence is determined to be the periodic index; If the standard deviation is less than or equal to the preset threshold, then the index type of the sample sequence is determined to be the volatility index.

3. The method according to claim 2, characterized in that, The step of generating abnormal parameters for the sample sequence based on the indicator type, the sequence to be detected, and the sample sequence includes: If the index type is the periodic index, then the sample sequence is sampled at intervals according to the second time period to obtain multiple second subsequences arranged in order of generation time; the number of index elements included in each second subsequence is the preset number; A set of corresponding elements for each indicator element in the sequence to be detected is determined. The set of corresponding elements for any indicator element includes corresponding elements determined from each second subsequence that correspond to the indicator element. The corresponding element in any second subsequence that corresponds to the indicator element refers to the indicator element in any second subsequence with the same index as the indicator element. The index of each indicator element in each second subsequence and the index of each indicator element in the sequence to be detected are both determined according to the generation time order. Based on the set of corresponding elements of each indicator element in the sequence to be detected, the abnormal parameters of the sample sequence are generated.

4. The method according to claim 3, characterized in that, The generation of abnormal parameters for the sample sequence based on the set of corresponding elements for each indicator element in the sequence to be detected includes: Based on each co-occurring element in the set of co-occurring elements of each indicator element in the sequence to be detected, and each indicator element in the sequence to be detected, determine the month-on-month ratio value of each indicator element in the sequence to be detected. The abnormal parameters of the sample sequence are obtained by summing the month-on-month ratio values ​​of each indicator element in the sequence to be detected.

5. The method according to claim 4, characterized in that, The sequence to be detected includes N indicator elements; the number of the plurality of second subsequences is M; the sequence to be detected includes an indicator element with index i, and based on each co-occurrence element in the set of co-occurrence elements of the indicator element with index i and the indicator element with index i, the cycle ratio value of the indicator element with index i is determined, including: Calculate the ratio between the index element with index number i in the sequence to be detected and each corresponding element in the set of corresponding elements with index element number i, to obtain M year-on-year ratio values; M is a positive integer; i is greater than 0 and less than or equal to N; The month-on-month ratio of the M year-on-year ratio values ​​is obtained by averaging the M year-on-year ratio values.

6. The method according to claim 2, characterized in that, The step of generating abnormal parameters for the sample sequence based on the indicator type, the sequence to be detected, and the sample sequence includes: If the indicator type is the volatility indicator, then the standard deviation and the average value of the sample sequence are calculated based on the values ​​of multiple indicator elements in the sample sequence. Anomaly parameters for the sample sequence are generated based on the standard deviation of the sample sequence, the mean of the sample sequence, and each indicator element in the sequence to be detected.

7. The method according to claim 6, characterized in that, The step of generating abnormal parameters for the sample sequence based on the standard deviation of the sample sequence, the mean of the sample sequence, and each indicator element in the sequence to be detected includes: Based on the average difference between each indicator element in the sequence to be detected and the sample sequence and the standard deviation of the sample sequence, calculate the first ratio corresponding to each indicator element in the sequence to be detected; The average of the first ratio corresponding to each indicator element in the sequence to be detected is calculated to obtain the abnormal parameters of the sample sequence.

8. The method according to claim 7, characterized in that, The sequence to be detected includes N indicator elements; the sequence to be detected includes an indicator element with index j. Based on the average difference between the indicator element with index j in the sequence to be detected and the sample sequence, and the standard deviation of the sample sequence, a first ratio corresponding to the indicator element with index j is calculated, including: The difference between the index element with index j in the sequence to be detected and the average value of the sample sequence is calculated to obtain the first difference value corresponding to the index element with index j; j is greater than 0 and less than or equal to N; The ratio of the absolute value of the first difference corresponding to the index element with index number j to the standard deviation of the sample sequence is calculated to obtain the first ratio corresponding to the index element with index number j.

9. The method according to claim 1, characterized in that, The abnormal monitoring results of the service to be detected, based on the abnormal parameters of the sample sequence, include: Based on the comparison results between the abnormal parameters and the preset parameter thresholds, the abnormality level of the business indicator to be monitored is determined. The monitored business metrics are displayed according to the alarm color corresponding to the anomaly level.

10. An anomaly monitoring device for business indicators, characterized in that, The device includes: The acquisition unit is used to acquire the set of indicator elements corresponding to the business indicators of the business to be monitored; the set of indicator elements includes multiple indicator elements arranged in order of generation time; the set of indicator elements is generated based on the business indicator generation rules and the embedded data of the business to be monitored. The first partitioning unit is used to partition the indicator element set into a sequence to be detected and a sample sequence; the sequence to be detected includes a preset number of indicator elements whose generation time is close to the current time point; the sample sequence includes other indicator elements in the indicator element set besides the sequence to be detected; the generation time of the first indicator element in the sample sequence is after the generation time of the last indicator element in the sequence to be detected. The second partitioning unit is used to divide the sample sequence into multiple first subsequences according to the first time period; The processing unit is used to determine the index type based on the plurality of first sub-sequences to obtain the index type of the sample sequence; The output unit is used to generate abnormal parameters of the sample sequence according to the indicator type, the sequence to be detected and the sample sequence, and output the abnormal monitoring results of the service to be monitored based on the abnormal parameters of the sample sequence.

11. An anomaly monitoring device for business indicators, characterized in that, The device includes: A processor; and a memory configured to store computer-executable instructions, which, when executed, cause the processor to perform an anomaly monitoring method for business metrics as described in any one of claims 1-9.

12. A computer-readable storage medium, characterized in that, The computer-readable storage medium is used to store computer-executable instructions, which, when executed by a processor, implement the abnormal monitoring method for business indicators as described in any one of claims 1-9.

Images