Application system fault detection method, device, equipment and readable storage medium

Abstract

The embodiments of the present application provide a fault detection method, apparatus, device, and readable storage medium for an application system. When a fault occurs in the application system, the method determines the first operation and maintenance object corresponding to the fault and its first indicator; obtains multiple second operation and maintenance objects and their corresponding second indicators that have an association relationship with the first operation and maintenance object; based on a target association analysis algorithm, screens out indicators that do not have an association relationship with the first indicator from each second indicator; selects one indicator from the screened second indicators as a target indicator; establishes a knowledge graph based on the first operation and maintenance object, the first indicator, the second operation and maintenance object, and the target indicator; calculates the fault similarity between each second operation and maintenance object and the first operation and maintenance object in the knowledge graph and performs pruning; calculates the anomaly scores of multiple fault chains in the pruned knowledge graph; and determines the cause of the fault based on the anomaly scores of the multiple fault chains. The embodiments of the present application can improve the accuracy of fault detection in the application system.

Description

Technical Field

[0001] The present application belongs to the field of fault detection technology, and in particular relates to a fault detection method, apparatus, device, and readable storage medium for an application system. Background Art

[0002] The rapid development of the information age has fostered the emergence of a wide variety of application systems. The advancement of digitalization and intelligence has also placed increasingly stringent demands on these systems. People expect application system pages to be accessible, smooth, and interactive. Therefore, timely detection and location of application system failures are crucial for efficient and effective handling, minimizing their impact on user experience.

[0003] However, the inventors of the present application have discovered that current abnormal indicator detection only monitors core KPI indicators or monitors all indicators while ignoring the correlation between indicators, resulting in low accuracy of the final fault detection results. Summary of the Invention

[0004] The embodiments of the present application provide a method, apparatus, device, and readable storage medium for fault detection of an application system, which can solve the problem of low accuracy of fault detection results of the application system.

[0005] In a first aspect, an embodiment of the present application provides a fault detection method for an application system, and the fault detection method for an application system includes: in the event of a fault in the application system, determining a first operation and maintenance object corresponding to the fault and a first indicator of the first operation and maintenance object; obtaining multiple second operation and maintenance objects that have an association relationship with the first operation and maintenance object and second indicators corresponding to each of the multiple second operation and maintenance objects; based on a target association analysis algorithm, filtering out indicators that have no association relationship with the first indicator from each second indicator to obtain the second indicators after screening of each second operation and maintenance object; selecting an indicator from the second indicators after screening of the second operation and maintenance object as the target indicator of the second operation and maintenance object; establishing a knowledge graph based on the first operation and maintenance object, the first indicator, the second operation and maintenance object and the target indicator, the knowledge graph including multiple fault chains; calculating the fault similarity between each second operation and maintenance object and the first operation and maintenance object in the knowledge graph, and pruning the fault chain where the second operation and maintenance object whose fault similarity is less than a first preset threshold is located; calculating the anomaly scores of the multiple fault chains in the pruned knowledge graph; and determining the cause of the fault based on the anomaly scores of the multiple fault chains.

[0006] According to the implementation method of the first aspect of the present application, multiple second operation and maintenance objects that are associated with the first operation and maintenance object and the second indicators corresponding to each of the multiple second operation and maintenance objects are obtained, specifically including: based on the target anomaly detection algorithm, calculating whether multiple indicators of the second operation and maintenance object that are associated with the first operation and maintenance object have anomalies; based on the abnormal indicators of the second operation and maintenance object, constructing an abnormal indicator set to obtain the second indicators corresponding to the second operation and maintenance object.

[0007] According to any of the aforementioned implementations of the first aspect of the present application, based on the target association analysis algorithm, the indicators in each second indicator that have no correlation with the first indicator are screened out to obtain the second indicators after screening of each second operation and maintenance object, specifically including: based on the target association analysis algorithm, calculating the support and confidence between each indicator in the second indicator and the first indicator; screening out the indicators in the second indicator whose support is less than the second preset threshold or whose confidence is less than the third preset threshold, to obtain the screened second indicators.

[0008] According to any of the aforementioned implementations of the first aspect of the present application, an indicator is selected from the second indicators after screening the second operation and maintenance object as the target indicator of the second operation and maintenance object, specifically including: for each second operation and maintenance object, based on the target local outlier factor detection method, the abnormality degree of each indicator in the second indicators after screening the second operation and maintenance object is calculated, and the indicator with the largest abnormality degree is used as the target indicator of the second operation and maintenance object.

[0009] According to any of the aforementioned implementations of the first aspect of the present application, a knowledge graph is established based on the first operation and maintenance object, the first indicator, the second operation and maintenance object and the target indicator, specifically including: calculating the conditional probability of failure of the second operation and maintenance object based on historical monitoring data, and using the conditional probability as the weight value of the link relationship between the first operation and maintenance object and the second operation and maintenance object; establishing a triple of the first operation and maintenance object, the second operation and maintenance object and the link relationship between the first operation and maintenance object and the second operation and maintenance object, and using the first indicator as the attribute of the node where the first operation and maintenance object is located, and using the target indicator as the attribute of the node where the second operation and maintenance object is located; and drawing a knowledge graph containing the triple.

[0010] According to any of the aforementioned implementations of the first aspect of the present application, the fault similarity between each second operation and maintenance object and the first operation and maintenance object in the knowledge graph is calculated, specifically including: for the fault chain in which each second operation and maintenance object is located, the duration of the fault chain is used as the abnormal time window of the fault chain; within the abnormal time window, based on the target weighted moving average algorithm, the characteristics of the first indicator of the first operation and maintenance object are calculated to obtain the first feature vector of the first operation and maintenance object; within the abnormal time window, based on the target weighted moving average algorithm, the characteristics of the second indicator of the second operation and maintenance object are calculated to obtain the second feature vector of the second operation and maintenance object; based on the cosine similarity algorithm, the fault similarity between the first feature vector and the second feature vector is calculated.

[0011] According to any of the aforementioned embodiments of the first aspect of the present application, the anomaly scores of multiple fault chains in the pruned knowledge graph are calculated, specifically including: for each fault chain, calculating the anomaly probability of each node on the fault chain within a preset time range; calculating the anomaly score of each node on the fault chain based on the indicator type, anomaly start time, anomaly duration and anomaly probability of each node on the fault chain; for any node, calculating the ratio of the number of node failures to the total number of failures that occurred on the previous node under the condition that the previous node fails, to obtain the link weight corresponding to the node; calculating the weighted average of the anomaly score of each node on the fault chain and the link weight corresponding to each node, to obtain the anomaly score of the fault chain.

[0012] According to any of the aforementioned embodiments of the first aspect of the present application, determining the cause of the fault based on the anomaly scores of multiple fault chains specifically includes: arranging the anomaly scores of the multiple fault chains in descending order, and selecting the fault chains corresponding to the top N anomaly scores as candidate causes of the current fault, where N is a positive integer.

[0013] In a second aspect, an embodiment of the present application provides a fault detection device for an application system, and the fault detection device for an application system includes: a first determination module for determining, when a fault occurs in the application system, a first operation and maintenance object corresponding to the fault and a first indicator of the first operation and maintenance object; an acquisition module for acquiring a plurality of second operation and maintenance objects associated with the first operation and maintenance object and second indicators corresponding to each of the plurality of second operation and maintenance objects; a screening module for screening out, based on a target association analysis algorithm, indicators that have no association with the first indicator from each second indicator, and obtaining the second indicators after screening of each second operation and maintenance object; a selection module for selecting the second indicators from the second operation and maintenance objects An indicator is selected from the second indicators after the image screening as the target indicator of the second operation and maintenance object; an establishment module is used to establish a knowledge graph based on the first operation and maintenance object, the first indicator, the second operation and maintenance object and the target indicator, and the knowledge graph includes multiple fault chains; a first calculation module is used to calculate the fault similarity between each second operation and maintenance object and the first operation and maintenance object in the knowledge graph, and prune the fault chain where the second operation and maintenance object whose fault similarity is less than a first preset threshold is located; a second calculation module is used to calculate the anomaly scores of the multiple fault chains in the pruned knowledge graph; a second determination module is used to determine the cause of the fault according to the anomaly scores of the multiple fault chains.

[0014] In a third aspect, an embodiment of the present application provides an electronic device, which includes: a processor, a memory, and a computer program stored in the memory and runnable on the processor. When the computer program is executed by the processor, the steps of the fault detection method of the application system provided in the first aspect are implemented.

[0015] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the fault detection method of the application system provided in the first aspect are implemented.

[0016] The fault detection method, apparatus, device and readable storage medium of the application system of the embodiment of the present application, in the event of a fault in the application system, determine the first operation and maintenance object corresponding to the fault and the first indicator of the first operation and maintenance object; obtain multiple second operation and maintenance objects that have an association relationship with the first operation and maintenance object and the second indicators corresponding to each of the multiple second operation and maintenance objects; based on the target association analysis algorithm, screen out the indicators that have no association relationship with the first indicator in each second indicator to obtain the second indicators after screening of each second operation and maintenance object; select an indicator from the second indicators after screening of the second operation and maintenance object as the target indicator of the second operation and maintenance object; establish a knowledge graph based on the first operation and maintenance object, the first indicator, the second operation and maintenance object and the target indicator, the knowledge graph including multiple fault chains; calculate the fault similarity between each second operation and maintenance object and the first operation and maintenance object in the knowledge graph, and prune the fault chain where the second operation and maintenance object whose fault similarity is less than a first preset threshold is located; calculate the anomaly scores of the multiple fault chains in the pruned knowledge graph; and determine the cause of the fault based on the anomaly scores of the multiple fault chains. The embodiment of the present application fully considers the complexity of the actual application system and the correlation between the indicators of different operation and maintenance objects. First, all the indicator anomalies of each operation and maintenance object are calculated, and the abnormal indicators that are not related to the current fault are filtered out through the correlation analysis algorithm. At the same time, the indicators of the operation and maintenance objects are also added to the fault chain, so that the actual situation of the application system can be simulated to a large extent, the cause of the fault and the corresponding location can be accurately found, and the reliability and accuracy of the application system fault detection can be enhanced. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0018] Figure 1 A flowchart of a fault detection method for an application system provided in an embodiment of the present application;

[0019] Figure 2 A schematic diagram of a flow chart of S102 in the fault detection method of the application system provided in an embodiment of the present application;

[0020] Figure 3 A schematic diagram of a flow chart of S103 in the fault detection method of the application system provided in an embodiment of the present application;

[0021] Figure 4 A schematic diagram of a flow chart of S105 in the fault detection method of the application system provided in an embodiment of the present application;

[0022] Figure 5A schematic diagram of a flow chart of S106 in the fault detection method of the application system provided in an embodiment of the present application;

[0023] Figure 6 A schematic diagram of a flow chart of S107 in the fault detection method of the application system provided in an embodiment of the present application;

[0024] Figure 7 A schematic diagram of a structure of a fault detection device for an application system provided in an embodiment of the present application;

[0025] Figure 8 A schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0026] The features and exemplary embodiments of various aspects of the present application will be described in detail below. In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only intended to explain the present application, rather than to limit the present application. For those skilled in the art, the present application can be implemented without the need for some of these specific details. The following description of the embodiments is merely to provide a better understanding of the present application by illustrating the examples of the present application.

[0027] It should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. In the absence of further limitations, the elements defined by the phrase "comprising..." do not exclude the presence of other identical elements in the process, method, article, or device comprising the elements.

[0028] It should be understood that the term "and / or" as used herein is merely a description of the relationship between associated objects, indicating that three possible relationships exist. For example, "A and / or B" can represent: A exists alone, A and B exist simultaneously, or B exists alone. Furthermore, the character " / " in this document generally indicates that the associated objects are in an "or" relationship.

[0029] It will be apparent to those skilled in the art that various modifications and variations can be made in this application without departing from the spirit or scope of this application. Therefore, this application is intended to cover modifications and variations of this application that fall within the scope of the corresponding claims (technical solutions claimed for protection) and their equivalents. It should be noted that the embodiments provided in the examples of this application can be combined with each other without contradiction.

[0030] Before describing the technical solutions provided by the embodiments of the present application, in order to facilitate understanding of the embodiments of the present application, the present application first specifically describes the problems existing in the related art:

[0031] The rapid development of the information age has fostered the emergence of a wide variety of application systems. The advancement of digitalization and intelligence has also placed increasingly stringent demands on these systems. People expect application system pages to be accessible, smooth, and interactive. Therefore, timely detection and location of application system failures are crucial for efficient and effective handling, minimizing their impact on user experience.

[0032] The monitoring functions of application systems include network monitoring, storage monitoring, operating system monitoring, middleware monitoring, application monitoring, and database monitoring. Each monitoring function includes many operation and maintenance objects, which mainly refer to the hardware and software in the monitoring system. Hardware includes servers, firewalls, anti-DoS devices, Waf devices, routers, switches, or storage devices, and software includes operating systems, databases, applications, and various middleware. The operation and maintenance objects involved in network monitoring include switches, routers, firewalls, VoIP gateway devices, and other network devices with SNMP protocol enabled. The operation and maintenance objects involved in operating system monitoring include operating systems such as Windows, Linux, and UNIX. The operation and maintenance objects involved in middleware monitoring include message middleware, Web service middleware, cache middleware, and database middleware.

[0033] The indicators mentioned below refer to a specific attribute used to measure the function or performance of an operation and maintenance object. Each operation and maintenance object can have multiple indicators, such as utilization, availability, response time, throughput, success rate, and error rate. Different operation and maintenance objects can have different indicators. For example, network devices have indicators such as network latency, access volume, and success rate. Storage devices have indicators such as block read and write rates, IOPS, read and write latency, and disk usage. Operating systems have indicators such as CPU, memory, network I / O, and disk I / O. Databases have indicators such as slow queries, cache hit rate, and tablespace growth rate.

[0034] The inventors of this application have found that current abnormal indicator detection only monitors core KPI indicators or monitors all indicators while ignoring the correlation between indicators. It usually only performs abnormal analysis and positioning on a single indicator, resulting in low accuracy of the final fault detection results.

[0035] In view of the above research findings of the inventors, the embodiments of the present application provide a method, apparatus, device and readable storage medium for fault detection of an application system, which can solve the technical problem of low accuracy of fault detection results of an application system existing in the related art.

[0036] The following first introduces the fault detection method of the application system provided by the embodiment of the present application.

[0037] Figure 1 A flow chart of a fault detection method for an application system provided in an embodiment of the present application. Figure 1 As shown, the fault detection method of the application system may include the following steps S101 to S108.

[0038] S101. When an application system fails, determine a first operation and maintenance object corresponding to the failure and a first indicator of the first operation and maintenance object.

[0039] The first operation and maintenance object can be understood as the fault object entity, or the fault object entity directly affected by the fault (hereinafter referred to as the direct fault object entity). In S101, first, for the application system fault, the direct fault object entity Entry and the indicator corresponding to the direct fault object entity Entry are searched according to the fault. The direct fault object entity Entry is recorded as E m , the indicator is the first indicator, denoted as I m .

[0040] S102: Acquire multiple second operation and maintenance objects associated with the first operation and maintenance object and second indicators corresponding to each of the multiple second operation and maintenance objects.

[0041] A second operation and maintenance object is an operation and maintenance object that has an association with a first operation and maintenance object. Associations include, but are not limited to, call, include, and connect relationships. Each second operation and maintenance object has its own corresponding indicator, referred to as a second indicator.

[0042] S103: Based on the target correlation analysis algorithm, the indicators that have no correlation with the first indicator are filtered out from the second indicators to obtain the filtered second indicators of the second operation and maintenance objects.

[0043] Some of the second indicators may not have a correlation with the first indicator. Therefore, in S103, based on a target correlation analysis algorithm (such as an Apriori algorithm), the indicators that do not have a correlation with the first indicator in each second indicator can be screened out to obtain the second indicators after screening for each second operation and maintenance object.

[0044] S104: Select an indicator from the second indicators filtered by the second operation and maintenance object as the target indicator of the second operation and maintenance object.

[0045] The second indicators after screening of the second operation and maintenance object may include multiple indicators. In S104, for each second operation and maintenance object, one indicator may be selected from the corresponding second indicators as the target indicator of the second operation and maintenance object.

[0046] S105. Establish a knowledge graph based on the first operation and maintenance object, the first indicator, the second operation and maintenance object, and the target indicator.

[0047] The inventors of this application have found that current fault detection or location methods mainly achieve fault location through event correlation, alarm topology diagrams, semantic analysis and machine learning, while the use of knowledge graphs for application system fault detection is relatively rare.

[0048] In contrast, the embodiment of the present application performs application system fault detection based on the knowledge graph. The knowledge graph is a graph-based data structure that aims to describe various entities or concepts and their relationships in the real world. It consists of nodes (points) and edges (Edges). Nodes represent entities or concepts, and edges are composed of attributes or relationships, which form a huge semantic network graph. The triple-based representation method is a common representation form of the knowledge graph, such as: entity 1-relationship-entity 2 and entity-attribute-attribute value. The knowledge graph has powerful semantic processing capabilities and open organizational capabilities.

[0049] In an embodiment of the present application, the established knowledge graph may include multiple fault chains. For example, a second operation and maintenance object may be located in a fault chain.

[0050] S106. Calculate the fault similarity between each second operation and maintenance object and the first operation and maintenance object in the knowledge graph, and prune the fault chain of the second operation and maintenance object where the fault similarity is less than a first preset threshold.

[0051] In S106 , by calculating the fault similarity and pruning the fault chain of the second operation and maintenance object where the fault similarity is less than the first preset threshold, the workload of fault cause analysis can be greatly reduced and the efficiency of fault detection and location can be improved.

[0052] S107. Calculate anomaly scores of multiple fault chains in the pruned knowledge graph.

[0053] Current fault detection or location methods do not have a clear and detailed method for the scoring mechanism of fault chains. The embodiments of the present application can make the root cause analysis method more reasonable and clear by calculating the anomaly scores of multiple fault chains in the pruned knowledge graph.

[0054] S108. Determine the cause of the fault based on the anomaly scores of the multiple fault chains.

[0055] The specific implementation of each of the above steps will be described in detail below.

[0056] The fault detection method for the application system of the embodiment of the present application fully considers the complexity of the actual application system and the correlation between the indicators of different operation and maintenance objects. First, all the indicator anomalies of each operation and maintenance object are calculated, and the abnormal indicators that are not related to the current fault are filtered out through the correlation analysis algorithm. At the same time, the indicators of the operation and maintenance objects are also added to the fault chain, so that the actual situation of the application system can be simulated to a large extent, the cause of the fault and the corresponding location can be accurately found, and the reliability and accuracy of the application system fault detection can be enhanced.

[0057] First, S101 is introduced: when a failure occurs in the application system, a first operation and maintenance object corresponding to the failure and a first indicator of the first operation and maintenance object are determined.

[0058] In S101, first, for the application system fault, the direct fault object entity Entry and the indicator corresponding to the direct fault object entity Entry are searched according to the fault. Among them, the direct fault object entity Entry is the first operation and maintenance object, denoted as E m ;Indicator is the first indicator, denoted as I m .Indicator I m It has {Na, Ty, St, Kt, Vas} attributes, where Na represents the indicator name, Ty represents the indicator type, St represents the abnormal start time, Kt represents the abnormal duration, and Vas is the value set of the abnormal indicator from the start time to the duration.

[0059] The following describes S102, which involves acquiring a plurality of second operation and maintenance objects associated with the first operation and maintenance object and second indicators corresponding to the plurality of second operation and maintenance objects.

[0060] The inventors of this application have discovered that there are two common methods for detecting anomalies in time series data. One is statistically based methods, such as the concentration inequality, Markov inequality, 3-sigma, and ARIMA for univariate data, and the Mahalanobis distance for multivariate data. The other is similarity metric-based methods, such as distance-based KNN, density-based LOF and KDE kernel density estimation, clustering-based K-means and GMM, tree-based isolation forest, and spectral-based one-class SVM. There are relatively few methods using deep learning to detect anomalies in time series data.

[0061] The embodiment of the present application uses a target anomaly detection algorithm (such as the Buzz algorithm) for anomaly detection. The Buzz algorithm is an adversarial training method for Bayesian networks based on local analysis. It is the first high-performance unsupervised anomaly detection algorithm for complex monitoring indicators. Its optimal F-score ranges from 0.92 to 0.99, significantly outperforming the unsupervised method based on the most advanced VAE (no adversarial training) and the most advanced supervised method. Using this algorithm can improve the accuracy of indicator anomaly detection, thereby improving the timeliness and accuracy of application system fault detection.

[0062] Figure 2 This is a flow chart of S102 in the fault detection method of the application system provided in the embodiment of the present application. Figure 2 As shown, in some embodiments, S102 may specifically include the following steps S201 and S202.

[0063] S201: Based on a target anomaly detection algorithm, calculate whether multiple indicators of a second operation and maintenance object associated with a first operation and maintenance object have anomalies.

[0064] There may be multiple second operation and maintenance objects associated with the first operation and maintenance object, such as the second operation and maintenance object E n 、E O , E p ,…,E z . Take the second operation and maintenance object E n For example, we can use the target anomaly detection algorithm (such as Buzz algorithm) to calculate the first operation and maintenance object E m The second operation and maintenance object E with call, containment and connection relationships n Check whether all indicators are abnormal.

[0065] S202: Construct an abnormal indicator set based on the abnormal indicator of the second operation and maintenance object to obtain a second indicator corresponding to the second operation and maintenance object.

[0066] Take the second operation and maintenance object E n For example, the second operation and maintenance object En The abnormal indicators are retained and the abnormal indicator set I is constructed ns , such as {I n1 ,I n2 ,…,I nk}, abnormal indicator set I ns That is, the second operation and maintenance object E n Each anomaly indicator in the anomaly indicator set has {Na, Ty, St, Kt, Vas} attributes, where Na represents the indicator name, Ty represents the indicator type, St represents the anomaly start time, Kt represents the anomaly duration, and Vas is the value set of the anomaly indicator from the start time to the duration.

[0067] For other second operation and maintenance objects E O , E p ,…,E z Use the second operation and maintenance object E n In the same way, the second indicator corresponding to each second operation and maintenance object is obtained.

[0068] The embodiment of the present application adopts a target anomaly detection algorithm (such as the Buzz algorithm) for anomaly detection, which can improve the accuracy of indicator anomaly detection, thereby improving the timeliness and accuracy of application system fault discovery.

[0069] The following describes S103: based on the target correlation analysis algorithm, the indicators that have no correlation with the first indicator in each second indicator are screened out to obtain the second indicators after screening of each second operation and maintenance object.

[0070] Figure 3 This is a flow chart of S103 in the fault detection method of the application system provided in the embodiment of the present application. Figure 3 As shown, in some embodiments, S103 may specifically include the following steps S301 and S302.

[0071] S301. Based on a target association analysis algorithm, calculate the support and confidence between each indicator in the second indicator and the first indicator.

[0072] Still taking the second operation and maintenance object E n For example, we can find the second operation and maintenance object E based on historical monitoring data and target association analysis algorithm (such as Apriori algorithm). n and abnormal indicator set I ns The data set composed of E m and I m The datasets that make up the data have indicators of association relationships.

[0073] Specifically, the abnormal index set I can be calculated nsThe support and confidence between each indicator in and the first indicator.

[0074] For example, the abnormality index set I can be calculated according to the following expression (1): ns The support between each indicator and the first indicator in :

[0075] Support(I m =>I n1 )=P(I m ∩I n1 ) (1)

[0076] Among them, indicator I n1 With the first indicator I m The support between them refers to the first indicator I m and indicator I n1 The probability of simultaneous occurrence.

[0077] For example, the abnormality index set I can be calculated according to the following expression (2): ns The confidence between each indicator and the first indicator in:

[0078] Confidence(I m =>I n1 )=P(I n1 ∩I m ) (2)

[0079] Among them, indicator I n1 With the first indicator I m The confidence level between the first indicator I m Under the conditions that occur, indicator I n1 Probability of occurrence.

[0080] S302: Eliminate the second indicators whose support is less than the second preset threshold or whose confidence is less than the third preset threshold, to obtain the filtered second indicators.

[0081] Using the above expressions (1) and (2), calculate the abnormal index set I ns Each indicator in the first indicator I m The support and confidence of the index are greater than or equal to the second preset threshold and the confidence is greater than or equal to the third preset threshold, which is considered to be consistent with the first index I m The indicator whose support is less than the second preset threshold or whose confidence is less than the third preset threshold is considered to be related to the first indicator I m The second indicators whose support is less than the second preset threshold or whose confidence is less than the third preset threshold are filtered out to obtain the filtered second indicators.

[0082] For other second operation and maintenance objects E O , E p ,…,E z Use the second operation and maintenance object E n In the same way, the second indicators after screening of each second operation and maintenance object are obtained.

[0083] The following describes S104, selecting an indicator from the second indicators filtered by the second operation and maintenance object as the target indicator of the second operation and maintenance object.

[0084] In some embodiments, S104 may specifically include the following steps: for each second operation and maintenance object, based on the target local outlier factor detection method, calculate the abnormality degree of each indicator in the second indicator after the second operation and maintenance object is screened, and take the indicator with the largest abnormality degree as the target indicator of the second operation and maintenance object.

[0085] Specifically, the second operation and maintenance object E n For example, during the duration of the abnormal indicator, the target local outlier factor detection method (such as LOF method) can be used to calculate the abnormality of the remaining indicators, and the indicator with the largest abnormality is retained as the second operation and maintenance object E n Target Indicator I n .

[0086] LOF is a local outlier factor detection method. The size of the outlier factor determines the degree of abnormality of the data point. The local outlier factor of point p is expressed as:

[0087]

[0088] Among them, the local outlier factor of point p represents the neighborhood point N of point p k The average of the ratios of the local reachability density of point (p) to the local reachability density of point p. The symbols in the formula are explained as follows:

[0089] (1) It represents the reciprocal of the average reachable distance from point p to points in its k-th neighborhood.

[0090] (2) reach-distance k (p,o)=max{k-distance(o),d(p,o)} represents the kth reachable distance from point o to point p.

[0091] (3)N k (p) represents the kth distance neighborhood of point p, which is all points within the kth distance of p.

[0092] (4)d k (p)=d(p,o) represents the k-th distance of p, that is, the distance to the point k-th farthest from p, excluding p.

[0093] (5)d(p,o) represents the distance between two points p and o.

[0094] In this way, after calculating the abnormality degree of each indicator in the second indicator after screening the second operation and maintenance object based on the target local outlier factor detection method, the indicator with the largest abnormality degree is used as the target indicator of the second operation and maintenance object.

[0095] The following introduces S105, which establishes a knowledge graph based on the first operation and maintenance object, the first indicator, the second operation and maintenance object, and the target indicator.

[0096] Figure 4 This is a flow chart of S105 in the fault detection method of the application system provided in the embodiment of the present application. Figure 4 As shown, in some embodiments, S105 may specifically include the following steps S401 to S403.

[0097] S401: Calculate the conditional probability of a failure of the second operation and maintenance object based on historical monitoring data, and use the conditional probability as a weight value of the link relationship between the first operation and maintenance object and the second operation and maintenance object.

[0098] Still taking the second operation and maintenance object E n For example, we can calculate E based on historical monitoring data. n The conditional probability of failure, and E n The conditional probability of failure is used as the link weight value W of the knowledge graph edge mn .

[0099] S402: Establish a triple of the first operation and maintenance object, the second operation and maintenance object, and the link relationship between the first operation and maintenance object and the second operation and maintenance object, and use the first indicator as the attribute of the node where the first operation and maintenance object is located, and use the target indicator as the attribute of the node where the second operation and maintenance object is located.

[0100] By adding E m and E n And the link relationship between them is expressed as a triple form {E m ; R{W mn};E n}, and record the properties of the node. m and E n The attributes are the indicators I m and I n The R in the triplet stands for E m and E n The link relationship between them includes calling, including and connecting. n The conditional probability of failure, determining the attribute W of R mnThe weight value of .

[0101] S403. Draw a knowledge graph containing triples.

[0102] Draw the knowledge graph represented by triples in the target graph database (such as Neo4j) to establish E m and E n The graph relationship between them.

[0103] Traverse the remaining and operation object E m The second operation and maintenance object E with call, containment and connection relationships O , E p ,…,E z , calculate their abnormal index I O , I p ,…,I z .

[0104] Then, the first operation and maintenance object E is established m and the second operation and maintenance object E O , E p ,…,E z The triplet of the relationship between {E m ; R{W mo};E o},{E m ; R{W mp};E p},…,{E m ; R{W mz};E z}, for subsequent storage in the graph database, thereby establishing the first operation and maintenance object E m And the graph relationship between each second operation and maintenance object.

[0105] It should be noted that, in some embodiments, the above process can be repeated until the traversed object reaches the most basic unit (such as instance or host level), thereby constructing a knowledge graph containing different operation and maintenance objects and the link relationships between them.

[0106] The following describes S106, which calculates the fault similarity between each second operation and maintenance object and the first operation and maintenance object in the knowledge graph, and prunes the fault chain where the second operation and maintenance object whose fault similarity is less than a first preset threshold is located.

[0107] Figure 5 This is a flow chart of S106 in the fault detection method of the application system provided in the embodiment of the present application. Figure 5 As shown, in some embodiments, S106 may specifically include the following steps S501 to S504.

[0108] S501: For each fault chain where the second operation and maintenance object is located, the duration of the fault chain is used as the abnormal time window of the fault chain.

[0109] In S501 , the duration of each fault chain may be taken as the abnormal time window of the fault chain.

[0110] S502: Within the abnormal time window, based on a target weighted moving average algorithm, calculate the characteristics of the first indicator of the first operation and maintenance object to obtain a first characteristic vector of the first operation and maintenance object.

[0111] Specifically, within the abnormal time window, the target weighted moving average algorithm (such as WMA algorithm) can be used to calculate the first operation and maintenance object E m Indicator I m The characteristics of the first operation and maintenance object E m The feature, denoted as Feature(E m ). The expression is as follows:

[0112]

[0113] Among them, Y n+1 is the weighted average value of the n+1 period, Y i is the actual value of period i, X i is the weight of period i (where ), n is the number of this period.

[0114] S503: Within the abnormal time window, based on the target weighted moving average algorithm, calculate the characteristics of the second indicator of the second operation and maintenance object to obtain a second characteristic vector of the second operation and maintenance object.

[0115] In S503, the method in S502 can be repeated to calculate the first operation and maintenance object E on the knowledge graph. m The second operation and maintenance object E with call, containment, and connection relationships n , E O , E p ,…,E z Abnormal indicator I n , I O , I p ,…,I z The characteristics of the operation and maintenance object E n , E O , E p ,…,E z The characteristic vectors of n ), Feature(E o ), Feature(E p ),…,Feature(E z ).

[0116] S504 : Calculate the fault similarity between the first eigenvector and the second eigenvector based on a cosine similarity algorithm.

[0117] The cosine similarity algorithm uses the cosine value of the angle between two vectors in the vector space as a measure of the difference between two individuals. The closer the value is to 1, the more similar the two vectors are. It measures the similarity of the proportions of two variables in various directions (attributes).

[0118] The expression is as follows:

[0119]

[0120] In this way, the fault similarity between the first eigenvector and each second eigenvector can be calculated by the above expression (5).

[0121] Still taking the second operation and maintenance object E n For example, when E m and E n When the similarity of E is less than the set similarity threshold, n Otherwise, the fault chain is retained.

[0122] In some embodiments, the process of S501 to S504 can be repeated to calculate the fault similarity of operation and maintenance objects with call, containment, and connection relationships between two adjacent layers of nodes on the remaining chain after pruning on the knowledge graph, and prune according to the set threshold.

[0123] The embodiment of the present application calculates the feature vector of the node using the weighted moving average method within the abnormal time window, calculates the similarity of two adjacent layers of nodes on the knowledge graph using the cosine similarity algorithm, and cuts off the fault chain containing nodes whose similarity is less than the specified threshold, thereby narrowing the fault location range and reducing the workload of fault cause analysis of the application system.

[0124] This embodiment of the application fully considers the suddenness and transience of abnormal data and uses a weighted average to perform feature processing on nodes within the time window of the abnormal data, which is more closely aligned with the window characteristics of the abnormal data. Furthermore, this embodiment of the application uses cosine similarity to calculate the similarity between nodes, making the root cause of the fault more clearly located.

[0125] The following describes S107, calculating anomaly scores of multiple fault chains in the pruned knowledge graph.

[0126] Figure 6 This is a flow chart of S107 in the fault detection method of the application system provided in the embodiment of the present application. Figure 6As shown, in some embodiments, S107 may specifically include the following steps S601 to S604.

[0127] S601: For each fault chain, calculate the abnormal probability of each node on the fault chain within a preset time range.

[0128] The abnormality score of each level node on the fault chain after pruning can be calculated. In S601, based on historical data, for example, the abnormality score of node E on the fault chain can be calculated. m Indicator I m The abnormal probability P(m) in the specified time range is calculated by the node E on the fault chain n Indicator I n The probability of anomaly P(n) within a specified time range.

[0129] S602: Calculate the anomaly score of each node on the fault chain according to the indicator type, anomaly start time, anomaly duration, and anomaly probability of each node on the fault chain.

[0130] The anomaly score of each node is a function of the indicator type, anomaly start time, anomaly duration, and anomaly probability. Its expression can be:

[0131] Score_P(m)=f m (Ty,St,Kt,P(m)) (6)

[0132] By repeating the above steps S601 and S602, the anomaly score of each node on the knowledge graph can be calculated.

[0133] S603: For any node, calculate the ratio of the number of node failures to the total number of failures of the previous node under the condition that the previous node fails, and obtain the link weight corresponding to the node.

[0134] Link weight W i It is the ratio of the number of failures of the next node under the condition that the previous node fails to the total number of failures of the previous node in the two connected nodes on the knowledge graph fault chain. m and node E n The link weight value W between mn For node E within the specified historical time range m Under the condition of failure, node E n The number of failures and node E m The ratio of the total number of failures that occurred.

[0135] S604: Calculate the weighted average of the anomaly score of each node on the fault chain and the link weight corresponding to each node to obtain the anomaly score of the fault chain.

[0136] The score of each fault chain is the weighted average of the anomaly score and link weight of each node in the fault chain. The calculation formula is as follows:

[0137]

[0138] The following describes S108: determining the cause of the fault based on the anomaly scores of the multiple fault chains.

[0139] In some embodiments, S108 may specifically include the following steps:

[0140] Arrange the anomaly scores of multiple fault chains in descending order, and select the fault chains corresponding to the top N anomaly scores as candidates for the cause of the current fault, where N is a positive integer.

[0141] The higher the anomaly score of a fault chain, the greater the probability that it caused the current fault. Therefore, by selecting the fault chains corresponding to the top N anomaly scores as candidate causes of the current fault, we can quickly determine the cause of the application system failure and pinpoint the suspected location of the fault with the highest probability. Operations and maintenance personnel can then use location and troubleshooting methods to quickly locate the fault, shortening troubleshooting time.

[0142] In the embodiment of the present application, the anomaly score of each node on the knowledge graph fault chain is regarded as a function of the indicator type, anomaly start time, anomaly duration and anomaly probability. The node anomaly probability is calculated through historical monitoring data. The score of each fault chain in the knowledge graph is the weighted average of the anomaly point score and the link weight. By analyzing the historical monitoring data, the conditional probability of the node failure is calculated as the link weight value. Finally, the fault chain scores are sorted in descending order, and the fault chains corresponding to the top N anomaly scores are taken as the root cause candidates for this fault, so that the cause of the application system failure can be quickly determined.

[0143] Based on the application system fault detection method provided in the above embodiment, the present application also provides a specific implementation of an application system fault detection device. Please refer to the following embodiment.

[0144] Figure 7 A structural diagram of a fault detection device for an application system provided in an embodiment of the present application. Figure 7 As shown, the fault detection device 70 of the application system provided in the embodiment of the present application includes the following modules:

[0145] A first determining module 701 is configured to determine, when a failure occurs in the application system, a first operation and maintenance object and a first indicator of the first operation and maintenance object corresponding to the failure;

[0146] An acquisition module 702 is configured to acquire a plurality of second operation and maintenance objects associated with the first operation and maintenance object and second indicators corresponding to the plurality of second operation and maintenance objects;

[0147] A screening module 703 is configured to screen out the second indicators that have no correlation with the first indicators based on a target correlation analysis algorithm, thereby obtaining the screened second indicators for the second operation and maintenance objects.

[0148] A selection module 704 is configured to select an indicator from the second indicators filtered by the second operation and maintenance object as a target indicator of the second operation and maintenance object;

[0149] An establishing module 705 is configured to establish a knowledge graph based on the first operation and maintenance object, the first indicator, the second operation and maintenance object, and the target indicator, wherein the knowledge graph includes multiple fault chains;

[0150] A first calculation module 706 is configured to calculate the fault similarity between each second operation and maintenance object and the first operation and maintenance object in the knowledge graph, and to prune the fault chain of the second operation and maintenance object whose fault similarity is less than a first preset threshold;

[0151] A second calculation module 707 is used to calculate anomaly scores of multiple fault chains in the pruned knowledge graph;

[0152] The second determining module 708 is configured to determine the cause of the fault according to the anomaly scores of the multiple fault chains.

[0153] The fault detection device of the application system in the embodiment of the present application fully considers the complexity of the actual application system and the correlation between the indicators of different operation and maintenance objects. First, all the indicator anomalies of each operation and maintenance object are calculated, and the abnormal indicators that are not related to the current fault are filtered out through the correlation analysis algorithm. At the same time, the indicators of the operation and maintenance objects are also added to the fault chain, so that the actual situation of the application system can be simulated to a large extent, the cause and corresponding location of the fault can be accurately found, and the reliability and accuracy of the application system fault detection are enhanced.

[0154] In some embodiments, the acquisition module 702 is specifically used to calculate whether multiple indicators of a second operation and maintenance object that has an association relationship with the first operation and maintenance object have abnormalities based on the target anomaly detection algorithm; based on the abnormal indicators of the second operation and maintenance object, an abnormal indicator set is constructed to obtain the second indicator corresponding to the second operation and maintenance object.

[0155] In some embodiments, the screening module 703 is specifically used to calculate the support and confidence between each indicator in the second indicator and the first indicator based on the target association analysis algorithm; filter out the indicators in the second indicator whose support is less than the second preset threshold or whose confidence is less than the third preset threshold, and obtain the screened second indicator.

[0156] In some embodiments, the selection module 704 is specifically used to calculate the abnormality level of each indicator in the second indicators after screening the second operation and maintenance object for each second operation and maintenance object based on the target local outlier factor detection method, and take the indicator with the largest abnormality level as the target indicator of the second operation and maintenance object.

[0157] In some embodiments, the establishment module 705 is specifically used to calculate the conditional probability of failure of the second operation and maintenance object based on historical monitoring data, and use the conditional probability as the weight value of the link relationship between the first operation and maintenance object and the second operation and maintenance object; establish a triple of the first operation and maintenance object, the second operation and maintenance object, and the link relationship between the first operation and maintenance object and the second operation and maintenance object, and use the first indicator as the attribute of the node where the first operation and maintenance object is located, and use the target indicator as the attribute of the node where the second operation and maintenance object is located; draw a knowledge graph containing the triples.

[0158] In some embodiments, the first calculation module 706 is specifically used to use the duration of the fault chain in which each second operation and maintenance object is located as the abnormal time window of the fault chain; within the abnormal time window, based on the target weighted moving average algorithm, calculate the characteristics of the first indicator of the first operation and maintenance object to obtain the first feature vector of the first operation and maintenance object; within the abnormal time window, based on the target weighted moving average algorithm, calculate the characteristics of the second indicator of the second operation and maintenance object to obtain the second feature vector of the second operation and maintenance object; based on the cosine similarity algorithm, calculate the fault similarity of the first feature vector and the second feature vector.

[0159] In some embodiments, the second calculation module 707 is specifically used to calculate the abnormal probability of each node on the fault chain within a preset time range for each fault chain; calculate the abnormal score of each node on the fault chain according to the indicator type, abnormal start time, abnormal duration and abnormal probability of each node on the fault chain; for any node, calculate the ratio of the number of node failures to the total number of failures that occurred on the previous node under the condition that the previous node fails, and obtain the link weight corresponding to the node; calculate the weighted average of the abnormal score of each node on the fault chain and the link weight corresponding to each node to obtain the abnormal score of the fault chain.

[0160] In some embodiments, the second determining module 708 is specifically configured to sort the anomaly scores of the multiple fault chains in descending order, and select the fault chains corresponding to the top N anomaly scores as candidate causes of the current fault, where N is a positive integer.

[0161] Figure 7 Each module / unit in the device shown has the function of implementing each step in the fault detection method of the application system provided by the above method embodiment and can achieve its corresponding technical effect. For the sake of brevity, it will not be repeated here.

[0162] Based on the fault detection method of the application system provided in the above embodiment, the present application also provides a specific implementation of the electronic device. Please refer to the following embodiment.

[0163] Figure 8 A schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present application is shown.

[0164] The electronic device may include a processor 801 and a memory 802 storing computer program instructions.

[0165] Specifically, the processor 801 may include a central processing unit (CPU) or an application specific integrated circuit (ASIC), or may be configured to implement one or more integrated circuits of the embodiments of the present application.

[0166] The memory 802 may include a large-capacity memory for data or instructions. By way of example and not limitation, the memory 802 may include a hard disk drive (HDD), a floppy disk drive, a flash memory, an optical disk, a magneto-optical disk, a magnetic tape, or a universal serial bus (USB) drive, or a combination of two or more of these. In one example, the memory 802 may include removable or non-removable (or fixed) media, or the memory 802 may be a non-volatile solid-state memory. The memory 802 may be internal or external to the electronic device.

[0167] In one example, the memory 802 may be a read-only memory (ROM). In one example, the ROM may be a mask-programmed ROM, a programmable ROM (PROM), an erasable PROM (EPROM), an electrically erasable PROM (EEPROM), an electrically rewritable ROM (EAROM), or a flash memory, or a combination of two or more of these.

[0168] The memory 802 may include read-only memory (ROM), random access memory (RAM), magnetic disk storage media devices, optical storage media devices, flash memory devices, electrical, optical or other physical / tangible memory storage devices. Thus, generally, the memory includes one or more tangible (non-transitory) computer-readable storage media (e.g., memory devices) encoded with software including computer-executable instructions, and when the software is executed (e.g., by one or more processors), it is operable to perform the operations described with reference to the method according to an aspect of the present application.

[0169] The processor 801 implements the method / steps in the above-mentioned method embodiment by reading and executing the computer program instructions stored in the memory 802, and achieves the corresponding technical effects achieved by the method embodiment executing its method / steps. For the sake of brevity, it will not be repeated here.

[0170] In one example, the electronic device may further include a communication interface 803 and a bus 810. Figure 8 As shown, the processor 801, the memory 802, and the communication interface 803 are connected via a bus 810 and communicate with each other.

[0171] The communication interface 803 is mainly used to implement communication between various modules, devices, units and / or equipment in the embodiments of the present application.

[0172] Bus 810 includes hardware, software or both, couples the parts of electronic equipment to each other.For example, but not limitation, bus may include Accelerated Graphics Port (AGP) or other graphics buses, Enhanced Industry Standard Architecture (EISA) bus, Front Side Bus (FSB), Hyper Transport (HT) interconnection, Industry Standard Architecture (ISA) bus, InfiniBand interconnection, Low Pin Count (LPC) bus, memory bus, Micro Channel Architecture (MCA) bus, Peripheral Component Interconnect (PCI) bus, PCI-Express (PCI-X) bus, Serial Advanced Technology Attachment (SATA) bus, Video Electronics Standards Association local (VLB) bus or other suitable bus or two or more of these combinations. In appropriate cases, bus 810 may include one or more buses. Although the present application embodiment describes and shows specific bus, the application considers any suitable bus or interconnection.

[0173] In addition, in combination with the fault detection method of the application system in the above embodiment, the embodiment of the present application can provide a computer-readable storage medium for implementation. The computer-readable storage medium stores computer program instructions; when the computer program instructions are executed by a processor, any of the fault detection methods of the application system in the above embodiment is implemented. Examples of computer-readable storage media include non-transitory computer-readable storage media, such as electronic circuits, semiconductor memory devices, ROM, random access memory, flash memory, erasable ROM (EROM), floppy disks, CD-ROMs, optical disks, and hard disks.

[0174] It should be understood that the present application is not limited to the specific configurations and processes described above and illustrated in the figures. For the sake of brevity, a detailed description of known methods is omitted here. In the above embodiments, several specific steps are described and illustrated as examples. However, the method process of the present application is not limited to the specific steps described and illustrated. Those skilled in the art can make various changes, modifications, and additions, or change the order of the steps after understanding the spirit of the present application.

[0175] The functional blocks shown in the above-described block diagram can be implemented as hardware, software, firmware or a combination thereof. When implemented in hardware, it can be, for example, an electronic circuit, an application specific integrated circuit (ASIC), appropriate firmware, a plug-in, a function card, etc. When implemented in software, the elements of the present application are programs or code segments that are used to perform the required tasks. The program or code segment can be stored in a machine-readable medium, or transmitted on a transmission medium or a communication link via a data signal carried in a carrier wave. "Machine-readable medium" can include any medium capable of storing or transmitting information. Examples of machine-readable media include electronic circuits, semiconductor memory devices, ROMs, flash memories, erasable ROMs (EROMs), floppy disks, CD-ROMs, optical disks, hard disks, optical fiber media, radio frequency (RF) links, etc. The code segment can be downloaded via a computer network such as the Internet, an intranet, etc.

[0176] It should also be noted that the exemplary embodiments mentioned in this application describe some methods or systems based on a series of steps or devices. However, this application is not limited to the order of the above steps. In other words, the steps can be performed in the order mentioned in the embodiments, or in a different order, or several steps can be performed simultaneously.

[0177] Aspects of the present application have been described above with reference to the flowcharts and / or block diagrams of the methods, devices (systems) and computer program products according to the embodiments of the present application. It should be understood that each box in the flowchart and / or block diagram and the combination of each box in the flowchart and / or block diagram can be implemented by computer program instructions. These computer program instructions can be provided to the processor of a general-purpose computer, a special-purpose computer or other programmable data processing device to produce a machine so that these instructions executed via the processor of the computer or other programmable data processing device enable the implementation of the function / action specified in one or more boxes of the flowchart and / or block diagram. This processor can be, but is not limited to, a general-purpose processor, a special-purpose processor, a special application processor or a field programmable logic circuit. It is also understood that each box in the block diagram and / or the flowchart and the combination of the boxes in the block diagram and / or the flowchart can also be implemented by the dedicated hardware that performs the specified function or action, or can be implemented by the combination of dedicated hardware and computer instructions.

[0178] The above description is only a specific embodiment of the present application. Those skilled in the art will clearly understand that for the convenience and brevity of description, the specific working processes of the systems, modules and units described above can refer to the corresponding processes in the aforementioned method embodiments, and will not be repeated here. It should be understood that the scope of protection of the present application is not limited thereto. Any person skilled in the art can easily think of various equivalent modifications or replacements within the technical scope disclosed in the present application, and these modifications or replacements should be included in the scope of protection of the present application.

Claims

1. A fault detection method for an application system, characterized in that: include: In the event that a failure occurs in the application system, determining a first operation and maintenance object corresponding to the failure and a first indicator of the first operation and maintenance object; Acquire multiple second operation and maintenance objects associated with the first operation and maintenance object and second indicators corresponding to each of the multiple second operation and maintenance objects; Based on the target association analysis algorithm, the indicators that have no association with the first indicator are screened out from each of the second indicators to obtain the second indicators after screening for each of the second operation and maintenance objects; Selecting one indicator from the second indicators filtered by the second operation and maintenance object as the target indicator of the second operation and maintenance object; Establishing a knowledge graph based on the first operation and maintenance object, the first indicator, the second operation and maintenance object, and the target indicator, wherein the knowledge graph includes multiple fault chains; Calculating the fault similarity between each second operation and maintenance object and the first operation and maintenance object in the knowledge graph, and pruning the fault chain of the second operation and maintenance object where the fault similarity is less than a first preset threshold; Calculating anomaly scores of multiple fault chains in the pruned knowledge graph; determining a cause of the fault according to the anomaly scores of the multiple fault chains; The establishing of a knowledge graph based on the first operation and maintenance object, the first indicator, the second operation and maintenance object, and the target indicator specifically includes: Calculate, based on historical monitoring data, a conditional probability that the second operation and maintenance object has failed, and use the conditional probability as a weight value of the link relationship between the first operation and maintenance object and the second operation and maintenance object; Establishing a triple of the first operation and maintenance object, the second operation and maintenance object, and a link relationship between the first operation and maintenance object and the second operation and maintenance object, and using the first indicator as an attribute of the node where the first operation and maintenance object is located, and using the target indicator as an attribute of the node where the second operation and maintenance object is located; Draw a knowledge graph containing the triples.

2. The method according to claim 1, characterized in that The acquiring of a plurality of second operation and maintenance objects associated with the first operation and maintenance object and second indicators corresponding to the plurality of second operation and maintenance objects specifically includes: Calculate, based on a target anomaly detection algorithm, whether multiple indicators of the second operation and maintenance object associated with the first operation and maintenance object have anomalies; According to the abnormal indicators of the second operation and maintenance object, an abnormal indicator set is constructed to obtain the second indicator corresponding to the second operation and maintenance object.

3. The method according to claim 1, characterized in that The target association analysis algorithm is used to filter out the indicators that have no association with the first indicator from the second indicators to obtain the second indicators after filtering for the second operation and maintenance objects, specifically including: Calculating the support and confidence between each indicator in the second indicator and the first indicator based on the target association analysis algorithm; The indicators whose support is less than the second preset threshold or whose confidence is less than the third preset threshold are screened out from the second indicators to obtain the screened second indicators.

4. The method according to claim 1, wherein The selecting an indicator from the second indicators filtered by the second operation and maintenance object as the target indicator of the second operation and maintenance object specifically includes: For each second operation and maintenance object, based on the target local outlier factor detection method, the abnormality degree of each indicator in the second indicators after the second operation and maintenance object is screened is calculated, and the indicator with the largest abnormality degree is used as the target indicator of the second operation and maintenance object.

5. The method according to claim 1, wherein The calculating the fault similarity between each second operation and maintenance object and the first operation and maintenance object in the knowledge graph specifically includes: For each fault chain where the second operation and maintenance object is located, the duration of the fault chain is used as the abnormal time window of the fault chain; Within the abnormal time window, based on a target weighted moving average algorithm, calculating a feature of the first indicator of the first operation and maintenance object to obtain a first feature vector of the first operation and maintenance object; Within the abnormal time window, based on the target weighted moving average algorithm, calculating the characteristics of the second indicator of the second operation and maintenance object to obtain a second characteristic vector of the second operation and maintenance object; Based on a cosine similarity algorithm, the fault similarity between the first feature vector and the second feature vector is calculated.

6. The method according to claim 1, wherein The calculating of anomaly scores of the multiple fault chains in the pruned knowledge graph specifically includes: For each of the fault chains, calculating the abnormal probability of each node on the fault chain within a preset time range; Calculate an anomaly score for each node on the fault chain according to the indicator type, anomaly start time, anomaly duration, and anomaly probability of each node on the fault chain; For any node, calculate the ratio of the number of failures of the node to the total number of failures of the previous node under the condition that the previous node fails, and obtain the link weight corresponding to the node; The anomaly score of each node on the fault chain and the weighted average of the link weights corresponding to each node are calculated to obtain the anomaly score of the fault chain.

7. The method according to claim 1, characterized in that Determining the cause of the fault according to the anomaly scores of the multiple fault chains specifically includes: Arrange the anomaly scores of the multiple fault chains in descending order, and select the fault chains corresponding to the top N anomaly scores as candidates for the causes of the current fault, where N is a positive integer.

8. A fault detection device for an application system, characterized in that: include: A first determining module is configured to determine, when a failure occurs in the application system, a first operation and maintenance object corresponding to the failure and a first indicator of the first operation and maintenance object; an acquisition module, configured to acquire a plurality of second operation and maintenance objects associated with the first operation and maintenance object and second indicators corresponding to each of the plurality of second operation and maintenance objects; a screening module, configured to screen out, based on a target association analysis algorithm, indicators that have no association with the first indicator from among the second indicators, and obtain the second indicators after screening for the second operation and maintenance objects; a selection module, configured to select an indicator from the second indicators filtered by the second operation and maintenance object as a target indicator of the second operation and maintenance object; An establishing module, configured to establish a knowledge graph based on the first operation and maintenance object, the first indicator, the second operation and maintenance object, and the target indicator, wherein the knowledge graph includes a plurality of fault chains; a first calculation module, configured to calculate a fault similarity between each second operation and maintenance object and the first operation and maintenance object in the knowledge graph, and prune a fault chain containing the second operation and maintenance object whose fault similarity is less than a first preset threshold; A second calculation module is used to calculate anomaly scores of multiple fault chains in the pruned knowledge graph; a second determining module, configured to determine a cause of the fault according to the anomaly scores of the multiple fault chains; The establishing of a knowledge graph based on the first operation and maintenance object, the first indicator, the second operation and maintenance object, and the target indicator specifically includes: Calculate, based on historical monitoring data, a conditional probability that the second operation and maintenance object has failed, and use the conditional probability as a weight value of the link relationship between the first operation and maintenance object and the second operation and maintenance object; Establishing a triple of the first operation and maintenance object, the second operation and maintenance object, and a link relationship between the first operation and maintenance object and the second operation and maintenance object, and using the first indicator as an attribute of the node where the first operation and maintenance object is located, and using the target indicator as an attribute of the node where the second operation and maintenance object is located; Draw a knowledge graph containing the triples.

9. An electronic device, characterized in that: The electronic device includes: a processor, a memory, and a computer program stored in the memory and executable on the processor. When the computer program is executed by the processor, the steps of the fault detection method for the application system according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the fault detection method for the application system according to any one of claims 1 to 7.

Images