An operation and maintenance data anomaly detection device, method and storage medium

Abstract

The application discloses an operation and maintenance data anomaly detection device and method and a storage medium. An acquisition module acquires operation and maintenance data. A detection module is connected with the acquisition module and is used for receiving the operation and maintenance data of the acquisition module. According to the type of the operation and maintenance data, an anomaly detection algorithm is used to perform anomaly detection processing on the operation and maintenance data to obtain an anomaly detection result. According to the type of the operation and maintenance data, the operation and maintenance data is predicted to obtain a prediction result. The operation and maintenance data including indexes, logs and call chains can be uniformly accessed to the detection module. The interface calling and the input mode of the operation and maintenance data are unified. The anomaly detection processing and the prediction processing are uniformly performed through the detection module. The integration is not needed additionally. The output mode of the result is unified. The convenience is improved. In addition, the anomaly detection algorithm uses unsupervised learning and integrated learning voting. The cumbersome work of labeling and the reuse according to different specific businesses are avoided. The applicability is improved.

Description

Technical Field

[0001] This invention relates to the field of detection technology, and in particular to a device, method and storage medium for detecting anomalies in operation and maintenance data. Background Technology

[0002] Currently, in the field of observable operations and maintenance (O&M), O&M data typically contains different types of data.

[0003] Currently, intelligent algorithm applications based on this operational data are fragmented and independent. Because certain types of data require different processing methods than others—for example, using different algorithms, or multiple processing methods for a single data type—it's cumbersome to input different types of data into different intelligent algorithm applications, and even input the same type of data into different intelligent algorithm applications. Furthermore, the results from these different intelligent algorithm applications need to be re-integrated to understand the overall detection results of the operational data. In addition, current detection algorithms are based on supervised learning or deep learning, resulting in a heavy workload for labeling. Anomaly detection also needs to be combined with specific business needs, making it difficult to standardize. Therefore, current detection algorithms are difficult to reuse and have poor applicability. Summary of the Invention

[0004] Based on this, the purpose of the present invention is to solve at least one of the above problems and provide an operation and maintenance data anomaly detection device, method and storage medium to improve convenience and applicability.

[0005] This invention provides a device for detecting anomalies in operation and maintenance data, comprising:

[0006] The acquisition module is used to acquire operation and maintenance data; the types of operation and maintenance data include metrics, logs, and call chains.

[0007] The detection module, connected to the acquisition module, is used to receive the operation and maintenance data from the acquisition module, perform anomaly detection processing on the operation and maintenance data according to the type of the operation and maintenance data using an anomaly detection algorithm to obtain anomaly detection results, and perform prediction processing on the operation and maintenance data according to the type of the operation and maintenance data to obtain prediction results.

[0008] The anomaly detection algorithm utilizes unsupervised learning and ensemble learning voting.

[0009] This invention also provides a method for detecting anomalies in operation and maintenance data, including:

[0010] Operational and maintenance data is acquired through an acquisition module; the types of operational and maintenance data include metrics, logs, and call chains.

[0011] The detection module receives the operation and maintenance data from the acquisition module, performs anomaly detection processing on the operation and maintenance data according to the type of the operation and maintenance data using an anomaly detection algorithm to obtain anomaly detection results, and performs prediction processing on the operation and maintenance data according to the type of the operation and maintenance data to obtain prediction results.

[0012] The anomaly detection algorithm utilizes unsupervised learning and ensemble learning voting.

[0013] Furthermore, the step of performing predictive processing on the operational data based on its type to obtain a prediction result includes:

[0014] The type of the operation and maintenance data is determined to be the indicator, and a prediction feasibility assessment is performed on the indicator;

[0015] Once the feasibility assessment results are deemed satisfactory, a target prediction algorithm is determined from the set of prediction algorithms, and the prediction result is determined based on the target prediction algorithm and the indicators.

[0016] The set of prediction algorithms includes at least one of Prophet, Holt-Winters, SARIMA, and regression algorithms.

[0017] Furthermore, the feasibility assessment for predicting the aforementioned indicators includes:

[0018] The stability of the aforementioned indicators is verified.

[0019] When the stationarity verification result represents stationary data, the index is periodically processed using the Fourier algorithm to obtain a periodic value.

[0020] When the periodic value meets the preset periodicity, the prediction feasibility assessment result indicates that it has passed.

[0021] Specifically, if the stationarity verification result indicates non-stationary data or the periodic value does not meet the preset periodicity, the prediction feasibility assessment result indicates failure.

[0022] Furthermore, the step of performing anomaly detection processing on the operation and maintenance data according to the type of the operation and maintenance data, and obtaining anomaly detection results, includes:

[0023] The type of the operation and maintenance data is determined to be the call chain. Statistical processing is performed based on the entry service and interface of the call chain to obtain the link diagram of the call chain.

[0024] The link graph of the call chain is divided into communities to obtain several subgraphs of communities;

[0025] The subgraph weights corresponding to the subgraphs of the several communities are calculated by a preset weighting algorithm, and the subgraph weights are sorted to obtain the first detection result; the anomaly detection result includes the first detection result.

[0026] Furthermore, the step of performing anomaly detection processing on the operation and maintenance data according to the type of the operation and maintenance data, and obtaining anomaly detection results, includes:

[0027] The type of the operation and maintenance data is determined to be the log, and the log is subjected to template extraction processing to obtain the target template;

[0028] A second detection result is determined based on the target template; wherein, the anomaly detection result includes the second detection result, and the determination of the second detection result based on the target template includes at least one of the following steps:

[0029] The target template is compared with a preset template. When the target template is a new template, a second detection result representing an anomaly is obtained.

[0030] The quantity index of the target template per unit time is detected. When the difference between the quantity index and the index threshold is greater than the first difference threshold, a second detection result representing an anomaly is obtained.

[0031] The target template is filtered. When the difference between the number of filtered target templates and the preset number is greater than the second difference threshold, a second detection result representing an anomaly is obtained.

[0032] Extract the parameters of the target template. When the parameters are discrete data, calculate the state proportion of the parameters. When the difference between the state proportion and the historical proportion is greater than a third difference threshold, obtain a second detection result representing an anomaly. Alternatively, when the parameters are continuous data, obtain a second detection result representing an anomaly when the parameters are outside the historical variation range.

[0033] Furthermore, the step of performing template extraction processing on the log to obtain the target template includes:

[0034] Extract the log messages from the log and automatically generate several different candidate delimiters for splitting the log messages;

[0035] The candidate delimiter that appears more than a preset threshold number of times is used as the final delimiter, and at least one candidate template is generated.

[0036] Calculate the Jaccard similarity of each candidate template, and merge candidate templates with a Jaccard similarity greater than a preset similarity threshold to obtain the target template.

[0037] Furthermore, the step of performing anomaly detection processing on the operation and maintenance data according to the type of the operation and maintenance data, and obtaining anomaly detection results, includes:

[0038] The type of the operation and maintenance data is determined to be the indicator, and the indicator is classified to obtain different classification indicators;

[0039] The classification index that conforms to a normal distribution is processed by the first algorithm of unsupervised learning to obtain the first processing result.

[0040] The classification index that satisfies the multi-centralized value form is processed by a second algorithm of unsupervised learning to obtain the second processing result;

[0041] The classification index that satisfies the form of slow change is processed by a third algorithm of unsupervised learning to obtain the third processing result;

[0042] The classification indicators that do not satisfy the normal distribution form, the multi-centralized value form, or the slowly changing form are processed by the fourth algorithm of unsupervised learning to obtain the fourth processing result;

[0043] Different classification metrics are processed using a general algorithm for unsupervised learning to obtain the fifth processing result;

[0044] An integrated learning vote is performed on the first processing result, the second processing result, the third processing result, the fourth processing result, and the fifth processing result to obtain a third detection result; the anomaly detection result includes the third detection result.

[0045] This invention also provides an operation and maintenance data anomaly detection device, which includes a processor and a memory. The memory stores at least one instruction, at least one program, code set, or instruction set. The at least one instruction, the at least one program, the code set, or the instruction set are loaded and executed by the processor to implement the method.

[0046] This invention also provides a computer-readable storage medium storing at least one instruction, at least one program, a code set, or an instruction set, wherein the at least one instruction, the at least one program, the code set, or the instruction set is loaded and executed by a processor to implement the method.

[0047] The beneficial effects of this invention are:

[0048] The system acquires operational data via an acquisition module. A detection module, connected to the acquisition module, receives this data and performs anomaly detection processing using an anomaly detection algorithm based on the data type, yielding anomaly detection results. It also performs prediction processing on the data based on its type, yielding prediction results. This allows operational data, including metrics, logs, and call chains, to be uniformly integrated into the detection module, standardizing interface calls and data input methods. Anomaly detection and prediction processing are handled uniformly through the detection module, eliminating the need for additional integration. Furthermore, the output methods for prediction and anomaly detection results are unified, improving convenience. Additionally, the anomaly detection algorithm utilizes unsupervised learning and ensemble learning voting, avoiding tedious labeling work and allowing for reuse based on different specific business needs, thus improving applicability.

[0049] To better understand and implement this invention, the following detailed description is provided in conjunction with the accompanying drawings. Attached Figure Description

[0050] Figure 1 This is a schematic diagram of the operation and maintenance data anomaly detection device of the present invention;

[0051] Figure 2 This is a flowchart illustrating the steps of the operation and maintenance data anomaly detection method of the present invention. Detailed Implementation

[0052] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0053] The terms "first," "second," "third," and "fourth," etc., used in the specification, claims, and accompanying drawings of this application are used to distinguish different objects, not to describe a specific order. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or apparatus that includes a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units not listed, or may optionally include other steps or units inherent to these processes, methods, products, or apparatuses.

[0054] In this document, the term "embodiment" means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this application. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0055] like Figure 1 As shown in the figure, this embodiment of the invention provides an operation and maintenance data anomaly detection device, including an acquisition module and a detection module.

[0056] In this embodiment of the invention, the acquisition module is used to acquire operation and maintenance data, and the types of operation and maintenance data may include, but are not limited to, metrics, logs, and call chains.

[0057] In this embodiment of the invention, the detection module is connected to the acquisition module, providing a unified interface call and data input method for the acquisition module. This allows the module to receive operational data such as metrics, logs, and call chains from the acquisition module. The detection module then processes this operational data to achieve unified output and display of results. Optionally, the processing of operational data by the detection module includes, but is not limited to: performing anomaly detection processing on the operational data according to its type using an anomaly detection algorithm to obtain anomaly detection results; and performing prediction processing on the operational data according to its type to obtain prediction results. It should be noted that the anomaly detection algorithm utilizes unsupervised learning and ensemble learning voting.

[0058] like Figure 2 As shown, this embodiment of the invention provides a method for detecting anomalies in operation and maintenance data, which can be applied to the above-mentioned operation and maintenance data anomaly detection device, including steps S100-S200:

[0059] S100: Obtain operation and maintenance data through the acquisition module.

[0060] Optionally, the types of operational data include, but are not limited to, metrics, logs, and call chains. This operational data can be obtained by using Python SDKs to retrieve data from Kafka, Elasticsearch, or other databases.

[0061] S200: Receive maintenance data from the acquisition module through the detection module; perform anomaly detection processing on the maintenance data according to the type of maintenance data using an anomaly detection algorithm to obtain anomaly detection results; and perform prediction processing on the maintenance data according to the type of maintenance data to obtain prediction results.

[0062] It should be noted that the anomaly detection algorithm utilizes unsupervised learning and ensemble learning voting.

[0063] Optionally, the detection module may include a first AI system, a second AI system, and a third AI system, wherein the first AI system includes a first preprocessing unit, the second AI system includes a second preprocessing unit, and the third AI system includes a third preprocessing unit. In this embodiment of the invention, after the detection module receives the operation and maintenance data from the acquisition module, it may further include a data preprocessing step S201:

[0064] S201. The first preprocessing unit preprocesses the metrics, the second preprocessing unit preprocesses the metrics into logs, and the third preprocessing unit preprocesses the call chain.

[0065] It should be noted that the anomaly detection algorithm and the predictive processing operation and maintenance data in step S200 can both be preprocessed operation and maintenance data. Optionally, the preprocessing of the indicators by the first preprocessing unit includes, but is not limited to: field validation, timestamp conversion, type conversion, extreme point removal, sorting, deduplication, timestamp normalization, data frequency calculation, and missing value completion for the time series data of the indicators; the log preprocessing of the indicators by the second preprocessing unit includes, but is not limited to: regular expression variable replacement, invalid character removal, and invalid log removal; the call chain preprocessing by the third preprocessing unit includes, but is not limited to: filtering out broken chains and incorrect chains.

[0066] In this embodiment of the invention, step S200 involves predictive processing of the maintenance data based on its type to obtain a prediction result, including steps S211-S212, wherein steps S211-S212 can be executed by a first AI system:

[0067] S211. Determine the type of operation and maintenance data as indicators, and conduct a feasibility assessment for predicting the indicators.

[0068] Optionally, the feasibility assessment of the indicator prediction includes steps S2111-S2113:

[0069] S2111, Perform a stability check on the indicators.

[0070] Specifically, the indicators are checked for stationarity. If the stationarity check result indicates non-stationary data, that is, the indicator is non-stationary data, it is considered that it cannot be predicted or the prediction accuracy is low. In this case, the prediction feasibility assessment result is not passed.

[0071] Alternatively, stationarity can be verified using the ADF test, which is based on the regression equation of the ADF test. Specifically, the Python package `arch.unitroot.ADF` can be used to directly calculate the significance level p of the time series data to determine whether the time series data is stationary and whether the trend is stable.

[0072] S2112. When the stationarity verification result represents stationary data, the index is periodically processed using the Fourier algorithm to obtain the periodic value.

[0073] S2113. When the periodic value meets the preset periodicity, the prediction feasibility assessment result is deemed acceptable.

[0074] Specifically, when the stationarity check result indicates stationary data, a periodicity judgment is required. Optionally, the periodicity judgment includes: processing the index periodically using a Fourier algorithm to obtain a periodic value; if the periodic value meets a preset periodicity, it is considered predictable, and the prediction feasibility assessment result is considered passed; if the periodic value does not meet the preset periodicity, the index is considered white noise, unpredictable, or with low prediction accuracy, and the prediction feasibility assessment result is failed. Optionally, by comparing the periodic value corresponding to the maximum amplitude with a preset periodic range, if the periodic value is within the preset periodic range, it is considered to meet the preset periodicity; if the periodic value is outside the preset periodic range, it is considered to not meet the preset periodicity.

[0075] It should be noted that when the stationarity verification result indicates non-stationary data or the periodic value does not meet the preset periodicity, and the prediction feasibility assessment result indicates failure, a valid prediction result cannot be output. Instead, a prediction result with prompts can be obtained, such as: "Unable to predict" or "Please re-acquire operation and maintenance data," without specific limitations.

[0076] S212. When the feasibility assessment results are deemed satisfactory, the target prediction algorithm is determined from the set of prediction algorithms, and the prediction results are determined based on the target prediction algorithm and the indicators.

[0077] Optionally, the algorithms in the prediction algorithm set include, but are not limited to, at least one of Prophet, Holt-Winters, SARIMA, and regression algorithms. When the prediction feasibility assessment result is satisfactory, an algorithm can be selected from the prediction algorithm set as the target prediction algorithm based on machine resources and the user's algorithmic capabilities. The target prediction algorithm is then used to process the indicators to determine the prediction result.

[0078] It's important to note that while Prohet is simple to use and effective, it takes longer to execute than other algorithms and consumes more machine resources. Holt-Winters and SARIMA require specifying multiple hyperparameters such as period values ​​and autocorrelation coefficients, which necessitate time-series analysis of the data, thus having prerequisites, although the data volume requirement is not large. Regression algorithms are simple to use and produce results quickly, but require a large amount of historical data to guarantee effectiveness. Therefore, selecting an algorithm from the set of prediction algorithms as the target prediction algorithm requires comprehensive consideration of the above factors, based on machine resources and the user's algorithmic capabilities. For example, when processing speed is the priority, regression algorithms are used; when ease of use and effectiveness are the priority factors, Prohet is used; when the amount of operational data is less than the data volume threshold, and processing speed and ease of use are not priority factors, Holt-Winters or SARIMA can be used.

[0079] In this embodiment of the invention, step S200 involves performing anomaly detection processing on the operation and maintenance data according to the type of the operation and maintenance data using an anomaly detection algorithm to obtain anomaly detection results, including steps S221-S223, wherein steps S221-S223 can be executed by a third AI system:

[0080] S221. Determine the type of operation and maintenance data as a call chain, perform statistical processing based on the entry service and interface of the call chain, and obtain the link diagram of the call chain.

[0081] Optionally, the type of operation and maintenance data is determined to be a call chain. Based on the entry service and interface, statistical processing is performed on the entry service and interface of the call chain to obtain all link diagrams of the call chain.

[0082] It's important to note that the entry service is the service initially triggered by the user. For example, in a shopping app scenario, submitting an order serves as the entry service. Subsequent processes include generating an order number, automatically calculating the price, and utilizing various Redis, MySQL, and message brokers. The initial trigger for the entire service call process is the order service submission interface (order / create, service / interface). Therefore, all service call chains have graph data with starting points (service / interface). Based on different starting points, numerous call chains can be divided into different call chain graphs, i.e., call chain link graphs. For instance, a shopping app might have an order submission service and an order deletion service (the same service with different interfaces), as well as a payment service and a refund service (the same service with different interfaces).

[0083] S222. Perform community partitioning on the call chain graph to obtain several subgraphs of communities.

[0084] Optionally, the call chain graph can be partitioned into several subgraphs representing different communities using a community partitioning algorithm. It should be noted that community partitioning algorithms include, but are not limited to, LPA, Louvain, and Infomap algorithms.

[0085] S223. Calculate the subgraph weights corresponding to the subgraphs of several communities using a preset weighting algorithm, sort the subgraph weights, and obtain the first detection result.

[0086] Optionally, the subgraph weights corresponding to the subgraphs of several communities are calculated using a preset weighting algorithm, thereby obtaining the subgraph weights corresponding to the subgraphs of several communities. The subgraph weights are then sorted to obtain the root cause node sorting, and the result of the root cause node sorting is the first detection result. The anomaly detection result includes the first detection result; the preset weighting algorithm includes, but is not limited to, the PageRank algorithm. In this embodiment of the invention, when the root cause localization process is triggered (e.g., a span times out), the root cause node sorting result is output according to its specific community. Optionally, each community can correspond to its own root cause node sorting result.

[0087] In this embodiment of the invention, step S200 involves performing anomaly detection processing on the operation and maintenance data according to the type of the operation and maintenance data using an anomaly detection algorithm to obtain an anomaly detection result, including steps S231-S232, wherein steps S231-S232 can be executed by a second AI system:

[0088] S231. Determine that the type of operation and maintenance data is log, perform template extraction processing on the log, and obtain the target template.

[0089] It should be noted that the target template in this embodiment of the invention can be stored in a database for use in subsequent anomaly detection. The extraction process in this embodiment improves upon existing drain methods by automatically generating candidate delimiters. Furthermore, existing drain methods assume that logs belonging to the same log template should have the same length. To reduce the negative impact of this assumption on actual log parsing, this embodiment uses asymmetric Jaccard similarity to merge logs, thereby ultimately generating the target template.

[0090] Optionally, the logs are subjected to template extraction processing to obtain the target template, including steps S2311-S2313:

[0091] S2311. Extract log messages from the logs and automatically generate several different candidate delimiters for splitting the log messages.

[0092] Specifically, when the type of operational data is logs, the log messages in the logs are extracted, and several different candidate delimiters are automatically generated for splitting the log messages.

[0093] S2312. Select the candidate delimiter that appears more than a preset threshold as the final delimiter and generate at least one candidate template.

[0094] Optionally, the preset frequency threshold can be set according to actual needs and is not specifically limited. Specifically, the occurrence frequency of different candidate delimiters is counted, and the candidate delimiters with an occurrence frequency greater than the preset frequency threshold are used as the final delimiters, thereby generating at least one candidate template based on the log messages and the final delimiters.

[0095] S2313. Calculate the Jaccard similarity of each candidate template, and merge the candidate templates with a Jaccard similarity greater than a preset similarity threshold to obtain the target template.

[0096] Optionally, the preset threshold for the number of attempts can be set according to actual needs and is not specifically limited. Specifically, the Jaccard similarity of each candidate template is calculated, and candidate templates with a Jaccard similarity greater than the preset similarity threshold are merged to obtain the target template. It should be noted that when the logs contain different types of logs, there can be multiple target templates, with each type of log corresponding to one type of target template.

[0097] S232. Determine the second detection result based on the target template.

[0098] Specifically, anomaly detection is performed based on the target template to determine a second detection result, where the anomaly detection result includes the second detection result. Determining the second detection result based on the target template includes at least one of the following steps S2321-S2324, where the order of S2321-S2324 is not limited.

[0099] S2321. Compare the target template with the preset template. When the target template is a new template, obtain the second detection result that represents the anomaly.

[0100] Optionally, the preset template is a pre-saved normal template under normal conditions. When logs have different types, there are multiple preset templates, with one preset template corresponding to each type of log. When the target template is compared with the preset template, if the target template contains content different from the preset template or contains content not found in the preset template, the target template is considered a new template, and a second detection result representing an anomaly is obtained.

[0101] S2322. Detect the quantity index of the target template per unit time. When the difference between the quantity index and the index threshold is greater than the first difference threshold, obtain the second detection result that represents the anomaly.

[0102] Optionally, the magnitude of the indicator threshold and the first gap threshold can be set as needed. For example, the indicator threshold can be determined based on historical data to be a normal quantity value or a normal range. The quantity indicators include, but are not limited to, quantity indicators within a single type of target template or quantity indicators for all types of target templates. For example, the quantity indicator within a single type of target template can be: if the quantity of that type of target template increases or decreases to a first value within a unit of time, and the difference between the first value and the indicator threshold is greater than the first gap threshold, it indicates an abnormal change in the quantity indicator, resulting in a second detection result representing an anomaly. As another example, the quantity indicator for all types of target templates can be the total number of all types of target templates. When the total number increases or decreases to a second value, and the difference between the second value and the indicator threshold is greater than the first gap threshold, it indicates an abnormal change in the quantity indicator, resulting in a second detection result representing an anomaly. Alternatively, the total number of all types of target templates can be converted into an indicator, and the detection result can be obtained using the methods in steps S241-S247 below, serving as part of the second detection result.

[0103] S2323. Filter the target template. When the difference between the number of filtered target templates and the preset number is greater than the second difference threshold, obtain the second detection result that represents the anomaly.

[0104] Optionally, the second gap threshold and the preset number can be set according to actual needs. The preset number can be the number of templates with preset keywords under normal conditions. For example, preset keywords include, but are not limited to, certain types of templates with fixed fields (sender, receiver). Therefore, specific senders / receivers can be filtered first, and then the change in such target templates can be monitored to specifically monitor target templates of key objects. Specifically, target templates can be filtered using preset keywords. When the difference between the number of filtered target templates and the preset number is greater than the second gap threshold, a second detection result representing an anomaly is obtained. The number of filtered target templates can be used as an indicator. Step S2323 can obtain the detection result through the methods of steps S241-S247 of the first AI system, which is then used as part of the second detection result.

[0105] S2324. Extract the parameter quantity of the target template. When the parameter quantity is discrete data, calculate the state ratio of the parameter quantity. When the difference between the state ratio and the historical ratio is greater than the third difference threshold, obtain the second detection result representing the anomaly. Alternatively, when the parameter quantity is continuous data, when the parameter quantity is outside the historical variation range, obtain the second detection result representing the anomaly.

[0106] In this embodiment of the invention, abnormal changes / distributions of parameters can be determined by extracting the parameter quantity of the target template, thereby determining the second detection result. Here, the parameter quantity refers to the value represented by the asterisk (*) in the target template. The historical proportion and historical change range are determined under historical normal conditions. The third gap threshold can be set according to actual needs and is not specifically limited. Specifically, when the parameter quantity is discrete data, such as a status field (success or failure), the status proportion of the parameter quantity is calculated. When the difference between the status proportion and the historical proportion is greater than the third gap threshold, a second detection result representing an anomaly is obtained. For example, if the historical proportion of success to failure is 9:1 (i.e., 9), and the calculated status proportion is now 5:5 (i.e., 1), assuming the third gap threshold is 2, then 9-1 is greater than 2, thus obtaining the second detection result representing an anomaly.

[0107] Alternatively, when the parameter is continuous data, such as transmission time, its value can change continuously. For example, the historical range of transmission time might be 20ms-900ms, while the current transmission time is 1300ms, which is outside the historical range. This also yields a second detection result indicating an anomaly. Here, the parameter can serve as an indicator, and step S2324 can obtain the detection result using the methods of steps S241-S247 of the first AI system, which serves as part of the second detection result.

[0108] In this embodiment of the invention, step S200 involves performing anomaly detection processing on the operation and maintenance data according to the type of the operation and maintenance data using an anomaly detection algorithm to obtain anomaly detection results, including steps S241-S247, wherein steps S241-S247 can be executed by the first AI system:

[0109] S241. Determine the type of operation and maintenance data as indicators, classify the indicators, and obtain different classification indicators.

[0110] Optionally, the indicators can be classified using the classification module in the first AI system to obtain different classification indicators. The classification module can either allow manual specification of the classification or automatically determine the specific algorithm used for classification. Algorithms include, but are not limited to, normality checks and density estimations, etc., without specific limitations.

[0111] S242. The classification index that satisfies the normal distribution form is processed by the first algorithm of unsupervised learning to obtain the first processing result.

[0112] Optionally, the first algorithm includes, but is not limited to, nsigma or box plot algorithms. The first algorithm, which is learned in unsupervised learning, performs a first processing on the classification index that satisfies the normal distribution form to obtain the first processing result of anomaly detection.

[0113] For example, data over a period of time (e.g., 1440 values ​​corresponding to 1440 minutes in a day, such as CPU utilization) can be divided into two segments (720+720). The mean and standard deviation of each segment can be calculated. If the difference between the mean and standard deviation of these two segments is less than the difference threshold, the data is considered to meet the normal distribution. Alternatively, the Kolmogorov-Smirnov normality test can be used to determine whether the data meets the normal distribution form, without making specific limitations.

[0114] S243. The classification index that satisfies the multi-centralized value form is processed by the second algorithm of unsupervised learning to obtain the second processing result.

[0115] Optionally, the second algorithm includes, but is not limited to, KDE or DBSCAN. This second algorithm, employing unsupervised learning, performs a second processing on classification indicators that satisfy the multi-centralized value form to obtain the second processing result for anomaly detection. For example, operational data can be divided into several intervals based on their frequency of occurrence, and the indicator corresponding to the interval with the highest frequency can be used as the classification indicator satisfying the multi-centralized value form.

[0116] S244. The classification index that satisfies the form of slow change is processed by the third algorithm of unsupervised learning to obtain the third processing result.

[0117] Optionally, the third algorithm includes, but is not limited to, EWMA or first-order difference + nsigma. The third algorithm, which is based on unsupervised learning, performs third processing on classification indicators that satisfy the form of slow change, and obtains the third processing result of anomaly detection.

[0118] Alternatively, the slow change pattern can be achieved through human visualization or machine judgment. For example, certain classification indicators that do not undergo abrupt changes are typically selected, such as engine speed. The speed will gradually increase or decrease, and if the change in engine speed per unit time is less than or equal to the change threshold, it is considered to meet the slow change pattern.

[0119] S245. Classification indicators that do not satisfy the normal distribution form, multiple concentration value form, or slow change form are processed by the fourth algorithm of unsupervised learning to obtain the fourth processing result.

[0120] Optionally, classification indicators that do not satisfy the normal distribution form, multiple central value form, or slowly changing form are considered special cases. The fourth algorithm includes, but is not limited to, CUSUM. In this case, the classification indicators of the special cases are processed by the unsupervised learning fourth algorithm to obtain the fourth processing result of anomaly detection.

[0121] S246. Different classification indicators are processed using a general algorithm for unsupervised learning to obtain the fifth processing result.

[0122] Optionally, the general algorithm is a general machine learning algorithm, including but not limited to Isolation Forest, LOF, oneClassSVM, etc., and all different classification indicators are processed by the general algorithm of unsupervised learning to obtain the fifth processing result.

[0123] S247. Perform integrated learning voting on the first processing result, the second processing result, the third processing result, the fourth processing result, and the fifth processing result to obtain the third detection result.

[0124] Optionally, in this embodiment of the invention, the fifth processing result obtained by the general algorithm is combined with the first, second, third, and fourth processing results for integrated learning and voting to achieve joint judgment and obtain a third detection result with higher accuracy. The anomaly detection result includes the third detection result.

[0125] In this embodiment of the invention, the detection module uniformly outputs, stores, and displays the obtained anomaly detection results (including the first detection result, the second detection result, and the third detection result) and the prediction results. Optionally, the output can also be in the form of an alarm.

[0126] It should be noted that the algorithms in the prediction algorithm set, including the community partitioning algorithm, the algorithm for calculating Jaccard similarity, the first algorithm, the second algorithm, the third algorithm, and the general algorithm, are all unsupervised learning algorithms. This helps to avoid the tedious work of labeling and facilitates reuse according to different specific business needs.

[0127] In this embodiment of the invention, users can start real-time / offline tasks via API interfaces. All algorithms in the detection module support both offline and online modes, meaning they can be used for single calls or run in the background for real-time use. Furthermore, the detection module uses Celery to create and stop background task processes. It should be noted that the acquisition module can accept data from various databases as data sources, such as Kafka, InfluxDB, Elasticsearch, and MySQL. These data sources can be encapsulated into a data module using a Python SDK for convenient unified access. Anomaly detection results and prediction results obtained from the detection module can also be input into the data module for storage and retrieval, thus realizing the input and output of the data module.

[0128] Compared to existing technologies, the operation and maintenance data anomaly detection method of this invention:

[0129] 1. It integrates intelligent algorithms for observable operation and maintenance data. By unifying the interface calls, data inputs, and result outputs through the acquisition and detection modules, it facilitates the first, second, and third AI systems of the detection module to assist in intelligent and observable operation and maintenance.

[0130] 2. It innovatively abandons large supervised learning models such as deep learning and adopts unsupervised learning algorithms. It uses the idea of ​​ensemble learning voting to output results. It is simple to use, highly interpretable, and fast in operation. It does not require updates or iterations, thus avoiding the drawback of retraining after the model performance deteriorates.

[0131] 3. Step S231 improves upon the existing drain algorithm, and step S232 adds several methods to the log anomaly detection, enabling better and more comprehensive detection of system log anomalies.

[0132] 4. Steps S221-S223 use a community partitioning + PageRank method for root cause localization of the call chain. The offline + online approach speeds up root cause recommendation and can provide root cause nodes in seconds.

[0133] The contents of the above device embodiments are all applicable to the present method embodiments. The specific functions implemented in the present method embodiments are the same as those in the above device embodiments, and the beneficial effects achieved are also the same as those achieved in the above device embodiments, so they will not be repeated here.

[0134] This invention also provides another operation and maintenance data anomaly detection device, which includes a processor and a memory. The memory stores at least one instruction, at least one program, code set, or instruction set. The processor loads and executes the at least one instruction, at least one program, code set, or instruction set to implement the operation and maintenance data anomaly detection method of the aforementioned embodiments. Optionally, the operation and maintenance data anomaly detection device includes, but is not limited to, mobile phones, tablets, computers, and vehicle-mounted computers.

[0135] The content of the above method embodiments is applicable to the device embodiments. The specific functions implemented by the device embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments, so they will not be repeated here.

[0136] This invention also provides a computer-readable storage medium storing at least one instruction, at least one program, code set, or instruction set, wherein the at least one instruction, at least one program, code set, or instruction set is loaded and executed by a processor to implement the operation and maintenance data anomaly detection method of the aforementioned embodiments.

[0137] This invention also provides a computer program product or computer program, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the operation and maintenance data anomaly detection method described in the foregoing embodiments.

[0138] The terms “first,” “second,” “third,” “fourth,” etc. (if present) in the specification and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms “comprising” and “having,” and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0139] It should be understood that in this application, "at least one (item)" means one or more, and "more than" means two or more. "And / or" is used to describe the relationship between related objects, indicating that three relationships can exist. For example, "A and / or B" can represent three cases: only A exists, only B exists, and both A and B exist simultaneously, where A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. "At least one (item) of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one (item) of a, b, or c can represent: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, and c can be single or multiple.

[0140] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative. For instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the shown or discussed mutual couplings, direct couplings, or communication connections may be through some interfaces; indirect couplings or communication connections between devices or units may be electrical, mechanical, or other forms. Units described as separate components may or may not be physically separate, and components shown as units may or may not be physical units, i.e., they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs. Additionally, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The integrated units described above can be implemented in hardware or as software functional units.

[0141] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes multiple instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing programs, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0142] The above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit it. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.

Claims

1. A device for detecting anomalies in operation and maintenance data, characterized in that, include: The acquisition module is used to acquire operation and maintenance data; the types of operation and maintenance data include metrics, logs, and call chains. The detection module, connected to the acquisition module, is used to receive the operation and maintenance data from the acquisition module, perform anomaly detection processing on the operation and maintenance data according to the type of the operation and maintenance data using an anomaly detection algorithm to obtain anomaly detection results, and perform prediction processing on the operation and maintenance data according to the type of the operation and maintenance data to obtain prediction results. The step of performing anomaly detection processing on the operation and maintenance data according to the type of the operation and maintenance data, and obtaining anomaly detection results, includes: The operation and maintenance data is determined to be of the log type. The log is then subjected to template extraction processing to obtain a target template. Specifically: the log messages of the log are extracted, and several different candidate delimiters for splitting the log messages are automatically generated; the candidate delimiters that appear more than a preset threshold number of times are used as the final delimiters to generate at least one candidate template; the Jaccard similarity of each candidate template is calculated, and the candidate templates with Jaccard similarity greater than a preset similarity threshold are merged to obtain the target template. A second detection result is determined based on the target template; wherein, the anomaly detection result includes the second detection result, and the determination of the second detection result based on the target template includes at least one of the following steps: The target template is compared with a preset template. When the target template is a new template, a second detection result representing an anomaly is obtained. The quantity index of the target template per unit time is detected. When the difference between the quantity index and the index threshold is greater than the first difference threshold, a second detection result representing an anomaly is obtained. The target template is filtered. When the difference between the number of filtered target templates and the preset number is greater than the second difference threshold, a second detection result representing an anomaly is obtained. Extract the parameters of the target template. When the parameters are discrete data, calculate the state proportion of the parameters. When the difference between the state proportion and the historical proportion is greater than a third difference threshold, obtain a second detection result representing an anomaly. Alternatively, when the parameters are continuous data, obtain a second detection result representing an anomaly when the parameters are outside the historical range of change. The anomaly detection algorithm utilizes unsupervised learning and ensemble learning voting.

2. A method for detecting anomalies in operation and maintenance data, characterized in that, include: Operational and maintenance data is acquired through an acquisition module; the types of operational and maintenance data include metrics, logs, and call chains. The detection module receives the operation and maintenance data from the acquisition module, performs anomaly detection processing on the operation and maintenance data according to the type of the operation and maintenance data using an anomaly detection algorithm to obtain anomaly detection results, and performs prediction processing on the operation and maintenance data according to the type of the operation and maintenance data to obtain prediction results. The step of performing anomaly detection processing on the operation and maintenance data according to the type of the operation and maintenance data, and obtaining anomaly detection results, includes: The operation and maintenance data is determined to be of the log type. The log is then subjected to template extraction processing to obtain a target template. Specifically: the log messages of the log are extracted, and several different candidate delimiters for splitting the log messages are automatically generated; the candidate delimiters that appear more than a preset threshold number of times are used as the final delimiters to generate at least one candidate template; the Jaccard similarity of each candidate template is calculated, and the candidate templates with Jaccard similarity greater than a preset similarity threshold are merged to obtain the target template. A second detection result is determined based on the target template; wherein, the anomaly detection result includes the second detection result, and the determination of the second detection result based on the target template includes at least one of the following steps: The target template is compared with a preset template. When the target template is a new template, a second detection result representing an anomaly is obtained. The quantity index of the target template per unit time is detected. When the difference between the quantity index and the index threshold is greater than the first difference threshold, a second detection result representing an anomaly is obtained. The target template is filtered. When the difference between the number of filtered target templates and the preset number is greater than the second difference threshold, a second detection result representing an anomaly is obtained. Extract the parameters of the target template. When the parameters are discrete data, calculate the state proportion of the parameters. When the difference between the state proportion and the historical proportion is greater than a third difference threshold, obtain a second detection result representing an anomaly. Alternatively, when the parameters are continuous data, obtain a second detection result representing an anomaly when the parameters are outside the historical range of change. The anomaly detection algorithm utilizes unsupervised learning and ensemble learning voting.

3. The method for detecting anomalies in operation and maintenance data according to claim 2, characterized in that: The step of performing predictive processing on the operation and maintenance data according to the type of the operation and maintenance data to obtain the prediction result includes: The type of the operation and maintenance data is determined to be the indicator, and a prediction feasibility assessment is performed on the indicator; Once the feasibility assessment results are deemed satisfactory, a target prediction algorithm is determined from the set of prediction algorithms, and the prediction result is determined based on the target prediction algorithm and the indicators. The set of prediction algorithms includes at least one of Prophet, Holt-Winters, SARIMA, and regression algorithms.

4. The method for detecting anomalies in operation and maintenance data according to claim 3, characterized in that: The feasibility assessment for predicting the aforementioned indicators includes: The stability of the aforementioned indicators is verified. When the stationarity verification result represents stationary data, the index is periodically processed using the Fourier algorithm to obtain a periodic value. When the periodic value meets the preset periodicity, the prediction feasibility assessment result indicates that it has passed. Specifically, if the stationarity verification result indicates non-stationary data or the periodic value does not meet the preset periodicity, the prediction feasibility assessment result indicates failure.

5. The method for detecting anomalies in operation and maintenance data according to any one of claims 2-4, characterized in that: The step of performing anomaly detection processing on the operation and maintenance data according to the type of the operation and maintenance data, and obtaining anomaly detection results, includes: The type of the operation and maintenance data is determined to be the call chain. Statistical processing is performed based on the entry service and interface of the call chain to obtain the link diagram of the call chain. The link graph of the call chain is divided into communities to obtain several subgraphs of communities; The subgraph weights corresponding to the subgraphs of the several communities are calculated by a preset weighting algorithm, and the subgraph weights are sorted to obtain the first detection result; the anomaly detection result includes the first detection result.

6. The method for detecting anomalies in operation and maintenance data according to any one of claims 2-4, characterized in that: The step of performing anomaly detection processing on the operation and maintenance data according to the type of the operation and maintenance data, and obtaining anomaly detection results, includes: The type of the operation and maintenance data is determined to be the indicator, and the indicator is classified to obtain different classification indicators; The classification index that conforms to a normal distribution is processed by the first algorithm of unsupervised learning to obtain the first processing result. The classification index that satisfies the multi-centralized value form is processed by a second algorithm of unsupervised learning to obtain the second processing result; The classification index that satisfies the form of slow change is processed by a third algorithm of unsupervised learning to obtain the third processing result; The classification indicators that do not satisfy the normal distribution form, the multi-centralized value form, or the slowly changing form are processed by the fourth algorithm of unsupervised learning to obtain the fourth processing result; Different classification metrics are processed using a general algorithm for unsupervised learning to obtain the fifth processing result; An integrated learning vote is performed on the first processing result, the second processing result, the third processing result, the fourth processing result, and the fifth processing result to obtain a third detection result; the anomaly detection result includes the third detection result.

7. A device for detecting anomalies in operation and maintenance data, characterized in that: The operation and maintenance data anomaly detection device includes a processor and a memory. The memory stores at least one instruction, at least one program, code set, or instruction set. The at least one instruction, the at least one program, the code set, or the instruction set is loaded and executed by the processor to implement the method as described in any one of claims 2-6.

8. A computer-readable storage medium, characterized in that: The storage medium stores at least one instruction, at least one program, code set, or instruction set, wherein the at least one instruction, the at least one program, the code set, or the instruction set is loaded and executed by a processor to implement the method as described in any one of claims 2-6.

Images