Abnormality early warning method and device, and related equipment

Abstract

The application provides an abnormality early warning method, device and related equipment, wherein the method comprises: acquiring K time series data corresponding to K service indexes for representing service states, the time series data comprises historical time series data and current time series data, K is a positive integer; determining target abnormality thresholds of K current moments corresponding to each index in the K service indexes based on the K historical time series data; and outputting early warning information based on the K current time series data and the target abnormality thresholds of the K current moments. The method provided by the application improves the accuracy of the abnormality detection result, and solves the problem of inaccurate detection result in the prior art.

Description

Technical Field

[0001] This application relates to the field of communication technology, and in particular to an anomaly early warning method, device and related equipment. Background Technology

[0002] Anomaly early warning methods, which enable early detection and rapid repair of faults by detecting anomalies (also known as anomaly moments), are an important means of improving the reliability of communication networks. Anomalies that represent a degradation in service performance are mainly detected by monitoring and detecting relevant service performance indicators.

[0003] In actual business operations, outliers are business metrics that affect business perception. Existing anomaly warning methods typically rely on experience to manually determine an anomaly threshold for a business metric, then compare the observed value of that metric with the threshold, and finally determine whether the observed value is an outlier based on the comparison result. If it is an outlier, a relevant alarm is generated. However, the anomaly threshold in existing technologies is a fixed value, while actual business operations are dynamic. A fixed threshold may not reflect the actual changes in business development, potentially leading to inaccurate detection results. In other words, existing anomaly warning methods suffer from inaccurate detection results. Summary of the Invention

[0004] This application provides an anomaly warning method, apparatus, and related equipment, which solves the problem that the detection results of existing anomaly warning methods are not very accurate.

[0005] To achieve the above objectives, in a first aspect, embodiments of this application provide an anomaly warning method, comprising:

[0006] Obtain K time-series data corresponding to K business indicators to characterize the business status. The time-series data includes historical time-series data and current time-series data, where K is a positive integer.

[0007] Based on K historical time-series data, determine the K target anomaly thresholds for each of the K business indicators at the current moment;

[0008] Based on K current time-series data and the target anomaly thresholds at the K current times, an early warning message is output.

[0009] Secondly, embodiments of this application provide an anomaly warning device, comprising:

[0010] The first acquisition module is used to acquire K time-series data corresponding to K business indicators to characterize the business status. The time-series data includes historical time-series data and current time-series data, where K is a positive integer.

[0011] The first determining module is used to determine the target anomaly thresholds at the current time corresponding to each of the K business indicators based on K historical time series data.

[0012] The first output module is used to output early warning information based on K current time series data and the target anomaly thresholds at the K current times.

[0013] Thirdly, embodiments of this application provide an electronic device, including a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the computer program, when executed by the processor, implements the steps in the abnormal warning method described in the first aspect.

[0014] Fourthly, embodiments of this application provide a readable storage medium storing a program, which, when executed by a processor, implements the steps in the anomaly warning method described in the first aspect.

[0015] In this embodiment, the anomaly warning method includes acquiring K time-series data corresponding to K business indicators to characterize business status. The time-series data includes historical time-series data and current time-series data, where K is a positive integer. Based on the K historical time-series data, it determines K target anomaly thresholds corresponding to each of the K business indicators at the current time. Based on the K current time-series data and the K target anomaly thresholds at the current time, it outputs warning information. By determining the target anomaly thresholds corresponding to the business indicators using the acquired historical time-series data, the target anomaly thresholds can be determined according to the dynamically evolving business. The determined target anomaly thresholds change according to the actual development and changes of the business, thus reflecting the actual business situation. Therefore, comparing the current time-series data with the target anomaly thresholds to output warning information reflects the actual development and changes of the business, improves the accuracy of anomaly detection results, and solves the problem of inaccurate detection results in existing anomaly warning methods. Attached Figure Description

[0016] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings are described below. Obviously, the following drawings are only embodiments of this application. For those skilled in the art, other drawings can be obtained based on the listed drawings without creative effort.

[0017] Figure 1 This is one of the flowcharts of the anomaly warning method provided in the embodiments of this application;

[0018] Figure 2 This is the second flowchart of the anomaly warning method provided in the embodiments of this application;

[0019] Figure 3This is the third flowchart of the anomaly warning method provided in the embodiments of this application;

[0020] Figure 4 This is one of the structural schematic diagrams of the abnormality early warning device provided in the embodiments of this application;

[0021] Figure 5 This is a second schematic diagram of the structure of the abnormality warning device provided in the embodiments of this application;

[0022] Figure 6 This is a schematic diagram of the structure of the electronic device provided in the embodiments of this application. Detailed Implementation

[0023] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of this application.

[0024] See Figure 1 , Figure 1 This is one of the flowcharts for the anomaly warning method provided in the embodiments of this application. For example... Figure 1 As shown, the anomaly warning method may include the following steps:

[0025] Step 101: Obtain K time-series data corresponding to K business indicators to represent business status. The time-series data includes historical time-series data and current time-series data, where K is a positive integer.

[0026] The aforementioned time-series data includes data collected at different times. Divided by time, time-series data includes historical time-series data and current time-series data. Historical time-series data includes historical moments and corresponding indicator values, while current time-series data includes the current moment and corresponding indicator values. Time-series data can be understood as indicator values ​​collected at fixed time intervals within a certain period, along with the corresponding moments. Time-series data describes how business status changes over time; specifically, the indicator values ​​in time-series data can characterize business status.

[0027] The aforementioned services can be internet services such as WeChat and Tencent Video. Each service may encounter multiple service issues, and these issues have a one-to-one correspondence with service metrics. Potential service issues in internet services include wireless access network problems, core network problems, access perception issues caused by sudden increases / decreases in traffic, degradation of local Internet Data Center (IDC) resource metrics, degradation of local Content Delivery Network (CDN) resource metrics, degradation of local leased line direct connection resource metrics, degradation of Hypertext Transfer Protocol (HTTP) metrics for resources on external provincial networks, and degradation of HTTP metrics for inter-network resources. In practice, these service metrics can be mapped one-to-one with potential service issues. If the value of a service metric in the time-series data is abnormal, then the service issue corresponding to that metric can be identified.

[0028] Step 102: Based on K historical time-series data, determine the K target anomaly thresholds for each of the K business indicators at the current time.

[0029] In practical implementation, historical anomaly thresholds, historical anomaly times, historical non-anomaly times, and the average value of indicator values ​​at historical non-anomaly times can be determined based on K historical time-series data for each of the K business indicators. Historical anomaly thresholds can be determined manually based on experience. Historical time-series data can consist of several times prior to the current time, along with the corresponding indicator values ​​for those times. If there are few anomaly times among those times, the target anomaly threshold for the current time can be determined based on the indicator values ​​at those times, rather than directly using the historical anomaly threshold as the target anomaly threshold for the current time. This approach takes into account the dynamic development of actual business operations.

[0030] The K mentioned above can be a positive integer of 1 or greater than 1. When K equals 1, the target anomaly threshold for the current moment corresponding to a single business indicator can be considered. When K is greater than 1, the correlation between the K business indicators can be comprehensively considered to determine the K target anomaly thresholds for the current moment corresponding to each of the K business indicators.

[0031] Step 103: Based on K current time-series data and the target anomaly thresholds at the K current times, output early warning information.

[0032] In practice, the current time-series data value of each of the K business metrics can be compared with the target anomaly threshold at the current moment, and an early warning message can be output based on the comparison result. If the comparison result indicates that the current metric value is abnormal, it can be determined that a business problem has occurred corresponding to that business metric, and an early warning message can be output to remind relevant personnel to handle the issue.

[0033] In this embodiment, the anomaly warning method includes acquiring K time-series data corresponding to K business indicators to characterize business status. The time-series data includes historical time-series data and current time-series data, where K is a positive integer. Based on the K historical time-series data, it determines K target anomaly thresholds corresponding to each of the K business indicators at the current time. Based on the K current time-series data and the K target anomaly thresholds at the current time, it outputs warning information. By determining the target anomaly thresholds corresponding to the business indicators using the acquired historical time-series data, the target anomaly thresholds can be determined according to the dynamically evolving business. The determined target anomaly thresholds change according to the actual development and changes of the business, thus reflecting the actual business situation. Therefore, comparing the current time-series data with the target anomaly thresholds to output warning information reflects the actual development and changes of the business, improves the accuracy of anomaly detection results, and solves the problem of inaccurate detection results in existing anomaly warning methods.

[0034] Optionally, step 102 includes:

[0035] Step 1021: Based on the K historical time series data, determine the number Q of the comprehensive abnormal moments of the K business indicators in the T moments before the current moment, where T is a positive integer greater than 1 and Q is a natural number. The comprehensive abnormal moment is the abnormal moment determined by comprehensively considering the abnormal situations of the K business indicators.

[0036] In practical implementation, machine learning algorithms can be used to learn the correlation between K business metrics and perform overall anomaly detection to determine the comprehensive anomaly moment. The specific value of T can be determined according to actual needs and is not restricted here; for example, the value of T can be 7.

[0037] Step 1022: If the number Q of the comprehensive abnormal moments is greater than the first preset value, then the historical abnormal threshold of the pre-acquired historical period is determined as the target abnormal threshold.

[0038] The aforementioned historical anomaly thresholds are historical anomaly thresholds that correspond one-to-one with each of the K business indicators.

[0039] In practice, the value of the first preset value is related to the value of T. For example, if T is 7, the value of the first preset value can be 2. The value of the first preset value is also related to the actual needs. For example, if T is 7, the value of the first preset value can be any one of 1, 2, 3, 4, or 5. If the tolerance for abnormal moments is low, the first preset value can be 1 or 2; if the tolerance for abnormal moments is high, the first preset value can be 4 or 5.

[0040] If the total number of abnormal moments, Q, is greater than a first preset value, it indicates that anomalies occurred frequently in moments prior to the current moment. If the target anomaly threshold is determined based on historical time-series data, then historical time-series data with multiple instances of anomalies would be used as the basis for determining the target anomaly threshold, potentially leading to inaccurate threshold values. Therefore, when the total number of abnormal moments, Q, is greater than the first preset value, using pre-acquired historical anomaly threshold values ​​for historical periods as the target anomaly threshold avoids using historical time-series data with multiple instances of anomalies as the basis for determining the target anomaly threshold, thus improving the accuracy of the target anomaly threshold.

[0041] Step 1023: If the number of comprehensive abnormal moments Q is less than or equal to the first preset value, then determine K target abnormal thresholds based on the historical abnormal thresholds and the K historical time series data.

[0042] As mentioned earlier, the aforementioned historical anomaly thresholds are historical anomaly thresholds that correspond one-to-one with each of the K business metrics. Since each of the K business metrics corresponds to one of the K historical time-series data, the target anomaly threshold corresponding to each of the K business metrics can be determined based on the historical anomaly thresholds corresponding to each of the K business metrics and the historical time-series data corresponding to each of the K business metrics.

[0043] For example, taking the determination of the target anomaly threshold of one of the K business metrics as an example, in specific implementation, step 1023 above may include:

[0044] The target anomaly threshold is determined according to a first expression, where the first expression is:

[0045]

[0046] Among them, T p T is the target anomaly threshold. h For historical anomaly thresholds, KPIs h KPI is the average value of the indicator at non-abnormal historical times. p-t The index value is the value of the index t moments before the current moment. The historical time series data includes the index values ​​of the index t moments before the current moment.

[0047] As mentioned earlier, T can take the value 7. When T is 7, the first expression is:

[0048]

[0049] The determination of the target anomaly threshold for other business indicators among the K business indicators can be done in a similar way, and will not be elaborated here.

[0050] It should be understood that actual business is dynamic and evolving. Historical time-series data can reflect the actual development and changes in the business. The target anomaly threshold determined based on historical time-series data can reflect the actual development and changes in the business. Therefore, such a dynamically determined target anomaly threshold can improve the accuracy of anomaly detection results.

[0051] Optionally, step 1021 above includes:

[0052] Step 10211: Input the K historical time series data into M algorithm models for anomaly detection to determine a comprehensive set of anomaly times. The comprehensive set of anomaly times includes the comprehensive anomaly times corresponding to the K historical time series data, where M is a positive integer greater than or equal to 1. The algorithm model is a model obtained after learning and training based on the K time series data.

[0053] In practice, the above algorithm model can be used to learn the correlation between multiple business indicators, perform overall anomaly detection, and output a comprehensive anomaly moment. The above algorithm model can be implemented using the Python OutlierDetection (PYOD) toolkit. The selected algorithm can be at least one of the following: Angle-based Outlier Detector (ABOD), Average KNN, Cluster-based Local Outlier Factor (CBLOF), Feature Bagging, Histogram-based Outlier Detection (HBOS), Isolation Forest, K-Nearest Neighbors (KNN), Local Outlier Factor (LOF), Locally Selective Combination (LSCP), Minimum Covariance Determinant (MCD), One-class SVM (OCSVM), and Principal Component Analysis (PCA).

[0054] K historical time-series data can be input sequentially or simultaneously into M algorithm models for anomaly detection. Each of the M algorithm models outputs a comprehensive anomaly time. The comprehensive anomaly time set can be determined based on the comprehensive anomaly time output by each of the M algorithm models. Specifically, when M is greater than 1, if all N algorithm models determine that the first time is a comprehensive anomaly time, then the first time is determined as the comprehensive anomaly time in the comprehensive anomaly time set, where N is a positive integer greater than or equal to 1.

[0055] In practical implementation, if M is 12, then N can be 3, or a positive integer greater than 3 and less than 12. After anomaly detection by the algorithm model, 12 individual judgment results are obtained. To enhance the robustness of the results, a voting mechanism is used to combine the results of the 12 algorithms to obtain the final detection result. That is, when more than 3 algorithm models consider the first moment to be the comprehensive anomaly moment, the first moment is determined as the comprehensive anomaly moment in the set of comprehensive anomaly moments. Determining the final result through the voting mechanism can avoid inaccurate results due to randomness, thereby improving the accuracy of the detection results.

[0056] Step 10212: Based on the comprehensive abnormal time set, determine the number Q of comprehensive abnormal times for the K business indicators in the T times before the current time. Specifically, by counting the number of comprehensive abnormal times in the comprehensive abnormal time set, the number Q of comprehensive abnormal times for the K business indicators in the T times before the current time can be obtained.

[0057] In this embodiment of the application, the correlation between K business indicators is obtained through the above algorithm model, and the correlation between the K business indicators can be analyzed and a comprehensive judgment result can be output.

[0058] Optionally, step 103 includes:

[0059] The K current time-series data are compared with the K target anomaly thresholds to determine the abnormal business indicators among the K business indicators at the current time.

[0060] Based on the aforementioned abnormal business indicators, abnormal information is determined;

[0061] Based on the aforementioned anomaly information, an early warning message is output.

[0062] In practice, the rules for determining abnormal business indicators differ depending on the specific business indicator. For example, for some business indicators, if the indicator value in the current time series data is greater than the target abnormal threshold, then the business indicator at the current moment is considered abnormal. For other business indicators, if the indicator value in the current time series data is less than the target abnormal threshold, then the business indicator at the current moment is considered abnormal. The current time series data corresponding to each of the K business indicators is compared with the target abnormal threshold corresponding to each of the K business indicators to obtain the abnormality status of each of the K business indicators and determine the abnormal business indicator.

[0063] As mentioned earlier, there is a one-to-one correspondence between business metrics and business issues. Business issues can be directly identified from abnormal business metrics, and abnormal information includes business issues identified based on abnormal business metrics. Furthermore, early warning information is output based on these business issues.

[0064] See Figure 2 It can also be based on Figure 2 The process shown is as follows: Figure 2 The order shown indicates whether the business metrics for overall HTTP response latency, deteriorating HTTP response success rate, and overall TCP wireless latency are abnormal. If any metrics are abnormal, the output should be as follows: Figure 2The warning information shown is as follows. If the service metric corresponding to the overall TCP wireless latency is an abnormal service metric, a warning message for a network problem on the wireless access side is output; if the service metric corresponding to the overall TCP core degradation latency is an abnormal service metric, a warning message for a core network problem is output. This is achieved by adopting... Figure 2 The illustrated process involves identifying business problems, and the judgment process is rigorous. Furthermore... Figure 2 The process shown prioritizes business metrics that are historically more likely to cause business problems, which can improve the efficiency of identifying business problems.

[0065] Optionally, determining the abnormal information based on the abnormal business indicators includes:

[0066] Based on the current time-series data corresponding to the abnormal business indicators and the target abnormal threshold corresponding to the abnormal business indicators, the abnormality degree of each indicator in the abnormal business indicators is determined.

[0067] Sort the multiple anomalies in ascending order to determine the first J1 target anomalies, or sort the multiple anomalies in descending order to determine the last J2 target anomalies, where J1 and J2 are both positive integers.

[0068] Based on the J1 or J2 target anomalies, anomaly information is output. Specifically, the anomaly degree of each indicator can be determined according to the second expression. The second expression is:

[0069] S p =|KPI p -T p | / T p

[0070] In the formula, S p For anomalies, KPI p T represents the indicator value corresponding to the current time point in the current time series data. P The target anomaly threshold.

[0071] The specific values ​​of J1 and J2 can be determined based on actual processing capabilities. If the business problem processing capability is strong, the specific values ​​of J1 and J2 can be larger. Output the business problems corresponding to J1 or J2 target anomalies to remind relevant personnel to handle them. Anomaly information includes the business problems corresponding to J1 or J2 target anomalies.

[0072] When a severe disruption to business operations occurs, all business metrics may be affected and deviate from normal thresholds. Therefore, it is necessary to rank all abnormal business metrics at the time of the overall anomaly. The higher the ranking of the business metrics, the greater the impact on user perception, i.e., the more severe the impact of the business problem. Therefore, the top-ranked abnormal business metrics should be selected first to identify the business problems related to them and fix them.

[0073] To make it easier to understand, the following will be combined with Figure 3 The methods provided in the embodiments of this application will be described.

[0074] See Figure 3 In this embodiment, the first step is to input K time-series data corresponding to K business metrics. Then, a comprehensive anomaly detection can be performed using a machine learning algorithm. Next, target anomaly thresholds for the K current moments corresponding to each of the K business metrics are determined. Following this, the anomaly degree of each business metric is determined and sorted. Finally, the business problem is identified, and a warning message is output. Detailed processes for the above steps can be found in the corresponding sections above and will not be repeated here.

[0075] This application's embodiments integrate machine learning anomaly detection methods with practical scenarios and empirical methods in the field of internet business quality monitoring. First, machine learning algorithms are used to capture the correlation between indicators for overall monitoring. Then, a dynamic target anomaly threshold method is used to detect the health of individual business indicators one by one, and problems are located based on the ranking of anomaly severity. This approach is highly adaptable and flexible.

[0076] Secondly, see Figure 4 This application provides an abnormality warning device 200, comprising:

[0077] The first acquisition module 201 is used to acquire K time-series data corresponding to K business indicators to characterize the business status. The time-series data includes historical time-series data and current time-series data, where K is a positive integer.

[0078] The first determining module 202 is used to determine the target anomaly thresholds at the current time corresponding to each of the K business indicators based on K historical time-series data.

[0079] The first output module 203 is used to output early warning information based on K current time series data and the target anomaly thresholds of the K current times.

[0080] Optionally, see Figure 5 The first determining module 202 includes:

[0081] The first determining unit 2021 is used to determine the number Q of the comprehensive abnormal moments of the K business indicators in the T moments before the current moment based on the K historical time series data, where T is a positive integer greater than 1 and Q is a natural number, and the comprehensive abnormal moment is an abnormal moment determined by comprehensively considering the abnormal situation of the K business indicators.

[0082] The second determining unit 2022 is used to determine the historical anomaly threshold of the pre-acquired historical period as the target anomaly threshold if the number Q of the comprehensive anomaly moments is greater than the first preset value.

[0083] The third determining unit 2023 is used to determine K target anomaly thresholds based on the historical anomaly thresholds and the K historical time series data if the number Q of the comprehensive anomaly moments is less than or equal to the first preset value.

[0084] Optionally, the third determining unit 2023 includes:

[0085] The target anomaly threshold is determined according to a first expression, where the first expression is:

[0086]

[0087] Among them, T p T is the target anomaly threshold. h For historical anomaly thresholds, KPIs h KPI is the average value of the indicator at non-abnormal historical times. p-t The index value is the value of the index t moments before the current moment. The historical time series data includes the index values ​​of the index t moments before the current moment.

[0088] Optionally, the first determining unit 2021 includes:

[0089] The K historical time series data are input into M algorithm models for anomaly detection to determine a comprehensive set of anomaly moments. The comprehensive set of anomaly moments includes the comprehensive anomaly moments corresponding to the K historical time series data, where M is a positive integer greater than or equal to 1. The algorithm model is obtained by learning and training based on the K time series data.

[0090] Based on the comprehensive abnormal time set, determine the number Q of comprehensive abnormal times for the K business indicators in the T times before the current time;

[0091] Where M is greater than 1, if the first moment is determined to be a comprehensive abnormal moment according to all N algorithm models, then the first moment is determined to be the comprehensive abnormal moment in the set of comprehensive abnormal moments, and N is a positive integer greater than or equal to 1.

[0092] Optionally, the first output module 203 includes:

[0093] The K current time-series data are compared with the K target anomaly thresholds to determine the abnormal business indicators among the K business indicators at the current time.

[0094] Based on the aforementioned abnormal business indicators, abnormal information is determined;

[0095] Based on the aforementioned anomaly information, an early warning message is output.

[0096] Optionally, determining the abnormal information based on the abnormal business indicators includes:

[0097] Based on the current time-series data corresponding to the abnormal business indicators and the target abnormal threshold corresponding to the abnormal business indicators, the abnormality degree of each indicator in the abnormal business indicators is determined.

[0098] Sort the multiple anomalies in ascending order to determine the first J1 target anomalies, or sort the multiple anomalies in descending order to determine the last J2 target anomalies, where J1 and J2 are both positive integers.

[0099] Based on the J1 or J2 target anomalies, output anomaly information.

[0100] The abnormal warning device 200 can realize the functions described in the embodiments of this application. Figure 1 The various processes in the method embodiments, and the ways to achieve the same beneficial effects, will not be repeated here to avoid repetition.

[0101] Thirdly, embodiments of this application provide an electronic device. For example... Figure 6 As shown, the electronic device 300 includes a processor 301, a memory 302, and a computer program stored in the memory 302 and executable on the processor. The various components of the electronic device 300 are coupled together via a bus system 303. It is understood that the bus system 303 is used to enable communication between these components.

[0102] The processor 301 is used to acquire K time-series data corresponding to K business indicators to characterize the business status. The time-series data includes historical time-series data and current time-series data, where K is a positive integer.

[0103] Based on K historical time-series data, determine the K target anomaly thresholds for each of the K business indicators at the current moment;

[0104] Based on K current time-series data and the target anomaly thresholds at the K current times, an early warning message is output.

[0105] Optionally, the processor 301 is further configured to determine, based on the K historical time-series data, the number Q of the comprehensive abnormal moments of the K business indicators in the T moments before the current moment, where T is a positive integer greater than 1 and Q is a natural number, and the comprehensive abnormal moment is an abnormal moment determined by comprehensively considering the abnormal situations of the K business indicators.

[0106] If the number of comprehensive abnormal moments Q is greater than the first preset value, then the historical abnormal threshold of the pre-acquired historical time period is determined as the target abnormal threshold.

[0107] If the number of comprehensive abnormal moments Q is less than or equal to a first preset value, then K target abnormal thresholds are determined based on the historical abnormal thresholds and the K historical time series data.

[0108] Optionally, processor 301 is also used for

[0109] The target anomaly threshold is determined according to a first expression, where the first expression is:

[0110]

[0111] Wherein, Tp is the target anomaly threshold, Th is the historical anomaly threshold, KPIh is the average value of the indicator at historical non-anomaly times, KPIp-t is the indicator value at the time t before the current time, and the historical time series data includes the indicator values ​​at the T times before the current time.

[0112] Optionally, the processor 301 is further configured to input the K historical time series data into M algorithm models for anomaly detection, and determine a comprehensive set of anomaly times. The comprehensive set of anomaly times includes the comprehensive anomaly times corresponding to the K historical time series data, where M is a positive integer greater than or equal to 1, and the algorithm model is a model obtained after learning and training based on the K time series data.

[0113] Based on the comprehensive abnormal time set, determine the number Q of comprehensive abnormal times for the K business indicators in the T times before the current time;

[0114] Where M is greater than 1, if the first moment is determined to be a comprehensive abnormal moment according to all N algorithm models, then the first moment is determined to be the comprehensive abnormal moment in the set of comprehensive abnormal moments, and N is a positive integer greater than or equal to 1.

[0115] Optionally, the processor 301 is further configured to compare the K current time-series data with the K target anomaly thresholds to determine the abnormal business indicators among the K business indicators at the current time.

[0116] Based on the aforementioned abnormal business indicators, abnormal information is determined;

[0117] Based on the aforementioned anomaly information, an early warning message is output.

[0118] Optionally, the processor 301 is further configured to determine the degree of abnormality of each indicator in the abnormal business indicators based on the current time-series data corresponding to the abnormal business indicators and the target abnormal threshold corresponding to the abnormal business indicators.

[0119] Sort the multiple anomalies in ascending order to determine the first J1 target anomalies, or sort the multiple anomalies in descending order to determine the last J2 target anomalies, where J1 and J2 are both positive integers.

[0120] Based on the J1 or J2 target anomalies, output anomaly information.

[0121] The electronic device 300 provided in this application embodiment can realize all the processes that can be realized in the abnormal warning method embodiment of this application, and achieve the same beneficial effects. To avoid repetition, it will not be described again here.

[0122] A fourth aspect of this application provides a computer-readable storage medium storing a computer program. When executed by a processor, the computer program implements the various processes of the above-described abnormal warning method embodiments and achieves the same technical effects. To avoid repetition, it will not be described again here. The computer-readable storage medium may be a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0123] The embodiments of this application have been described above with reference to the accompanying drawings. However, this application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of this application without departing from the spirit and scope of the claims, and all of these forms are within the protection scope of this application.

Claims

1. An anomaly early warning method, characterized in that, include: Obtain K time-series data corresponding to K business metrics to characterize the business status. The time-series data includes historical time-series data and current time-series data, where K is a positive integer. The K business metrics include overall business HTTP response latency, business metrics for deteriorating HTTP response success rate, and business metrics corresponding to overall business TCP wireless latency. Based on K historical time-series data, determine the K target anomaly thresholds for each of the K business indicators at the current moment; Based on K current time-series data and the target anomaly threshold at the K current time, output early warning information; The step of determining the target anomaly thresholds for each of the K business metrics at the current time based on K historical time-series data includes: Based on the K historical time series data, determine the number Q of the comprehensive abnormal moments of the K business indicators in the T moments before the current moment, where T is a positive integer greater than 1 and Q is a natural number. The comprehensive abnormal moment is the abnormal moment determined by comprehensively considering the abnormal situations of the K business indicators. If the number of comprehensive abnormal moments Q is greater than the first preset value, then the historical abnormal threshold of the pre-acquired historical time period is determined as the target abnormal threshold. If the number of comprehensive abnormal moments Q is less than or equal to the first preset value, then K target abnormal thresholds are determined based on the historical abnormal threshold and the K historical time series data. If the number of comprehensive abnormal moments Q is less than or equal to a first preset value, then K target abnormal thresholds are determined based on the historical abnormal threshold and the K historical time series data, including: The target anomaly threshold is determined according to a first expression, where the first expression is: ； Among them, T p T is the target anomaly threshold. h For historical anomaly thresholds, KPIs h KPI is the average value of the indicator at non-abnormal historical times. p-t The index value is the value of the index t moments before the current moment. The historical time series data includes the index values ​​of the index t moments before the current moment.

2. The method according to claim 1, characterized in that, The step of determining the number Q of comprehensive abnormal moments of the K business indicators in the T moments prior to the current moment based on the K historical time-series data includes: The K historical time series data are input into M algorithm models for anomaly detection to determine a comprehensive set of anomaly moments. The comprehensive set of anomaly moments includes the comprehensive anomaly moments corresponding to the K historical time series data, where M is a positive integer greater than or equal to 1. The algorithm model is obtained by learning and training based on the K time series data. Based on the comprehensive abnormal time set, determine the number Q of comprehensive abnormal times for the K business indicators in the T times before the current time; Where M is greater than 1, if the first moment is determined to be a comprehensive abnormal moment according to all N algorithm models, then the first moment is determined to be the comprehensive abnormal moment in the set of comprehensive abnormal moments, and N is a positive integer greater than or equal to 1.

3. The method according to claim 1, characterized in that, The method of outputting early warning information based on K current time-series data and the K target anomaly thresholds at the current time includes: The K current time-series data are compared with the K target anomaly thresholds to determine the abnormal business indicators among the K business indicators at the current time. Based on the aforementioned abnormal business indicators, abnormal information is determined; Based on the aforementioned anomaly information, an early warning message is output.

4. The method according to claim 3, characterized in that, The process of determining abnormal information based on the abnormal business indicators includes: Based on the current time-series data corresponding to the abnormal business indicators and the target abnormal threshold corresponding to the abnormal business indicators, the abnormality degree of each indicator in the abnormal business indicators is determined. Sort the multiple anomalies in ascending order to determine the first J1 target anomalies, or sort the multiple anomalies in descending order to determine the last J2 target anomalies, where J1 and J2 are both positive integers. Based on the J1 or J2 target anomalies, output anomaly information.

5. An anomaly early warning device, characterized in that, include: The first acquisition module is used to acquire K time-series data corresponding to K business indicators to characterize the business status. The time-series data includes historical time-series data and current time-series data, where K is a positive integer. The K business indicators include the overall HTTP response latency of the business, the business indicator of deteriorated HTTP response success rate, and the business indicator corresponding to the overall TCP wireless latency of the business. The first determining module is used to determine the target anomaly thresholds at the current time corresponding to each of the K business indicators based on K historical time series data. The first output module is used to output early warning information based on K current time-series data and the target anomaly thresholds at the K current times; The first determining module includes: The first determining unit is used to determine the number Q of the comprehensive abnormal moments of the K business indicators in the T moments before the current moment based on the K historical time series data, where T is a positive integer greater than 1 and Q is a natural number, and the comprehensive abnormal moment is an abnormal moment determined by comprehensively considering the abnormal situation of the K business indicators. The second determining unit is used to determine the historical anomaly threshold of the pre-acquired historical period as the target anomaly threshold if the number Q of the comprehensive anomaly moments is greater than the first preset value. The third determining unit is used to determine K target anomaly thresholds based on the historical anomaly thresholds and the K historical time series data if the number Q of the comprehensive anomaly moments is less than or equal to the first preset value. The third determining unit is specifically used for: The target anomaly threshold is determined according to a first expression, where the first expression is: ； Among them, T p T is the target anomaly threshold. h For historical anomaly thresholds, KPIs h KPI is the average value of the indicator at non-abnormal historical times. p-t The index value is the value of the index t moments before the current moment. The historical time series data includes the index values ​​of the index t moments before the current moment.

6. An electronic device, characterized in that, It includes a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the computer program, when executed by the processor, implements the steps of the anomaly warning method as described in any one of claims 1 to 4.

7. A readable storage medium, characterized in that, The readable storage medium stores a program that, when executed by a processor, implements the steps of the anomaly warning method as described in any one of claims 1 to 4.

Images