Business data fault detection method, device and equipment and readable storage medium

Abstract

A service data fault detection method, device and equipment and readable storage medium, the service data fault detection method comprises: obtaining a to-be-detected service data set, each to-be-detected service data in the to-be-detected service data set is service data generated by each node in a business process; the abnormal score of the to-be-detected service data set is calculated by using the constructed isolation forest; according to the abnormal score of the to-be-detected service data set, whether the to-be-detected service data set is abnormal is determined; if the to-be-detected service data set is abnormal, the fault expert database is searched according to the message content of each to-be-detected service data, so as to determine the abnormal service data and the corresponding fault reason. Through the present application, the abnormal service data in the business process can be actively detected in advance and the fault reason can be accurately determined, passive fault reason analysis according to user complaint information is avoided, and user experience is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the Internet of Vehicles big data technical field, and particularly relates to a service data fault detection method and device, equipment and a readable storage medium. BACKGROUND

[0002] A user remotely controls opening or closing of a vehicle door through a mobile phone APP (an abbreviation of application, namely application software), a basic process of the service is that the user opens the APP on the mobile phone, clicks a vehicle door opening or closing control button, and then a control signal is transmitted to a TSP (Telematics Service Provider, automobile remote service provider) platform, the TSP platform is issued to a Tbox (telematics box, vehicle-mounted communication terminal), and then the Tbox is issued to a vehicle controller to execute a corresponding vehicle door control instruction.

[0003] When a service process of remotely controlling a vehicle door by a user through a mobile phone APP fails, currently, user complaint information is mainly received passively, fault cause analysis is performed according to the user complaint information, and hysteresis leads to poor user experience. SUMMARY

[0004] The present application provides a service data fault detection method, device, equipment and readable storage medium, and aims to solve the technical problem that when a service process of remotely controlling a vehicle door by a user through a mobile phone APP fails, currently, user complaint information is mainly received passively, fault cause analysis is performed according to the user complaint information, and hysteresis leads to poor user experience.

[0005] In a first aspect, an embodiment of the present application provides a service data fault detection method, and the service data fault detection method comprises the following steps.

[0006] Obtaining a to-be-detected service data set, each piece of to-be-detected service data in the to-be-detected service data set is service data occurring at each node in a service process;

[0007] Calculating an anomaly score of the to-be-detected service data set by using an isolated forest that has been constructed;

[0008] Determining whether the to-be-detected service data set is abnormal according to the anomaly score of the to-be-detected service data set;

[0009] If the to-be-detected service data set is abnormal, searching a fault expert database according to message content of each piece of to-be-detected service data, so as to determine abnormal service data and a corresponding fault cause.

[0010] Optionally, the obtaining of the to-be-detected service data set comprises the following steps.

[0011] By setting a burr point at each node of a business process, collecting business data occurring at each node, a to-be-detected business data set is obtained.

[0012] Optionally, before the step of calculating the anomaly score of the to-be-detected business data set by using the constructed isolation forest, the method further comprises:

[0013] constructing an isolation forest by using a plurality of historical business data, wherein each piece of historical business data comprises a message content and a fault cause;

[0014] constructing a fault expert library by using the message content and the fault cause.

[0015] Optionally, the step of constructing the isolation forest by using the plurality of historical business data comprises:

[0016] acquiring a plurality of historical business data;

[0017] dividing the plurality of historical business data into a plurality of groups of data, and taking each group of data as a piece of sample data;

[0018] taking all the sample data as a sample data set;

[0019] cutting all the sample data in the sample data set by randomly selecting a feature dimension of the sample data and randomly selecting a feature value of the feature dimension as a cutting point, and constructing a plurality of isolation trees;

[0020] taking the plurality of isolation trees constructed as an isolation forest.

[0021] Optionally, the step of calculating the anomaly score of the to-be-detected business data set by using the constructed isolation forest comprises:

[0022] calculating the anomaly score of the to-be-detected business data set by using the constructed isolation forest through a formula, the formula being:

[0023]

[0024] wherein s(x, ψ) is the anomaly score of the to-be-detected business data set, x is the to-be-detected business data set, ψ is the number of isolation trees, h(x) is the path length of the to-be-detected business data set in each isolation tree, E(h(x)) is the expectation of the path length of the to-be-detected business data set in all the isolation trees, and ε(ψ) is the average value of the path lengths of all the isolation trees.

[0025] Optionally, the step of determining whether the to-be-detected business data set is abnormal according to the anomaly score of the to-be-detected business data set comprises:

[0026] if the anomaly score of the to-be-detected business data set is greater than a first threshold value and less than a second threshold value, it is determined that the to-be-detected business data set is abnormal;

[0027] If the anomaly score of the to-be-detected service data set is less than the first threshold, it is determined that the to-be-detected service data set does not have an anomaly.

[0028] Optionally, the searching, according to the message content of each to-be-detected service data, the fault expert library for determining the abnormal service data and the corresponding fault reason comprises:

[0029] For each to-be-detected service data, if consistent message content and the corresponding fault reason exist in the fault expert library, the to-be-detected service data is determined as abnormal service data, and the corresponding fault reason is determined as the fault reason of the abnormal service data.

[0030] In a second aspect, an embodiment of the present application provides a service data fault detection device, and the service data fault detection device comprises:

[0031] The acquisition module is configured to acquire a to-be-detected service data set, each to-be-detected service data in the to-be-detected service data set being service data generated by each node in a service process;

[0032] The calculation module is configured to calculate an anomaly score of the to-be-detected service data set by using the constructed isolation forest;

[0033] The first determination module is configured to determine whether the to-be-detected service data set has an anomaly according to the anomaly score of the to-be-detected service data set;

[0034] The second determination module is configured to, if the to-be-detected service data set has an anomaly, search, according to the message content of each to-be-detected service data, the fault expert library for determining the abnormal service data and the corresponding fault reason.

[0035] In a third aspect, an embodiment of the present application provides a service data fault detection device, and the service data fault detection device comprises a processor, a memory, and a service data fault detection program stored in the memory and executable by the processor, wherein the service data fault detection program, when executed by the processor, implements the steps of the service data fault detection method described above.

[0036] In a fourth aspect, an embodiment of the present application provides a readable storage medium, and the readable storage medium stores a service data fault detection program, wherein the service data fault detection program, when executed by a processor, implements the steps of the service data fault detection method described above.

[0037] The technical scheme provided by the embodiment of the present application has the following beneficial effects:

[0038] In the embodiment of the present application, the business data set to be detected is acquired, each piece of business data to be detected in the business data set to be detected is business data generated at each node in a business process, the isolation forest is constructed, and the anomaly score of the business data set to be detected is calculated. Whether the business data set to be detected is abnormal is determined according to the anomaly score of the business data set to be detected. If the business data set to be detected is abnormal, the fault expert database is searched according to the message content of each piece of business data to be detected, so as to determine the abnormal business data and the corresponding fault reason. In the embodiment of the present application, the business data generated at each node in the business process is collected as the business data set to be detected, whether the business data set to be detected is abnormal is detected by the constructed isolation forest, if the business data set to be detected is abnormal, the fault expert database is searched according to the message content of each piece of business data to be detected, and the abnormal business data and the corresponding fault reason are determined, so that the abnormal business data in the business process can be actively detected in advance and the fault reason can be accurately determined, passive fault reason analysis according to user complaint information is avoided, and user experience is improved. BRIEF DESCRIPTION OF DRAWINGS

[0039] Figure 1 A flowchart of an embodiment of a business data fault detection method of the present application is shown.

[0040] Figure 2 A flowchart of an isolation forest construction process of an embodiment of a business data fault detection method of the present application is shown.

[0041] Figure 3 A flowchart of an embodiment of a business data fault detection method of the present application is shown. Figure 1 A flowchart of an embodiment of a business data fault detection method of the present application is shown.

[0042] Figure 4 A flowchart of an embodiment of a business data fault detection method of the present application is shown.

[0043] Figure 5 A hardware structure diagram of a business data fault detection device involved in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0044] In order to enable the personnel in the technical field to better understand the present application, the technical solutions in the embodiments of the present application will be described clearly and completely in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by the personnel in the field without creative labor are within the scope of protection of the present application.

[0045] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be described in further detail in conjunction with the drawings. In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be described in further detail in conjunction with the drawings.

[0046] In a first aspect, the embodiments of the present application provide a service data fault detection method.

[0047] In an embodiment, the service data fault detection method comprises the following steps. Figure 1 Figure 1 FIG. 1 is a flowchart of an embodiment of the service data fault detection method of the present application, as shown in the figure, the service data fault detection method comprises the following steps. Figure 1

[0048] In step S10, a set of to-be-detected service data is acquired, each piece of to-be-detected service data in the set of to-be-detected service data being service data occurring at each node in a service process.

[0049] In this embodiment, the service data occurring at each node in the service process is collected as the set of to-be-detected service data, the service process can include but is not limited to a service process such as remote control of opening or closing of a vehicle door by a user through a mobile phone APP, the basic process of this service is as described in the background art: the user opens the APP on the mobile phone, clicks the vehicle door opening or closing control button, and then the control signal is transmitted to the TSP platform, the TSP platform is issued to the Tbox, and the Tbox is issued to the vehicle controller to execute the corresponding vehicle door control instruction, each node in this service process is respectively the APP on the mobile phone, the TSP platform, the Tbox and the vehicle controller, each node cooperates to complete a service process, and corresponding service data will occur at each node, the content of each piece of service data includes, for example, the trigger time of this service process at the current node, the response time of this service process at the current node and the message content, etc., the collected service data occurring at each node can be uniformly acquired from the TSP platform, for example, the service data occurring at each node can be collected by means of kafka (a popular distributed publish / subscribe message system) and uploaded and saved to the TSP platform, and then the set of to-be-detected service data is acquired from the TSP platform.

[0050] In step S20, the anomaly score of the set of to-be-detected service data is calculated using the constructed isolated forest.

[0051] In this embodiment, the isolated forest algorithm utilizes the principle that the feature difference of abnormal samples is larger than that of normal samples, and abnormal samples can be isolated faster, and the isolated forest can be constructed in advance using sample data, the isolated forest is composed of multiple isolated binary trees, and the process of calculating the anomaly score of the set of to-be-detected service data using the constructed isolated forest mainly comprehensively values the path length of the set of to-be-detected service data on each isolated binary tree.

[0052] In step S30, whether the set of to-be-detected service data is abnormal is determined according to the anomaly score of the set of to-be-detected service data.

[0053] ​​In this embodiment, the abnormal score represents the degree of abnormality of the to-be-detected business data set detected by the constructed isolation forest. Whether the to-be-detected business data set is abnormal is determined by the size of the abnormal score of the to-be-detected business data set.

[0054] In step S40, if the to-be-detected business data set is abnormal, the message content of each to-be-detected business data is used to search the fault expert library to determine the abnormal business data and the corresponding fault reason.

[0055] In this embodiment, in an actual application scenario, the TSP platform is usually connected to a large number of vehicles and responds to a large number of requirements for remotely opening or closing the vehicle door through a mobile phone APP. Therefore, the amount of business data generated at each node that needs to be detected and processed by the TSP platform is very large. Therefore, the application improves the detection and processing efficiency by batch detection. The to-be-detected business data set includes multiple to-be-detected business data. The abnormality of the to-be-detected business data set is detected. Therefore, after detecting that the to-be-detected business data set is abnormal, each to-be-detected business data in the to-be-detected business data set needs to be detected, that is, the message content of each to-be-detected business data is used to search the fault expert library to determine the abnormal business data in the to-be-detected business data set and the corresponding fault reason.

[0056] In this embodiment, the to-be-detected business data set is obtained from the TSP platform. The to-be-detected business data set is multiple business data generated at each node in the collected business process. The path length of the to-be-detected business data set on each isolated binary tree of the isolation forest is comprehensively calculated to obtain the abnormal score of the to-be-detected business data set. Whether the to-be-detected business data set is abnormal is determined by the size of the abnormal score of the to-be-detected business data set. If it is abnormal, the message content of each to-be-detected business data is used to search the fault expert library to determine the abnormal business data in the to-be-detected business data set and the corresponding fault reason. Therefore, the abnormal business data in the business process can be actively detected in advance, and the fault reason can be accurately determined. Passive fault reason analysis based on user complaint information is avoided, and user experience is improved. Through batch detection and processing of the to-be-detected business data set, the abnormal detection and processing efficiency is improved, and the scene in which a large amount of business data is generated at each node in the business process can be better adapted.

[0057] Further, in an embodiment, step S10 includes:

[0058] By setting a buried point at each node of the business process, the business data generated at each node is collected to obtain the to-be-detected business data set.

[0059] In the embodiment, setting the burying points at the nodes of the business process is a data collection method. Specifically, the program code for data collection can be attached to the function program code of each node to capture, process and send the user behavior or event on each node, and collect the business data generated at each node. Similarly, the burying points can be set at the nodes of the business process with the help of Kafka to collect the generated business data from each node, upload and save to the TSP platform, and then obtain the to-be-detected business data set from the TSP platform.

[0060] Further, in an embodiment, before step S20, the method further comprises:

[0061] using the plurality of historical business data to construct an isolated forest, wherein each piece of historical business data comprises a message content and a fault reason;

[0062] using the message content and the fault reason to construct a fault expert database.

[0063] In the embodiment, a plurality of historical data with explicit fault reasons processed by artificial processing can be collected, the plurality of historical data with explicit fault reasons are used as sample data sets to construct an isolated forest, and the message content and the fault reason are used to construct a fault expert database, that is, each piece of data stored in the fault expert database is a fault reason corresponding to a message content.

[0064] Further, in an embodiment, referring to Figure 2 , Figure 2 FIG. 1 is a flowchart of an embodiment of a business data fault detection method of the present application, as shown in FIG. 1, the method comprises the following steps: Figure 2

[0065] Step S01, obtaining a plurality of historical business data;

[0066] Step S02, dividing the plurality of historical business data into a plurality of groups of data, and taking each group of data as a piece of sample data;

[0067] Step S03, taking all the sample data as a sample data set;

[0068] Step S04, cutting all the sample data in the sample data set by randomly selecting a feature dimension of the sample data and randomly selecting a feature value of the feature dimension as a cutting point, and constructing a plurality of isolated trees;

[0069] Step S05, taking the plurality of isolated trees constructed to form an isolated forest.

[0070] ​In this embodiment, since the batch service data is detected for anomaly, each sample data used for constructing the isolated forest is also batch when the isolated forest is constructed, that is, one sample data is composed of multiple historical service data, and the process of constructing an isolated binary tree is as follows: a feature dimension of a sample data is randomly selected, such as response time length, and a feature value of the feature dimension is randomly selected, such as 1 second of response time length, if the response time length of a sample data is less than 1 second, the sample data is placed on the left side of the binary tree, and if the response time length of a sample data is greater than or equal to 1 second, the sample data is placed on the right side of the binary tree, and all sample data in the sample data set is recursively cut to construct a binary tree in this way, until there is only one data on the leaf node (it cannot be cut any more) or the isolated tree has grown to the set height, and multiple isolated trees are constructed in this way to construct the isolated forest.

[0071] Further, in an embodiment, step S20 comprises:

[0072] The constructed isolated forest is used to calculate the anomaly score of the to-be-detected service data set by a formula, and the formula is:

[0073]

[0074] Wherein, s(x, ψ) is the anomaly score of the to-be-detected service data set, x is the to-be-detected service data set, ψ is the number of isolated trees, h(x) is the path length of the to-be-detected service data set in each isolated tree, E(h(x)) is the expectation of the path length of the to-be-detected service data set in all isolated trees, and ε(ψ) is the average of the path length of all isolated trees.

[0075] In this embodiment, the anomaly score s(x, ψ) of the to-be-detected service data set is the result of comprehensively considering the path length of the to-be-detected service data set in each isolated tree of the isolated forest, and ε(ψ) is the average of the path length of all isolated trees, which is used to normalize the expectation E(h(x)) of the path length of the to-be-detected service data set in all isolated trees.

[0076] Further, in an embodiment, with reference to Figure 3 , Figure 3 The detailed flowchart of step S30 in this application Figure 1 is shown in FIG. 6, and step S30 comprises: Figure 3

[0077] Step S301, if the anomaly score of the to-be-detected service data set is greater than the first threshold value and less than the second threshold value, it is determined that the to-be-detected service data set is abnormal;

[0078] ​Step S302, if the abnormal score of the to-be-detected service data set is less than the first threshold, it is determined that the to-be-detected service data set does not exist abnormality.

[0079] In this embodiment, the value range of the abnormal score after the normalization processing is [0, 1], the first threshold is, for example, 0.5, and the second threshold is, for example, 1. If 0.5 < the abnormal score of the to-be-detected service data set < 1, it is indicated that the to-be-detected service data set exists abnormality. If the abnormal score of the to-be-detected service data set < 0.5, it is indicated that the to-be-detected service data set does not exist abnormality.

[0080] Further, in an embodiment, step S40 comprises:

[0081] For each to-be-detected service data, the fault expert library is searched according to the message content. If consistent message content and corresponding fault reason exist in the fault expert library, the to-be-detected service data is determined as abnormal service data, and the corresponding fault reason is determined as the fault reason of the to-be-detected service data.

[0082] In this embodiment, the message content and the corresponding fault reason are stored in the fault expert library. The complaint information can be processed by manual. After the specific fault reason is determined according to the message content, the fault expert library is constructed according to the message content and the fault reason. For each to-be-detected service data, the fault expert library is searched according to the message content. If consistent message content and corresponding fault reason exist in the fault expert library, the to-be-detected service data is determined as abnormal service data, and the corresponding fault reason is determined as the fault reason of the to-be-detected service data. If consistent message content and corresponding fault reason do not exist in the fault expert library, the to-be-detected service data can be processed by manual. After the abnormal service data in the to-be-detected service data set is determined by manual and the fault reason is determined, the message content and the corresponding fault reason of the abnormal service data are further added to the fault expert library, so as to continuously improve the fault expert library.

[0083] In a second aspect, the embodiment of the present application further provides a service data fault detection device.

[0084] In an embodiment, the service data fault detection device comprises: Figure 4 , Figure 4 The function module of the service data fault detection device is shown in FIG. 1. As shown in FIG. 1, the service data fault detection device comprises: Figure 4

[0085] The acquisition module 10 is configured to acquire a to-be-detected service data set. Each to-be-detected service data in the to-be-detected service data set is service data generated at each node in a service process.

[0086] The calculation module 20 is configured to calculate an abnormal score of the to-be-detected service data set by using the constructed isolation forest.​

[0087] The first determining module 30 is configured to determine whether the to-be-detected service data set is abnormal according to an anomaly score of the to-be-detected service data set.

[0088] The second determining module 40 is configured to, if the to-be-detected service data set is abnormal, search the fault expert library according to the message content of each to-be-detected service data, so as to determine the abnormal service data and the corresponding fault reason.

[0089] Further, in an embodiment, the obtaining module 10 is configured to:

[0090] The to-be-detected service data set is obtained by setting a burying point at each node of the service flow and collecting service data generated at each node.

[0091] Further, in an embodiment, the service data fault detection apparatus further comprises a constructing module, which comprises:

[0092] The first constructing unit is configured to construct an isolated forest by using a plurality of historical service data, wherein each historical service data comprises a message content and a fault reason.

[0093] The second constructing unit is configured to construct the fault expert library by using the message content and the fault reason.

[0094] Further, in an embodiment, the first constructing unit is configured to:

[0095] Obtain a plurality of historical service data.

[0096] Divide the plurality of historical service data into a plurality of groups of data, and take each group of data as a sample data.

[0097] Take all the sample data as a sample data set.

[0098] Cut all the sample data in the sample data set by randomly selecting a feature dimension of the sample data and randomly selecting a feature value of the feature dimension as a cutting point, and construct a plurality of isolated trees.

[0099] The plurality of isolated trees are used to form the isolated forest.

[0100] Further, in an embodiment, the calculating module 20 is configured to:

[0101] The constructed isolated forest is used to calculate the anomaly score of the to-be-detected service data set by using a formula, and the formula is:

[0102]

[0103] s(x, ψ) = E(h(x)) - ε(ψ), wherein s(x, ψ) is the anomaly score of the to-be-detected service data set, x is the to-be-detected service data set, ψ is the number of isolated trees, h(x) is the path length of the to-be-detected service data set in each isolated tree, E(h(x)) is the expectation of the path length of the to-be-detected service data set in all isolated trees, and ε(ψ) is the average of the path lengths of all isolated trees.

[0104] Further, in an embodiment, the first determining module 30 is configured to:

[0105] If the anomaly score of the to-be-detected service data set is greater than the first threshold value and less than the second threshold value, it is determined that the to-be-detected service data set is abnormal.

[0106] If the anomaly score of the to-be-detected service data set is less than the first threshold value, it is determined that the to-be-detected service data set is not abnormal.

[0107] Further, in an embodiment, the second determining module 40 is configured to:

[0108] For each to-be-detected service data, the message content is used to search the fault expert library, and if consistent message content and corresponding fault reasons exist in the fault expert library, the to-be-detected service data is determined as abnormal service data, and the corresponding fault reason is determined as the fault reason of the to-be-detected service data.

[0109] The functions of each module in the service data fault detection device correspond to the steps in the service data fault detection method, and the functions and implementation processes will not be repeated here.

[0110] In a third aspect, the embodiments of the present application provide a service data fault detection device.

[0111] Reference Figure 5 , Figure 5 FIG. 1 is a schematic diagram of a hardware structure of a service data fault detection device according to an embodiment of the present application. In the embodiment of the present application, the service data fault detection device can include a processor, a memory, a communication interface, and a communication bus.

[0112] The communication bus can be of any type, used to interconnect the processor, the memory, and the communication interface.

[0113] The communication interface includes input / output (I / O) interfaces, physical interfaces, and logical interfaces used for interconnecting internal components of the service data fault detection equipment, as well as interfaces used for interconnecting the service data fault detection equipment with other devices (such as other computing devices or user equipment). Physical interfaces can be Ethernet interfaces, fiber optic interfaces, ATM interfaces, etc.; user equipment can be displays, keyboards, etc.

[0114] Memory can be various types of storage media, such as random access memory (RAM), read-only memory (ROM), non-volatile RAM (NVRAM), flash memory, optical storage, hard disk, programmable ROM (PROM), erasable PROM (EPROM), electrically erasable PROM (EEPROM), etc.

[0115] The processor can be a general-purpose processor, which can call the service data fault detection program stored in the memory and execute the service data fault detection method provided in the embodiments of this application. For example, the general-purpose processor can be a central processing unit (CPU). The method executed when the service data fault detection program is called can be referred to in the various embodiments of the service data fault detection method of this application, and will not be repeated here.

[0116] Those skilled in the art will understand that Figure 5 The hardware structure shown does not constitute a limitation of this application and may include more or fewer components than shown, or combine certain components, or have different component arrangements.

[0117] Fourthly, embodiments of this application also provide a readable storage medium.

[0118] The present application has a service data fault detection program stored on a readable storage medium, wherein when the service data fault detection program is executed by a processor, it implements the steps of the service data fault detection method described above.

[0119] The method implemented when the business data fault detection program is executed can be referred to in various embodiments of the business data fault detection method of this application, and will not be repeated here.

[0120] It should be noted that the sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0121] The terms "include", "has" and "has" in the description and claims of the present application and the above-mentioned drawings are intended to cover non-exclusive inclusion. For example, a process, method, system, product or device including a series of steps or units is not limited to the listed steps or units, but can optionally include steps or units not listed, or can optionally include other steps or units inherent to these processes, methods, products or devices. The terms "first", "second" and "third" and the like descriptions are used to distinguish different objects, etc., and do not represent the order or limit the "first", "second" and "third" to be different types.

[0122] In the description of the embodiments of the present application, "exemplary", "for example" or "for example" is used to represent an example, illustration or description. Any embodiment or design scheme described as "exemplary", "for example" or "for example" in the embodiments of the present application should not be interpreted as more preferred or more advantageous than other embodiments or design schemes. In fact, the words "exemplary", "for example" or "for example" are intended to present the relevant concept in a specific way.

[0123] In the description of the embodiments of the present application, unless otherwise specified, " / " means or, for example, A / B can represent A or B; "and / or" in the text only describes the relationship between the associated objects, which means that there can be three relationships, for example, A and / or B, which can represent: A alone, A and B exist simultaneously, and B alone exist in three cases. In addition, in the description of the embodiments of the present application, "multiple" means two or more than two.

[0124] In some of the processes described in the embodiments of the present application, a plurality of operations or steps are included in a specific order, but it should be understood that these operations or steps can be executed or executed in parallel without the order in which they appear in the embodiments of the present application. The serial number of the operation is only used to distinguish each different operation, and the serial number itself does not represent any execution order. In addition, these processes can include more or less operations, and these operations or steps can be executed in sequence or in parallel, and these operations or steps can be combined.

[0125] Those skilled in the art can clearly understand the above-mentioned embodiment method can be realized by means of software and the necessary general hardware platform, of course, can also be realized by hardware, but in many cases, the former is a better embodiment. Based on such understanding, the technical solutions of the present application can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) as described above, and includes a plurality of instructions for making a terminal device execute the method described in each embodiment of the present application.

[0126] The above is only the preferred embodiment of the present application, and does not limit the patent scope of the present application, and any equivalent structure or equivalent process transformation using the content of the specification and drawings, or direct or indirect application in other related technical fields, are also included in the patent protection scope of the present application.

Claims

1. A method of service data fault detection, characterized by, The business data fault detection method comprises: obtaining a to-be-detected business data set, each piece of to-be-detected business data in the to-be-detected business data set being business data occurring at each node in a business process; the obtaining of the to-be-detected business data set comprises: collecting business data occurring at each node by setting a burying point at each node of the business process to obtain the to-be-detected business data set; calculating an anomaly score of the to-be-detected business data set by using a constructed isolation forest; determining whether the to-be-detected business data set is abnormal according to the anomaly score of the to-be-detected business data set; if the to-be-detected business data set is abnormal, searching a fault expert database according to the message content of each piece of to-be-detected business data to determine abnormal business data and a corresponding fault cause; before the calculating of the anomaly score of the to-be-detected business data set by using the constructed isolation forest, comprising: constructing an isolation forest by using a plurality of historical business data, wherein each piece of historical business data comprises message content and a fault cause; constructing the fault expert database by using the message content and the fault cause; the searching of the fault expert database according to the message content of each piece of to-be-detected business data to determine abnormal business data and a corresponding fault cause comprises: for each piece of to-be-detected business data, searching the fault expert database according to the message content, if consistent message content and a corresponding fault cause exist in the fault expert database, determining the piece of to-be-detected business data as abnormal business data and determining the corresponding fault cause as the fault cause of the piece of abnormal business data.

2. The service data fault detection method of claim 1, wherein, the constructing of the isolation forest by using the plurality of historical business data comprises: obtaining a plurality of historical business data; dividing the plurality of historical business data into a plurality of groups of data, taking each group of data as a sample data; taking all the sample data as a sample data set; cutting all the sample data in the sample data set by randomly selecting a feature dimension of the sample data and randomly selecting a feature value of the feature dimension as a cutting point to construct a plurality of isolated trees; composing the isolation forest by using the plurality of isolated trees constructed.

3. The service data fault detection method of claim 2, wherein, the calculating of the anomaly score of the to-be-detected business data set by using the constructed isolation forest comprises: calculating the anomaly score of the to-be-detected business data set by using the constructed isolation forest through a formula, the formula being: ； wherein, is the number of isolated trees for the business data set to be detected, is the business data set to be detected, is the number of isolated trees, is the path length of the business data set to be detected in each isolated tree, is the expectation of the path length of the business data set to be detected in all isolated trees, is the average of the path length of all isolated trees.

4. The service data fault detection method of claim 1, wherein, the determining of whether the to-be-detected business data set is abnormal according to the anomaly score of the to-be-detected business data set comprises: if the anomaly score of the to-be-detected business data set is greater than a first threshold value and less than a second threshold value, determining that the to-be-detected business data set is abnormal; if the anomaly score of the to-be-detected business data set is less than the first threshold value, determining that the to-be-detected business data set is not abnormal.

5. A service data fault detection apparatus characterized by comprising: The business data fault detection device comprises: an obtaining module, configured to obtain a to-be-detected business data set, each piece of to-be-detected business data in the to-be-detected business data set being business data occurring at each node in a business process; the obtaining of the to-be-detected business data set comprises: collecting business data occurring at each node by setting a burying point at each node of the business process to obtain the to-be-detected business data set; a calculating module, configured to calculate an anomaly score of the to-be-detected business data set by using a constructed isolation forest; The first determining module is configured to determine whether the to-be-detected service data set has an anomaly according to an anomaly score of the to-be-detected service data set. The second determining module is configured to, if the to-be-detected service data set has an anomaly, search the fault expert library according to the message content of each to-be-detected service data, so as to determine the abnormal service data and the corresponding fault cause. Before the anomaly score of the to-be-detected service data set is calculated by using the constructed isolation forest, the method comprises the following steps: The isolation forest is constructed by using a plurality of historical service data, wherein each historical service data comprises message content and a fault cause. The fault expert library is constructed by using the message content and the fault cause. The searching of the fault expert library according to the message content of each to-be-detected service data, so as to determine the abnormal service data and the corresponding fault cause, comprises the following steps: For each to-be-detected service data, the fault expert library is searched according to the message content, if consistent message content and the corresponding fault cause exist in the fault expert library, the to-be-detected service data is determined as abnormal service data, and the corresponding fault cause is determined as the fault cause of the abnormal service data.

6. A service data fault detection device characterized by comprising: The service data fault detection device comprises a processor, a memory, and a service data fault detection program stored in the memory and executable by the processor, wherein when the service data fault detection program is executed by the processor, the steps of the service data fault detection method in any one of claims 1 to 4 are implemented.

7. A readable storage medium characterized by, The readable storage medium stores a service data fault detection program, wherein when the service data fault detection program is executed by the processor, the steps of the service data fault detection method in any one of claims 1 to 4 are implemented.

Images