Service platform anomaly detection method and system, electronic equipment and storage medium

Abstract

The invention discloses a service platform anomaly detection method and system, electronic equipment and a storage medium. Comprising the following steps: receiving target operation data sent by a plurality of service nodes in a target system, and determining a power spectrum density corresponding to the target operation data of each service node; determining corresponding key feature information based on the power spectral density, determining each item of index data in the detection indexes of the service node based on the key feature information, and processing each item of index data in the detection indexes through a deep learning model to obtain target detection index data of the service node; and calling the link detection knowledge graph and various alarm rules in a preset alarm rule base to carry out abnormity judgment on the target detection index data so as to obtain abnormal state information of each service node. According to the scheme, the operation data of the multiple service nodes are processed and analyzed, and the abnormal state information is accurately and comprehensively determined in combination with the link detection knowledge graph and the preset alarm rule base, so that the abnormal problem is quickly positioned.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to a service platform anomaly detection method, system, electronic device and storage medium. Background Art

[0002] Competition is becoming increasingly fierce from the Internet field to traditional industries. Consumers' hierarchical structure and personalized needs are changing rapidly. In order to cope with such changes, enterprises have to quickly iterate their business, resulting in more and more services and resources in the service platform and more and more complex functions.

[0003] During the operation of the service platform, once a service exception occurs, due to the complexity of the service platform, it is difficult or even impossible to locate the problem. The operation logs need to be checked one by one by the operation and maintenance personnel, resulting in low efficiency of service detection and operation. The existing methods for detecting service platforms also have problems such as inconsistent service granularity, inability to comprehensively detect the service platform, and untimely response. Summary of the invention

[0004] The present invention provides a service platform anomaly detection method, system, electronic device and storage medium to solve the problems of inconsistent service granularity and incomplete detection, as well as the problem of low detection efficiency in the prior art.

[0005] According to one aspect of the present invention, a service platform anomaly detection method is provided, comprising:

[0006] Receiving target operation data sent by multiple service nodes in the target system, and determining a power spectrum density corresponding to the target operation data of each service node, wherein the target operation data includes data associated with a detection indicator, and the detection indicator includes one or more of a user activity index, a network load index, and a device operation status index;

[0007] Determine the corresponding key feature information based on the power spectrum density of each service node, determine the various indicator data in the detection index of the service node based on the key feature information, and process the various indicator data in the detection index through a deep learning model to obtain the target detection indicator data of the service node;

[0008] Calling various alarm rules in the link detection knowledge graph and the preset alarm rule library; wherein the link detection knowledge graph is constructed based on entities corresponding to the operation data of multiple service nodes in the target system and the relationship types between the entities;

[0009] Based on the link detection knowledge graph and the various alarm rules in the preset alarm rule library, the target detection indicator data is judged to be abnormal, and the abnormal status information of each service node in the target system is determined.

[0010] Optionally, a link detection knowledge graph is constructed based on entities in the operating data of multiple service nodes in the target system and the relationship types between entities, including: identifying entities corresponding to the operating data of multiple service nodes, creating node objects for each entity, and setting node identifiers and node attribute information for the node objects, wherein the node attribute information includes node name, node type, node status, and detection indicator data; determining the relationship types between entities based on basic information of the target system, creating edge objects between corresponding entities based on the relationship types, and setting corresponding edge identifiers and edge attribute information for the edge objects, wherein the basic information includes a system architecture diagram and a service topology diagram, and the edge attribute information includes relationship types and weight information, and the relationship types include dependency relationships, connection relationships, and communication relationships; connecting corresponding nodes based on the relationship types in each edge attribute information to form a link detection knowledge graph.

[0011] Optionally, based on the link detection knowledge graph and various alarm rules in the preset alarm rule base, the target detection index data is judged to be abnormal, and the abnormal status information of each service node in the target system is determined, including: traversing various alarm rules in the preset alarm rule base, and based on various alarm rules, the target detection index data of each service node is judged to be abnormal, and the abnormal judgment result of each service node is determined; and, based on the link detection knowledge graph, the associated node object of the service node is determined, and various alarm rules in the preset alarm rule base are called to judge the abnormality of the associated node object, and the abnormal judgment result of the associated node object is determined; based on the abnormal judgment result of each service node and the abnormal judgment result of the corresponding associated node object, the abnormal status information of the corresponding service node is determined, and when there is an abnormality in the service node, the alarm information of the service node is determined, and the alarm information includes the alarm event type and the alarm event level.

[0012] Optionally, after determining the alarm information of the service node, the method further includes: matching the alarm event type and alarm event level of the service node with preset rules and knowledge base to determine the alarm cause of the service node.

[0013] Optionally, the method also includes: when the target object accesses any service node in the target system, if it is detected that the target object accesses the service node for the first time, verifying the target object according to a preset verification method; if it is detected that this is not the first time that the target object accesses the service node, there is no need to verify the target object; wherein the preset verification method includes a password verification method and a biometric verification method.

[0014] Optionally, the target object is verified according to a preset verification method, including: in response to the target object being verified according to the preset verification method, obtaining basic information of the target object, the basic information including user ID and current location information; obtaining preset authorization policy information, wherein the authorization policy includes access rules, authorization conditions and authorization levels; and verifying the basic information of the target object based on the preset authorization policy information to determine the target object's access rights and access resources.

[0015] Optionally, the method also includes: obtaining associated information corresponding to each transaction in the target system, wherein the associated information includes transaction start processing time, transaction end processing time, transaction processing failure time and transaction retry information; and determining the transaction abnormality status of each transaction based on the associated information.

[0016] According to another aspect of the present invention, a service platform anomaly detection system is provided, the system comprising: a data acquisition module, a detection index data screening module, a link detection knowledge graph construction module, an alarm rule configuration module, an anomaly determination module, a transaction status determination module, and an authorization management module; wherein:

[0017] A link detection knowledge graph construction module is used to construct a link detection knowledge graph based on entities corresponding to the operation data of multiple service nodes in the target system and the relationship types between entities;

[0018] An alarm rule configuration module, for adding one or more of the alarm event type, the alarm event level, the trigger condition and the threshold setting information to a preset alarm rule library in response to an input operation of one or more of the alarm event type, the alarm event level, the trigger condition and the threshold setting information;

[0019] A data acquisition module, used for receiving target operation data sent by multiple service nodes in the target system, and sending the target operation data sent by the multiple service nodes to the detection index data screening module;

[0020] A detection index data screening module is used to receive target operation data sent by multiple service nodes, and determine the power spectrum density corresponding to the target operation data of each service node, determine the corresponding key feature information based on the power spectrum density of each service node, determine each indicator data in the detection index of the service node based on the key feature information, and process each indicator data in the detection index through a deep learning model to obtain the target detection index data of the service node;

[0021] The anomaly judgment module is used to call the link detection knowledge graph and the various alarm rules in the preset alarm rule base; based on the link detection knowledge graph and the various alarm rules in the preset alarm rule base, the target detection indicator data is judged to be abnormal, and the abnormal status information of each service node in the target system is determined.

[0022] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0023] at least one processor; and

[0024] a memory communicatively connected to at least one processor; wherein,

[0025] The memory stores a computer program that can be executed by at least one processor, and the computer program is executed by at least one processor so that the at least one processor can execute the service platform anomaly detection method of any embodiment of the present invention.

[0026] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the service platform anomaly detection method of any embodiment of the present invention when executed.

[0027] The technical solution of the embodiment of the present invention determines the power spectrum density corresponding to the target operation data of each service node by receiving the target operation data sent by multiple service nodes in the target system, wherein the target operation data includes data associated with the detection index, and the detection index includes one or more of the user activity index, the network load index and the device operation status index, thereby realizing anomaly detection through the operation data of multiple data sources, which helps to determine comprehensive and accurate anomaly information. Based on the power spectrum density of each service node, the corresponding key feature information is determined, and based on the key feature information, the various indicator data in the detection index of the service node are determined, and the various indicator data in the detection index are processed by a deep learning model to obtain the target detection indicator data of the service node; it realizes the combination of constructing the power spectrum density and the deep learning model to determine the target detection indicator data of the service node, which can accurately capture the changing trend and abnormal situation of the target system, thereby improving the response speed and accuracy of the detection method. Call the link detection knowledge graph and the alarm rules in the preset alarm rule base; the link detection knowledge graph is constructed based on the entities corresponding to the operation data of multiple service nodes in the target system and the relationship types between the entities; the link detection knowledge graph can clearly display the relationship and dependency between the services, which helps to understand the operation status of the target system more comprehensively, thereby making up for the shortcomings of existing detection technology in the whole process of service evaluation and improving the comprehensiveness of anomaly detection. Based on the link detection knowledge graph and the alarm rules in the preset alarm rule base, the target detection indicator data is judged abnormally, and the abnormal status information of each service node in the target system is determined. It is realized that the alarm problems that exist can be quickly and comprehensively determined through the pre-configured alarm rules and link detection knowledge graph, which helps to quickly respond to the alarm problems, so as to improve the operation stability of the target system; it solves the problems of inconsistent service granularity and inability to fully detect systems with complex functions, and improves the comprehensiveness and efficiency of the detection of the target system, so that the target system can run more stably.

[0028] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0030] Figure 1is a flow chart of a service platform anomaly detection method provided in Embodiment 1 of the present invention;

[0031] Figure 2 is a flow chart of a service platform anomaly detection method provided by Embodiment 2 of the present invention;

[0032] Figure 3 is a flow chart of a service platform anomaly detection method provided by Embodiment 3 of the present invention;

[0033] Figure 4 It is a structural diagram of a service platform anomaly detection system provided by Embodiment 4 of the present invention;

[0034] Figure 5 It is a structural schematic diagram of an electronic device for implementing the service platform anomaly detection method according to an embodiment of the present invention. DETAILED DESCRIPTION

[0035] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0036] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0037] Embodiment 1

[0038] Figure 1 This is a flow chart of a service platform anomaly detection method provided in the first embodiment of the present invention. This embodiment is applicable to the case of performing anomaly detection on a service platform. The method can be executed by a service platform anomaly detection device. The service platform anomaly detection device can be implemented in the form of hardware and / or software. The service platform anomaly detection device can be configured in electronic devices such as computers and servers. Figure 1 As shown, the method includes:

[0039] S110. Receive target operation data sent by multiple service nodes in the target system, and determine the power spectrum density corresponding to the target operation data of each service node, wherein the target operation data includes data associated with detection indicators, and the detection indicators include one or more of a user activity index, a network load index, and a device operation status index.

[0040] Among them, the target system can be specifically understood as a service system to be detected for anomalies. For example, the target system can be a digital power grid service platform. A service node refers to a group of computer devices or software programs that are responsible for receiving, processing and forwarding task requests, data and information in a system or network. A service node can be a network device such as a server, router, switch, etc. that carries user services, or it can be a node of various applications such as infrastructure and security systems. For example, a service node can be a database, virtual machine, server and application node. The target operation data can be specifically understood as data that meets the data requirements that is screened out from all the operation data of the target system. Specifically, it can be used to screen from the operation data by setting detection indicators to obtain data that meets the set detection indicators, which is called target operation data. Power spectral density is a measurement method that describes how signal power changes with frequency. It is usually used to analyze the spectral characteristics of signals or noise and to determine characteristic information, where the characteristic information includes but is not limited to frequency peak characteristics, mean characteristics, and variance characteristics. The power spectral density can be determined by performing a fast Fourier transform on the time domain signal to obtain a frequency domain signal, and then calculating the frequency domain signal according to the power spectral density calculation formula to obtain the corresponding power spectral density. In this embodiment, the time domain signal is the operating data of each service node. The detection indicators can be specifically understood as quantitative indicators used to detect and evaluate the performance and reliability of service nodes. The detection indicators include but are not limited to user activity index, network load index and device operation status index. The user activity index is data used to reflect the user's usage behavior of the target system. It can be calculated through information such as the user's login frequency, number of pages visited, number of clicks, etc., or it can be determined based on the corresponding power spectrum density. The characteristic information can be estimated based on the characteristic information; the network load index can be calculated based on network traffic, bandwidth utilization, response time and other characteristics, and the network load situation is represented by weighted average or percentage; the device operation status index can be calculated based on the device's operating time, failure rate, CPU utilization, memory utilization and other characteristics, and the device's operating status is represented by weighted average or percentage.

[0041] Specifically, the operation data sent by multiple service nodes in the target system can be received in real time or offline. When each service node transmits the operation data, it can obtain the detection index from the preset storage space, and filter the operation data of each service node according to the detection index to obtain the target operation data of each service node, wherein the detection index includes one or more of the user activity index, the network load index and the equipment operation status index. Exemplarily, identifier information associated with the detection index can be set in the operation data. When each service node transmits the operation data, the identifier information is used to filter the operation data to obtain the target operation data, and then the obtained target operation data is transmitted.

[0042] In this embodiment, the original operation data of each service node is first screened according to the detection index to obtain the target operation data, and then the target operation data is sent to the target location. There is no need to transmit unnecessary information, and only the operation data related to the detection index is transmitted. This helps to improve data transmission efficiency, avoids processing useless data, avoids waste of resources, increases the speed of data transmission, and helps to improve the speed of subsequent data processing.

[0043] Preferably, after receiving the target operation data, the target operation data is preprocessed, specifically performing one or more operations of data cleaning, data conversion, integration and reduction on the target operation data to remove dirty data in the target operation data and obtain the preprocessed target operation data to ensure data consistency and availability. Among them, data cleaning specifically includes removing duplicate data, processing missing values, and removing abnormal values; data conversion specifically includes converting data from different service nodes into a unified data format, for example, converting text data into numerical data; data integration specifically integrates data from different data sources, for example, merging data from different data tables; data reduction specifically refers to compressing and sampling data for easy storage and processing.

[0044] Optionally, the method also includes: when the target object accesses any service node in the target system, if it is detected that the target object accesses the service node for the first time, verifying the target object according to a preset verification method; if it is detected that this is not the first time that the target object accesses the service node, there is no need to verify the target object; wherein the preset verification method includes a password verification method and a biometric verification method.

[0045] Wherein, the target object specifically refers to any user who accesses the target system. After the target object logs in to the target system, when accessing any service node, a process for verifying the target object is set, specifically verifying whether the target object has the authority to access the service node, so as to achieve efficient management of the services or resources of the target system. When the target object accesses the service node for the first time, the authority of the target object can be verified. When it is detected that the target object is not accessing the service node for the first time, the target object can directly access the service node without repeated verification. It can be understood that there will be a certain association relationship between some service nodes. Preferably, when detecting whether the target object accesses the service node for the first time, the association relationship between the two service nodes can be taken into account. If the target object successfully accesses any service node, then when the target object first accesses other service nodes associated with the target object, it is not necessary to verify the target object, which can avoid cumbersome user verification operations and improve user experience. It should be noted that the resources in the target system can also be verified. For services and resources that need to be set for verification processing, they can be pre-set according to actual needs. Wherein, the preset verification method includes a password verification method and a biometric verification method. Specifically, when the target object accesses any service node, a verification pop-up window can be set to remind the target object to perform permission verification. The verification method can be set to password verification method and biometric verification method, and the target object can choose any method for verification.

[0046] Optionally, the target object is verified according to a preset verification method, including: in response to the target object being verified according to the preset verification method, obtaining basic information of the target object, the basic information including user ID and current location information; obtaining preset authorization policy information, wherein the authorization policy includes access rules, authorization conditions and authorization levels; and verifying the basic information of the target object based on the preset authorization policy information to determine the target object's access rights and access resources.

[0047] Among them, access rules specifically represent the rules set for roles and user identities. Different access rights can be set for users based on different roles set for user identities; authorization conditions specifically represent time restrictions and location restrictions; authorization levels specifically include permission levels and role inheritance.

[0048] Specifically, when the target object selects any of the preset verification methods, in response to the selection operation of the target object, the basic information of the target object is obtained, wherein the basic information includes the user ID and the user's current location information. The user ID is specifically an identifier that represents the identity information of the target object, which can be a user name or a unique string composed of numbers, special symbols and letters, which is not limited here. After obtaining the basic information of the target object, the authorization policy information is obtained from the preset data storage space or configuration file, wherein the authorization policy includes access rules, authorization conditions and authorization levels, the basic information of the target object is matched with each information in the authorization policy, and the user ID is matched with the access rules to determine the role information corresponding to the user ID, that is, the role information of the target object is determined. It should be noted that different role information is assigned corresponding access rights and access resources. Therefore, when the role information of the target object is determined, the access rights and access resources of the target object can be determined. In addition, the authorization strategy also includes authorization conditions, and the current location information of the target object is matched based on the authorization conditions. If the match is successful, it indicates that the location information of the target object meets the access conditions. Preferably, the basic information also includes time information, and the time information indicates the time point used to limit the target object's access to the service node. By judging whether the time point when the target object accesses the service node satisfies the time information in the access conditions, it is determined whether the target object has access rights at the current time point. If so, the target object can access the service node at the current time point, otherwise it cannot access the service node. The operable functions of the target object on the service node are determined according to the authorization level. Different authorization levels can be set to assign different operation functions to corresponding roles. By defining the permissions of different resources and associating roles, permissions and specific operation functions, different operable functions can be automatically assigned to different user roles, thereby improving the fine-grained management of various operation functions of the target system.

[0049] In this embodiment, the password authentication method and the biometric authentication method are integrated with a single login mechanism, so that users can seamlessly switch between multiple applications or services in the system without repeated logins, thereby improving user experience and the response speed of applications or services.

[0050] S120. Determine the corresponding key feature information based on the power spectral density of each service node, determine the various indicator data in the detection index of the service node based on the key feature information, process the various indicator data in the detection index through a deep learning model, and obtain the target detection indicator data of the service node.

[0051] Among them, the key feature information includes frequency peak, variance and mean. The extraction of frequency peak usually involves finding the local maximum of the power spectrum density function. This can be achieved by taking the derivative of the power spectrum density function and finding the points where the derivative is equal to zero. These points correspond to the extreme points of the power spectrum density function, that is, the frequency peak. In practical applications, since the data is discrete, we usually use some form of search algorithm (such as local maximum search) to find peaks in discrete data. The calculation of variance and mean is relatively straightforward, and the corresponding statistics can be obtained by analyzing the data of the entire power spectrum density function. The variance reflects the degree of discreteness of the data points, while the mean is the average of all data points. When calculating the variance, we need to calculate the sum of the squares of the deviations of each data point from the mean and then divide it by the number of data points. When calculating the mean, we simply add up all data points and divide it by the number of data points.

[0052] Specifically, the corresponding key feature information can be determined according to the power spectrum density of each service node, that is, the frequency peak, variance and mean can be determined. Corresponding weight information is set for each key feature, and the various indicator data in the detection index of the corresponding service node are determined based on the key feature information and the corresponding weight data.

[0053] Exemplarily, for the user activity index, corresponding weight data is set for each key feature, and these features are weighted and summed as the user activity index. The user activity index can be calculated using the following formula: [User activity = \frac{{\sum_{i=1}^{n}(w_i\timesx_i)}}{n}] where (w_i) is the weight of the feature (x_i) and (n) is the number of features; for the network load index, a weighted average or percentage is used to represent the network load. The network load index can be calculated using the following formula: [Network load index Number = \frac{{\sum_{i=1}^{n}(w_i\timesx_i)}}{n}] where (w_i) is the weight of feature (x_i) and (n) is the number of features; for the equipment operation status index, the weighted average or percentage is used to represent the operation status of the equipment. The equipment operation status index can be calculated using the following formula: [Equipment operation status index = \frac{{\sum_{i=1}^{n}(w_i\timesx_i)}}{n}] where (w_i) is the weight of feature (x_i) and (n) is the number of features.

[0054] After determining the various indicator data in the detection indicators of the service node, the various indicator data in the detection indicators will be processed through the deep learning model to obtain the target detection indicator data of the service node. Among them, the deep learning model uses the long short-term memory network model, and the long short-term memory network model adds a Dropout layer. The Dropout layer is located between the LSTM layer and the fully connected layer of the long short-term memory network model. Its input layer, LSTM layer, fully connected layer and output layer are connected in sequence; using the mean square error as the loss function, setting the number of training rounds and batch size, and using the extracted feature data to train the long short-term memory network model. At the end of each training round, according to the value of the loss function, the back propagation algorithm is used to adjust the parameters of the long short-term memory network model to continue traversing the training and minimize the loss function; when the change of the loss function is less than the preset value, the training is terminated to obtain a trained deep learning model for determining the target detection indicator data.

[0055] S130. Call the link detection knowledge graph and various alarm rules in the preset alarm rule library; wherein the link detection knowledge graph is constructed based on entities corresponding to the operation data of multiple service nodes in the target system and the relationship types between the entities.

[0056] Among them, entities can be specifically understood as representing objects or things with independent existence, including but not limited to applications, service nodes, databases and users. The relationship types between entities can be specifically understood as representing the association relationship between entities, and the relationship types include but are not limited to dependency relationships, connection relationships and communication relationships. The link detection knowledge graph and the preset alarm rule library are both pre-existing in the preset target storage space. When the link detection knowledge graph and the preset alarm rule library are needed, they can be directly called. It is also possible to add new alarm rules to the preset alarm rule library and / or update the various alarm rules in the preset alarm rule library through the interactive page or configuration file.

[0057] Specifically, after determining the target detection index data of the service node, the target detection index data of the service node can be judged by calling the link detection knowledge graph and various alarm rules in the preset alarm rule library to determine the abnormal state of the service node.

[0058] In this embodiment, by calling the link detection knowledge graph and various alarm rules in the preset alarm rule library to determine the target detection index data of the service node, it is possible to achieve comprehensive detection of each service node of the target system, thereby improving the comprehensiveness and efficiency of the detection, obtaining abnormal problems in a timely manner, and better ensuring the stability of the target system operation.

[0059] Optionally, a link detection knowledge graph is constructed based on entities in the operating data of multiple service nodes in the target system and the relationship types between entities, including: identifying entities corresponding to the operating data of multiple service nodes, creating node objects for each entity, and setting node identifiers and node attribute information for the node objects, wherein the node attribute information includes node name, node type, node status, and detection indicator data; determining the relationship types between entities based on basic information of the target system, creating edge objects between corresponding entities based on the relationship types, and setting corresponding edge identifiers and edge attribute information for the edge objects, wherein the basic information includes a system architecture diagram and a service topology diagram, and the edge attribute information includes relationship types and weight information, and the relationship types include dependency relationships, connection relationships, and communication relationships; connecting corresponding nodes based on the relationship types in each edge attribute information to form a link detection knowledge graph.

[0060] Specifically, the operation data of multiple service nodes are traversed to identify entity information in the operation data, wherein the entity includes but is not limited to service nodes and users. A node object is created for each entity, and a node identifier and node attribute information are set for the node object, wherein the node identifier is unique, and a unique number, string or other form of identifier node can be used, and the attribute information includes node name, node type, node status and detection index data, and the detection index data can be calculated by the method in the above embodiment. In the process of constructing the knowledge graph, when creating the node object, the detection index data of the corresponding service node can be directly read and set as one of the attribute information of the corresponding service node; the relationship type between each entity is determined based on the basic information of the target system, wherein the basic information includes a system architecture diagram and a service topology diagram, and the system architecture diagram and service topology diagram corresponding to the target system are obtained from the target storage space. The relationship type between each service node can be determined by identifying the system architecture diagram or the service topology diagram, and the relationship type includes dependency, connection and communication relationship; based on the relationship type, edge objects are created between corresponding entities, and corresponding edge identifiers and edge attribute information are set for the edge objects, and the relationship type is used as a kind of attribute information in the edge attribute information. The attribute information also includes weight information corresponding to the relationship type, wherein the weight information can be pre-calibrated according to actual needs. Based on the relationship type in the attribute information of each edge, the corresponding nodes are connected to form a complete link detection knowledge graph, ensuring that the starting point and end point of the edge correspond to the unique identifier of the node. You can also set the attributes of the graph, including name and description information, and integrate the attribute information corresponding to the node object and edge object in the link detection knowledge graph, which helps users to query and analyze.

[0061] S140: Based on the link detection knowledge graph and various alarm rules in the preset alarm rule library, abnormality judgment is performed on the target detection indicator data to determine the abnormal status information of each service node in the target system.

[0062] Specifically, the target detection index data can be judged for abnormality through various alarm rules in the preset alarm rule library to obtain the abnormality judgment results of each service node. When it is determined that each service node has an abnormality, the associated node object corresponding to the service node with abnormality can be found according to the link detection knowledge graph, and the associated node object can be judged for abnormality to obtain the abnormality judgment result of the associated node object. The abnormal state of the service node with abnormality in the abnormality judgment result is set as the abnormal state, and the abnormal state of the service node without abnormality in the abnormality judgment result is set as the non-abnormal state.

[0063] The technical solution of this embodiment is to determine the power spectrum density corresponding to the target operation data of each service node by receiving the target operation data sent by multiple service nodes in the target system, wherein the target operation data includes data associated with the detection index, and the detection index includes one or more of the user activity index, the network load index and the equipment operation status index; determine the corresponding key feature information based on the power spectrum density of each service node, determine the various indicator data in the detection index of the service node based on the key feature information, and process the various indicator data in the detection index through a deep learning model to obtain the target detection indicator data of the service node; call the link detection knowledge graph and the various alarm rules in the preset alarm rule library; wherein the link detection knowledge graph is constructed based on the entities corresponding to the operation data of multiple service nodes in the target system and the relationship types between the entities; perform abnormal judgment on the target detection indicator data based on the link detection knowledge graph and the various alarm rules in the preset alarm rule library to determine the abnormal status information of each service node in the target system. This solution implements the construction of power spectrum density of operation data of multiple service nodes to determine the corresponding key feature information, and then determines the indicator data of the corresponding detection indicators. The deep learning model is used to process the indicator data of the obtained detection indicators to obtain the target detection indicator data. The pre-configured alarm rules and link detection knowledge graph are used to quickly and comprehensively determine the existing alarm problems, which helps to quickly respond to the alarm problems, so as to improve the operation stability of the target system; it solves the problems of inconsistent service granularity and the inability to fully detect system anomalies, and improves the comprehensiveness and efficiency of detection of the target system, so that the target system can run more stably.

[0064] Embodiment 2

[0065] Figure 2This is a flow chart of a service platform anomaly detection method provided in the second embodiment of the present invention. This embodiment is a further optimization of the method of the above embodiment. Optionally, various alarm rules in the preset alarm rule library are traversed, and the target detection index data of each service node is judged to be abnormal based on the various alarm rules, and the abnormal judgment results of each service node are determined; and, based on the link detection knowledge graph, the associated node object of the service node is determined, and various alarm rules in the preset alarm rule library are called to judge the abnormality of the associated node object, and the abnormal judgment results of the associated node object are determined; based on the abnormal judgment results of each service node and the abnormal judgment results of the corresponding associated node objects, the abnormal status information of the corresponding service node is determined. When an abnormality exists in the service node, the alarm information of the service node is determined. The alarm information includes the alarm event type and the alarm event level, and the abnormal status information of each service node in the target system is obtained. Figure 2 As shown, the method includes:

[0066] S210. Receive target operation data sent by multiple service nodes in the target system, and determine the power spectrum density corresponding to the target operation data of each service node, wherein the target operation data includes data associated with detection indicators, and the detection indicators include one or more of a user activity index, a network load index, and a device operation status index.

[0067] S220. Determine the corresponding key feature information based on the power spectral density of each service node, determine the various indicator data in the detection index of the service node based on the key feature information, process the various indicator data in the detection index through a deep learning model, and obtain the target detection indicator data of the service node.

[0068] S230. Call the link detection knowledge graph and various alarm rules in the preset alarm rule library; wherein the link detection knowledge graph is constructed based on entities corresponding to the operation data of multiple service nodes in the target system and the relationship types between the entities.

[0069] S240, traverse various alarm rules in the preset alarm rule library, perform abnormal judgment on the target detection indicator data of each service node based on various alarm rules, and determine the abnormal judgment result of each service node; and, determine the associated node object of the service node based on the link detection knowledge graph, call various alarm rules in the preset alarm rule library to perform abnormal judgment on the associated node object, and determine the abnormal judgment result of the associated node object.

[0070] Among them, the preset alarm rule base stores various alarm rules applicable to the target system, and the preset alarm rule base can be updated through the preset configuration interactive interface or configuration file. The alarm rules include alarm event type, alarm level, trigger condition and threshold information. The associated node object can be specifically understood as a node object that has a connection relationship with the service node in the link detection knowledge graph, which can be determined based on the edge attribute information in the link detection knowledge graph.

[0071] Specifically, traverse each alarm rule in the preset alarm rule library, compare the threshold information in each alarm rule with the target detection index data of each service node one by one, judge whether the target detection index data of each service node meets the corresponding threshold information, store the judgment result in the abnormal judgment result, complete the abnormal judgment of all service nodes in turn, and obtain the abnormal judgment result of each service node. Identify the constructed link detection knowledge graph, determine the node object associated with each service node, call each alarm rule in the preset alarm rule library to perform abnormal judgment on the associated node object, determine the abnormal judgment result of the associated node object, and preferably, update the abnormal state of the corresponding service node according to the abnormal judgment result of the associated node object.

[0072] It is understandable that there are corresponding time patterns for the use of the target system. By performing statistical analysis on the actual operating data of the target system, the threshold data of different detection indicators in different time periods can be predicted, and the threshold information in the alarm rules can be dynamically adjusted according to the statistical results to ensure that the alarm rules are more in line with the actual operation of the target system. For example, during the working day stage, the usage rate of the target system will increase significantly, and the threshold information corresponding to each detection indicator will need to be adjusted.

[0073] S250. Determine the abnormal status information of the corresponding service node based on the abnormal determination result of each service node and the abnormal determination result of the corresponding associated node object. When an abnormality exists in the service node, determine the alarm information of the service node. The alarm information includes the alarm event type and the alarm event level.

[0074] Specifically, the service node with an abnormality is determined based on the result data in the abnormal determination result, that is, the abnormal state of the service node corresponding to the target detection indicator data that does not meet the corresponding threshold information in the abnormal determination result is set as abnormal, and the corresponding alarm event type and alarm event level are matched according to the alarm rule corresponding to the abnormal service node. If there is no abnormality in the service node, but the corresponding associated node object is abnormal, the abnormal state of the corresponding service node can be set as abnormal according to the abnormal situation of each associated node object. Exemplarily, the corresponding weight value can be set according to the abnormal situation of each associated node object, and then the abnormal state of the service node is determined based on the weight value. Correspondingly, for the associated node object, the associated node objects that do not meet the alarm rules are screened out, and the alarm event type and alarm event level corresponding to the associated node object are matched.

[0075] On the basis of the above embodiment, after determining the alarm information of the service node, the method further includes: matching the alarm event type and alarm event level of the service node with preset rules and knowledge base to determine the alarm cause of the service node.

[0076] Among them, the rules and knowledge base are the relationship libraries of the alarm event types and the corresponding alarm causes that were originally constructed, and can be called when the alarm event type and alarm event level of the service node are determined to determine the alarm cause of the corresponding service node.

[0077] Specifically, after determining the alarm information of the service node, call the preset rules and knowledge base, traverse the preset rules and various data in the knowledge base, and match them with the alarm event type and alarm event level of the service node, and use the successfully matched information as the alarm reason of the corresponding service node.

[0078] S260: Obtain abnormal status information of each service node in the target system.

[0079] The technical solution of this embodiment is to determine the power spectrum density corresponding to the target operation data of each service node by receiving the target operation data sent by multiple service nodes in the target system, wherein the target operation data includes data associated with the detection index, and the detection index includes one or more of the user activity index, the network load index and the equipment operation status index; determine the corresponding key feature information based on the power spectrum density of each service node, determine the various indicator data in the detection index of the service node based on the key feature information, process the various indicator data in the detection index through a deep learning model, and obtain the target detection indicator data of the service node; call the link detection knowledge graph and the various alarm rules in the preset alarm rule library; wherein the link detection knowledge graph is based on the operation data of multiple service nodes in the target system. The corresponding entities and the relationship types between the entities are constructed; various alarm rules in the preset alarm rule library are traversed, and the target detection indicator data of each service node is judged to be abnormal based on the various alarm rules, and the abnormal judgment results of each service node are determined; and, based on the link detection knowledge graph, the associated node object of the service node is determined, and various alarm rules in the preset alarm rule library are called to judge the abnormality of the associated node object, and the abnormal judgment results of the associated node object are determined; based on the abnormal judgment results of each service node and the abnormal judgment results of the corresponding associated node objects, the abnormal status information of the corresponding service node is determined, and when the service node is abnormal, the alarm information of the service node is determined, and the alarm information includes the alarm event type and the alarm event level; the abnormal status information of each service node in the target system is obtained. This solution implements the construction of power spectrum density of operation data of multiple service nodes to determine the corresponding key feature information, and then determines the indicator data of the corresponding detection indicators. The deep learning model is used to process the indicator data of the obtained detection indicators to obtain the target detection indicator data. The pre-configured alarm rules and link detection knowledge graph are used to quickly and comprehensively determine the existing alarm problems, which helps to quickly respond to the alarm problems, so as to improve the operation stability of the target system; it solves the problems of inconsistent service granularity and the inability to fully detect system anomalies, and improves the comprehensiveness and efficiency of detection of the target system, so that the target system can run more stably.

[0080] Embodiment 3

[0081] Figure 3 This is a flow chart of a service platform anomaly detection method provided by Embodiment 3 of the present invention. This embodiment is a further optimization of the method of the above embodiment. Optionally, the associated information corresponding to each transaction in the target system is obtained, wherein the associated information includes the transaction start processing time, transaction end processing time, transaction processing failure time and transaction retry information; the transaction abnormality status of each transaction is determined based on the associated information. Figure 3 As shown, the method includes:

[0082] S310. Receive target operation data sent by multiple service nodes in the target system, and determine the power spectrum density corresponding to the target operation data of each service node, wherein the target operation data includes data associated with detection indicators, and the detection indicators include one or more of a user activity index, a network load index, and a device operation status index.

[0083] S320. Determine the corresponding key feature information based on the power spectral density of each service node, determine the various indicator data in the detection index of the service node based on the key feature information, process the various indicator data in the detection index through a deep learning model, and obtain the target detection indicator data of the service node.

[0084] S330, calling the link detection knowledge graph and various alarm rules in the preset alarm rule library; wherein the link detection knowledge graph is constructed based on entities corresponding to the operation data of multiple service nodes in the target system and the relationship types between the entities.

[0085] S340: Based on the link detection knowledge graph and various alarm rules in the preset alarm rule library, the target detection indicator data is judged to be abnormal, and the abnormal status information of each service node in the target system is determined.

[0086] S350: Obtain correlation information corresponding to each transaction in the target system, wherein the correlation information includes transaction start processing time, transaction end processing time, transaction processing failure time, and transaction retry information.

[0087] Among them, a transaction specifically represents a series of logical operations corresponding to the realization of a certain function. It should be noted that in order to understand the operation process of a transaction, the start time of any logical operation corresponding to any transaction and the generated operation data will be recorded and stored, and can be stored together with the operation data of the target system. The associated information corresponding to each transaction can be obtained in real time by calling the pre-developed transaction information acquisition interface, or the associated information of each transaction can be filtered out from the operation data of the target system. The associated information includes but is not limited to the transaction start processing time, transaction end processing time, transaction processing failure time and transaction retry information.

[0088] Specifically, the transaction information acquisition interface can be called and executed to acquire the associated information corresponding to each transaction in the target system in real time. Alternatively, the associated information corresponding to the transaction can be screened out from the operating data of the target system. This is not limited here.

[0089] S360: Determine the transaction abnormality status of each transaction based on the associated information.

[0090] Among them, the transaction abnormal state can be specifically understood as being used to characterize the abnormal state in the transaction processing process, that is, to characterize whether there is an abnormal situation in the transaction. The abnormal state includes but is not limited to the state of transaction processing taking too long, transaction processing failure and transaction processing delay, which is specifically determined based on the associated information of the transaction.

[0091] Specifically, the processing time of a transaction can be determined based on the transaction start processing time and the transaction end processing time, and it can be determined whether the processing time of the transaction exceeds the corresponding theoretical processing time of the transaction. If the processing time of the transaction exceeds the corresponding theoretical processing time of the transaction, the transaction abnormality state of the transaction is determined to be a state where the transaction processing time is too long. The corresponding transaction processing failure can be determined based on the transaction processing failure time, and then the abnormal state of the corresponding transaction is a transaction processing failure state. Based on the comparison between the transaction start processing time and the preset transaction processing start time, if the transaction processing start time is later than the preset transaction processing start time, the transaction abnormality state of the transaction is determined to be a transaction processing delay state. Preferably, the corresponding transaction abnormality response operation can be quickly determined based on the transaction abnormality state of each transaction to ensure that the transaction processing process can be executed normally, accurately and stably.

[0092] The technical solution of this embodiment is to determine the power spectrum density corresponding to the target operation data of each service node by receiving the target operation data sent by multiple service nodes in the target system, wherein the target operation data includes data associated with the detection index, and the detection index includes one or more of the user activity index, the network load index and the device operation status index; determine the corresponding key feature information based on the power spectrum density of each service node, determine the various indicator data in the detection index of the service node based on the key feature information, and process the various indicator data in the detection index through a deep learning model to obtain the target detection indicator data of the service node; call the link detection knowledge graph and the various alarm rules in the preset alarm rule library; wherein the link detection knowledge graph is constructed based on the entities corresponding to the operation data of multiple service nodes in the target system and the relationship types between the entities; perform abnormal judgment on the target detection indicator data based on the link detection knowledge graph and the various alarm rules in the preset alarm rule library to determine the abnormal status information of each service node in the target system; obtain the associated information corresponding to each transaction in the target system, wherein the associated information includes the transaction start processing time, the transaction end processing time, the transaction processing failure time and the transaction retry information. This solution realizes the construction of power spectrum density of operation data of multiple service nodes to determine the corresponding key feature information, and then determines the corresponding indicator data of each indicator. The deep learning model is used to process the obtained indicator data of each indicator to obtain the target detection indicator data. Through the pre-configured alarm rules and link detection knowledge graph, the alarm problems that exist can be quickly and comprehensively determined, which helps to quickly respond to the alarm problems, so as to improve the operation stability of the target system; solve the problems of inconsistent service granularity and inability to fully detect system anomalies, improve the comprehensiveness and efficiency of the detection of the target system, so that the target system can run more stably. Moreover, the detection and processing of transaction status is introduced, which can not only detect the abnormal detection of the target system, but also detect the abnormal state of the transaction, and can timely discover the abnormal situation of the transaction, which helps to ensure the stable operation of the system and efficiently handle transactions.

[0093] Embodiment 4

[0094] Figure 4 Schematic diagram of a service platform anomaly detection system provided by Embodiment 4 of the present invention. Figure 4 As shown, the system includes: a data collection module 410, a detection index data screening module 420, a link detection knowledge graph construction module 430, an alarm rule configuration module 440, an abnormality determination module 450, a transaction status determination module 460, and an authorization management module 470; wherein:

[0095] The link detection knowledge graph construction module 430 is used to construct a link detection knowledge graph based on entities corresponding to the operation data of multiple service nodes in the target system and the relationship types between the entities.

[0096] Specifically, the entity information in the operation data of multiple service nodes in the target system is identified through the link detection knowledge graph construction module 430, and corresponding node objects are created for the identified entities, and corresponding node identifiers are set. The system architecture diagram and service topology diagram of the target system are called to obtain the relationship type between each entity, and edge objects between entities are created based on the relationship type, and the corresponding relationship type is set as one of the attributes of the edge object, where the relationship type includes but is not limited to dependency relationships, connection relationships, and communication relationships. Specifically, a node object is created for each entity, a corresponding edge object is created between two nodes with a relationship type, and the node objects are connected based on the connection type corresponding to the edge object to form a complete link detection knowledge graph.

[0097] The alarm rule configuration module 440 is used to add one or more of the alarm event type, alarm event level, trigger condition and threshold setting information to the preset alarm rule library in response to the input operation of one or more of the alarm event type, alarm event level, trigger condition and threshold setting information.

[0098] Specifically, one or more of the alarm event type, alarm event level, trigger condition and threshold setting information can be input through the interactive page. After submitting the input information, the alarm rule configuration module 440 receives one or more of the alarm event type, alarm event level, trigger condition and threshold setting information, and stores it in the preset alarm rule library.

[0099] The alarm rule configuration module 440 includes a dynamic threshold setting submodule, which is used to predict the threshold data of different detection indicators in different time periods by performing statistical analysis on the actual operation data of the target system, and dynamically adjust the threshold information in the alarm rules according to the statistical results to ensure that the alarm rules are more in line with the actual operation of the target system. For example, during the working day stage, the utilization rate of the target system will increase significantly, so the threshold information corresponding to each detection indicator needs to be adjusted.

[0100] The data collection module 410 is used to receive target operation data sent by multiple service nodes in the target system, and send the target operation data sent by the multiple service nodes to the detection index data screening module 420.

[0101] Specifically, the data acquisition module 410 receives the target operation data sent by multiple service nodes in the target system in real time or offline, and sends the target operation data sent by multiple service nodes in the target system to the detection index data screening module 420.

[0102] The detection index data screening module 420 is used to receive the target operation data sent by multiple service nodes, and determine the power spectrum density corresponding to the target operation data of each service node, determine the corresponding key feature information based on the power spectrum density of each service node, determine the various indicator data in the detection index of the service node based on the key feature information, and process the various indicator data in the detection index through a deep learning model to obtain the target detection index data of the service node.

[0103] Specifically, when the detection index data screening module 420 receives target operation data sent by multiple service nodes, the target operation data is processed according to the fast Fourier transform, that is, the time domain signal is converted into a frequency domain signal, the corresponding power spectrum density is calculated, and the key feature information in the power spectrum density is extracted, that is, the frequency peak, variance and mean are determined. Corresponding weight information is set for each key feature information, and the various indicator data in the detection index of the corresponding service node are determined based on the key feature information and the corresponding weight data. The deep learning model is called to process the various indicator data in the detection index to obtain the target detection index data of the service node.

[0104] The abnormality judgment module 450 is used to call the link detection knowledge graph and the various alarm rules in the preset alarm rule base; based on the link detection knowledge graph and the various alarm rules in the preset alarm rule base, the target detection indicator data is judged to be abnormal, and the abnormal status information of each service node in the target system is determined.

[0105] Specifically, the link detection knowledge graph and the various alarm rules in the preset alarm rule base are called by the abnormality judgment module 450, and the target detection index data is judged to be abnormal by the various alarm rules in the preset alarm rule base to obtain the abnormality judgment results of each service node. When it is determined that each service node has an abnormality, the associated node object corresponding to the service node with an abnormality can be determined according to the link detection knowledge graph, and the associated node object is judged to be abnormal, and the abnormality judgment result of the associated node object is obtained. The abnormal state of the service node with an abnormality in the abnormality judgment result is set to the abnormal state, and the abnormal state of the service node without an abnormality in the abnormality judgment result is set to the non-abnormal state. Correspondingly, the abnormal state of the associated node object with an abnormality in the abnormality judgment result is set to the abnormal state, and the abnormal state of the associated node object without an abnormality in the abnormality judgment result is set to the non-abnormal state.

[0106] The transaction status determination module 460 is used to obtain the associated information corresponding to each transaction in the target system, and determine the transaction abnormal status of each transaction based on the associated information, wherein the associated information includes the transaction start processing time, the transaction end processing time, the transaction processing failure time and the transaction retry information.

[0107] Specifically, the transaction status determination module 460, by calling the transaction information acquisition interface, executes the transaction information acquisition interface to obtain the associated information corresponding to each transaction in the target system in real time. It is also possible to filter out the associated information corresponding to the transaction from the operation data of the target system. The processing time of the transaction can be determined according to the transaction start processing time and the transaction end processing time, and it is judged whether the processing time of the transaction exceeds the corresponding transaction theoretical processing time. If the processing time of the transaction exceeds the corresponding transaction theoretical processing time, the transaction abnormal state of the transaction is determined to be the transaction processing time too long state. According to the transaction processing failure time, the corresponding transaction processing failure can be determined, and the abnormal state of the corresponding transaction is the transaction processing failure state. Based on the transaction start processing time and the preset transaction start processing time, a comparison is performed. If the transaction start processing time is later than the preset transaction start processing time, the transaction abnormal state of the transaction is determined to be the transaction processing delay state. Preferably, the corresponding transaction abnormal response operation can be quickly determined according to the transaction abnormal state of each transaction to ensure that the transaction processing process can be executed normally, accurately and stably.

[0108] The authorization management module 470 is used to configure the authorization policy and determine the access rights and access resources of the target object based on the authorization policy, wherein the authorization policy includes access rules, authorization conditions and authorization levels.

[0109] Specifically, the authorization policy is configured through the authorization management module 470; after obtaining the basic information of the target object, the authorization policy information is obtained from the preset data storage space or configuration file, wherein the authorization policy includes access rules, authorization conditions and authorization levels, the basic information of the target object is matched with the authorization policy information, and the access rules are matched according to the user ID to determine the role information corresponding to the user ID, that is, to determine the role information of the target object. It should be noted that different role information is assigned corresponding access rights and access resources. Therefore, when the role information of the target object is determined, the access rights and access resources of the target object can be determined. In addition, the authorization strategy also includes authorization conditions, and the current location information of the target object is matched based on the authorization conditions. If the match is successful, it indicates that the location information of the target object meets the access conditions. Preferably, the basic information also includes time information, and the time information indicates the time point when the target object accesses the service node. By judging whether the time point when the target object accesses the service node satisfies the time information in the access conditions, it is determined whether the target object has access authority. If so, the target object can access the service node at the current moment, otherwise it cannot access the service node. The operable functions of the target object on the service node are determined according to the authorization level, and different authorization levels can be set to assign different operation functions to corresponding roles.

[0110] Optionally, the system further includes a noise reduction algorithm module for performing noise reduction processing on the received operation data of multiple service nodes to remove noise and abnormal values ​​in the operation data.

[0111] Specifically, the moving average algorithm is used to denoise the operating data of multiple data sources. The specific steps are as follows: Determine the window size. For window-based algorithms such as the moving average method, the window size needs to be determined. The window size determines the number of data points considered in the smoothing process. Different window sizes are suitable for different degrees of smoothing. Calculate the smoothing value. Apply the selected moving smoothing algorithm to the operating data to calculate the smoothing value of each data point. Process outliers. In the process of calculating the moving smoothing value, outliers can be identified and processed by setting thresholds or detecting outliers. Outliers can be corrected to the average value of surrounding data points or corrected by interpolation and other methods. Update the data. Apply the calculated smoothing value to the original operating data to form a denoised data sequence.

[0112] The service platform anomaly detection system provided in the embodiment of the present invention can execute the service platform anomaly detection method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0113] Embodiment 5

[0114] Figure 51 is a schematic diagram of the structure of an electronic device provided in Embodiment 5 of the present invention. The electronic device 10 is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0115] like Figure 5 As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0116] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0117] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The processor 11 executes the various methods and processes described above, such as the service platform anomaly detection method.

[0118] In some embodiments, the service platform anomaly detection method may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the service platform anomaly detection method described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to execute the service platform anomaly detection method in any other appropriate manner (e.g., by means of firmware).

[0119] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0120] The computer program for implementing the service platform anomaly detection method of the present invention can be written in any combination of one or more programming languages. These computer programs can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program can be executed entirely on the machine, partially on the machine, as a stand-alone software package, partially on the machine and partially on a remote machine, or entirely on a remote machine or server.

[0121] Embodiment 6

[0122] Embodiment 6 of the present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to cause a processor to execute a service platform anomaly detection method, the method comprising:

[0123] Receiving target operation data sent by multiple service nodes in the target system, and determining a power spectrum density corresponding to the target operation data of each service node, wherein the target operation data includes data associated with a detection indicator, and the detection indicator includes one or more of a user activity index, a network load index, and a device operation status index;

[0124] Determine the corresponding key feature information based on the power spectrum density of each service node, determine the various indicator data in the detection index of the service node based on the key feature information, and process the various indicator data in the detection index through a deep learning model to obtain the target detection indicator data of the service node;

[0125] Calling various alarm rules in the link detection knowledge graph and the preset alarm rule library; wherein the link detection knowledge graph is constructed based on entities corresponding to the operation data of multiple service nodes in the target system and the relationship types between the entities;

[0126] Based on the link detection knowledge graph and the various alarm rules in the preset alarm rule library, the target detection indicator data is judged to be abnormal, and the abnormal status information of each service node in the target system is determined.

[0127] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0128] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0129] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0130] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0131] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0132] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A service platform anomaly detection method, characterized in that: include: Receiving target operation data sent by multiple service nodes in the target system, and determining the power spectrum density corresponding to the target operation data of each of the service nodes, wherein the target operation data includes data associated with a detection indicator, and the detection indicator includes one or more of a user activity index, a network load index, and a device operation status index; Determine corresponding key feature information based on the power spectral density of each of the service nodes, determine various indicator data in the detection index of the service node based on the key feature information, and process various indicator data in the detection index through a deep learning model to obtain target detection indicator data of the service node; Calling various alarm rules in the link detection knowledge graph and the preset alarm rule library; wherein the link detection knowledge graph is constructed based on entities corresponding to the operation data of multiple service nodes in the target system and the relationship types between the entities; Based on the link detection knowledge graph and the various alarm rules in the preset alarm rule library, the target detection index data is judged to be abnormal, and the abnormal status information of each service node in the target system is determined.

2. The method according to claim 1, characterized in that Building a link detection knowledge graph based on entities and relationship types between entities in the operation data of the plurality of service nodes in the target system includes: Identify entities corresponding to the operation data of the plurality of service nodes, create a node object for each of the entities, and set a node identifier and node attribute information for the node object, wherein the node attribute information includes a node name, a node type, a node status, and detection index data; Determine the relationship type between the entities based on the basic information of the target system, create edge objects between the corresponding entities based on the relationship type, and set corresponding edge identifiers and edge attribute information for the edge objects, wherein the basic information includes a system architecture diagram and a service topology diagram, the edge attribute information includes relationship types and weight information, and the relationship types include dependency relationships, connection relationships, and communication relationships; Based on the relationship type in each edge attribute information, the corresponding nodes are connected to form the link detection knowledge graph.

3. The method according to claim 1, characterized in that: The abnormality judgment of the target detection index data based on the link detection knowledge graph and the various alarm rules in the preset alarm rule library to determine the abnormal state information of each service node in the target system includes: Traversing each alarm rule in the preset alarm rule base, performing abnormality judgment on the target detection indicator data of each service node based on the alarm rules, and determining the abnormality judgment result of each service node; and determining the associated node object of the service node based on the link detection knowledge graph, calling each alarm rule in the preset alarm rule base to perform abnormality judgment on the associated node object, and determining the abnormality judgment result of the associated node object; Based on the abnormality determination results of each of the service nodes and the corresponding abnormality determination results of the associated node objects, the abnormal status information of the corresponding service node is determined. When an abnormality exists in the service node, the alarm information of the service node is determined, and the alarm information includes the alarm event type and the alarm event level.

4. The method according to claim 3, characterized in that After determining the alarm information of the service node, the method further includes: The alarm event type and the alarm event level of the service node are matched with preset rules and knowledge base to determine the alarm cause of the service node.

5. The method according to claim 1, characterized in that The method also includes: In the case where the target object accesses any service node in the target system, if it is detected that the target object accesses the service node for the first time, verifying the target object according to a preset verification method; If it is detected that the target object is not accessing the service node for the first time, there is no need to verify the target object; Among them, the preset verification method includes a password verification method and a biometric verification method.

6. The method according to claim 5, characterized in that The verifying the target object according to a preset verification method includes: In response to the target object being verified according to the preset verification method, obtaining basic information of the target object, the basic information including a user ID and current location information; Obtaining preset authorization policy information, wherein the authorization policy includes access rules, authorization conditions, and authorization levels; The basic information of the target object is verified based on the preset authorization policy information to determine the access rights and access resources of the target object.

7. The method according to claim 1, characterized in that The method also includes: Acquire the associated information corresponding to each transaction in the target system, wherein the associated information includes the transaction start processing time, the transaction end processing time, the transaction processing failure time and the transaction retry information; The transaction abnormality status of each of the transactions is determined based on the association information.

8. A service platform anomaly detection system, characterized in that: The system includes: data collection module, detection index data screening module, link detection knowledge graph construction module, alarm rule configuration module, anomaly determination module, transaction status determination module, and authorization management module; among which: The link detection knowledge graph construction module is used to construct the link detection knowledge graph based on entities corresponding to the operation data of multiple service nodes in the target system and the relationship types between the entities; An alarm rule configuration module, configured to, in response to an input operation of one or more of the alarm event type, the alarm event level, the trigger condition and the threshold setting information, add one or more of the alarm event type, the alarm event level, the trigger condition and the threshold setting information to a preset alarm rule library; The data acquisition module is used to receive target operation data sent by multiple service nodes in the target system, and send the target operation data sent by the multiple service nodes to the detection index data screening module; The detection index data screening module is used to receive the target operation data sent by the multiple service nodes, and determine the power spectrum density corresponding to the target operation data of each of the service nodes, determine the corresponding key feature information based on the power spectrum density of each of the service nodes, determine each indicator data in the detection index of the service node based on the key feature information, and process each indicator data in the detection index through a deep learning model to obtain the target detection index data of the service node; The abnormality judgment module is used to call the link detection knowledge graph and the various alarm rules in the preset alarm rule base; based on the link detection knowledge graph and the various alarm rules in the preset alarm rule base, the target detection indicator data is judged to be abnormal, and the abnormal status information of each service node in the target system is determined.

9. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the service platform anomaly detection method described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the service platform anomaly detection method according to any one of claims 1 to 7 when executed.

Images