Abnormal computing resource information alarm method, electronic equipment and computer readable medium

Abstract

The embodiment of the invention discloses an abnormal computing resource information warning method, electronic equipment and a computer readable medium. A specific embodiment of the method comprises the steps of performing data aggregation processing on a computing resource call chain information set to generate a computing resource call chain aggregation information set; performing incremental updating processing on the computing resource standardized information set; performing incremental updating processing on the computing resource call chain aggregation information set; inputting the computing resource instance information set and the computing resource call chain instance information set into a pre-trained instance relationship prediction model; performing data standardization processing on the computing resource instance relationship prediction information set to generate a computing resource instance relationship prediction standardized information set; and performing exception recognition processing on the calculation resource instance relationship prediction standardized information set to generate an exception calculation resource information recognition result. According to the embodiment, the alarm can be given out in time through detection of multiple types of detection data, dynamic updating, standardized processing and application of the prediction model.

Description

Technical Field

[0001] Embodiments of the present disclosure relate to the computer field, and in particular to an abnormal computing resource information alarm method, an electronic device, and a computer-readable medium. Background Art

[0002] In modern computing environments, the management and monitoring of computing resources is a key link in ensuring system performance. At present, when issuing abnormal computing resource information alarms, the commonly used method is to obtain computing resource information and issue alarms by integrating various monitoring tools (network monitoring tools).

[0003] However, in practice, it is found that when the above method is used to generate abnormal computing resource information alarms, the following technical problems often occur:

[0004] First, monitoring tools can usually only process specific types of information and cannot fully integrate different types of computing resource data. As a result, it is difficult to issue abnormal alarms in a timely and accurate manner when processing complex computing resource information.

[0005] Second, when processing complex computing resource instance relationship prediction information, monitoring tools lack effective aggregation and standardization mechanisms, making it difficult to accurately identify abnormal computing resource results. This makes it impossible to effectively issue alerts for abnormal computing resource identification results.

[0006] The above information disclosed in this Background section is only for enhancement of understanding of the background of the inventive concept and therefore it may contain information that does not form the prior art that is already known in this country to a person of ordinary skill in the art. Summary of the invention

[0007] The content of this disclosure is used to introduce concepts in a brief form, which will be described in detail in the detailed implementation section below. The content of this disclosure is not intended to identify the key features or essential features of the technical solution claimed for protection, nor is it intended to limit the scope of the technical solution claimed for protection.

[0008] Some embodiments of the present disclosure propose abnormal computing resource information alarm methods, devices, electronic devices and computer-readable media to solve one or more of the technical problems mentioned in the above background technology section.

[0009] In a first aspect, some embodiments of the present disclosure provide an abnormal computing resource information alarm method, the method comprising: obtaining a computing resource information set and a computing resource call chain information set; obtaining an initial computing resource call chain information set; performing data standardization processing on the above computing resource information set to generate a computing resource standardized information set; performing data aggregation processing on the above computing resource call chain information set to generate a computing resource call chain aggregate information set; performing incremental update processing on the above computing resource standardized information set to generate a computing resource instance information set; performing incremental update processing on the above computing resource call chain aggregate information set to generate a computing resource call chain instance information set; combining the above computing resource instance information set and the above computing resource call chain aggregate information set; The computing resource call chain instance information set is input into a pre-trained instance relationship prediction model to obtain a computing resource instance relationship prediction information set; data standardization processing is performed on the above computing resource instance relationship prediction information set to generate a computing resource instance relationship prediction standardized information set, and the above computing resource instance relationship prediction standardized information set is stored in a resource management database; anomaly identification processing is performed on the above computing resource instance relationship prediction standardized information set to generate an abnormal computing resource information identification result; in response to determining that the above abnormal computing resource information identification result meets the preset abnormal alarm condition, the above computing resource instance relationship prediction standardized information set is sent to the associated alarm terminal for abnormal alarm processing.

[0010] In a second aspect, some embodiments of the present disclosure provide an abnormal computing resource information alarm device, the device comprising: a first acquisition unit, configured to acquire a computing resource information set and a computing resource call chain information set; a second acquisition unit, configured to acquire an initial computing resource call chain information set; a standardization unit, configured to perform data standardization processing on the computing resource information set to generate a computing resource standardized information set; an aggregation unit, configured to perform data aggregation processing on the computing resource call chain information set to generate a computing resource call chain aggregate information set; a first update unit, configured to perform incremental update processing on the computing resource standardized information set to generate a computing resource instance information set; a second update unit, configured to perform incremental update processing on the computing resource call chain aggregate information set to generate a computing resource call chain instance information set; an input unit A unit is configured to input the computing resource instance information set and the computing resource call chain instance information set into a pre-trained instance relationship prediction model to obtain a computing resource instance relationship prediction information set; a storage unit is configured to perform data standardization processing on the computing resource instance relationship prediction information set to generate a computing resource instance relationship prediction standardized information set, and store the computing resource instance relationship prediction standardized information set in a resource management database; an identification unit is configured to perform anomaly identification processing on the computing resource instance relationship prediction standardized information set to generate an abnormal computing resource information identification result; a sending unit is configured to send the computing resource instance relationship prediction standardized information set to an associated alarm terminal for abnormal alarm processing in response to determining that the abnormal computing resource information identification result meets a preset abnormal alarm condition.

[0011] In a third aspect, some embodiments of the present disclosure provide an electronic device comprising: one or more processors; a storage device on which one or more programs are stored, and when the one or more programs are executed by the one or more processors, the one or more processors implement the method described in any implementation manner of the above-mentioned first aspect.

[0012] In a fourth aspect, some embodiments of the present disclosure provide a computer-readable medium having a computer program stored thereon, wherein when the program is executed by a processor, the method described in any implementation manner of the above-mentioned first aspect is implemented.

[0013] The above-mentioned embodiments of the present disclosure have the following beneficial effects: through the abnormal computing resource information alarm method of some embodiments of the present disclosure, an alarm can be issued in time. Specifically, the reason why it is difficult to issue an abnormal alarm in time and accurately is that the monitoring tool can usually only process specific types of information and cannot fully integrate different types of computing resource data, so it is difficult to issue an abnormal alarm in time and accurately when processing complex computing resource information. Based on this, the abnormal computing resource information alarm method of some embodiments of the present disclosure. First, obtain a computing resource information set and a computing resource call chain information set; obtain an initial computing resource call chain information set. In this way, comprehensive monitoring and abnormality detection of the computing resource state can be achieved, and the root cause of the computing resource abnormality can be deeply analyzed in combination with the computing resource call chain data, and the foundation can be laid for the subsequent analysis of the computing resource call chain, ensuring that the latest call chain data can be obtained during the abnormality detection process. Secondly, the above computing resource information set is subjected to data standardization processing to generate a computing resource standardized information set. In this way, data from different sources can be converted into a consistent format. Thirdly, the above computing resource call chain information set is subjected to data aggregation processing to generate a computing resource call chain aggregate information set. Thus, the call chain information can be summarized according to certain rules to identify important patterns and abnormal behaviors in the call chain. Then, the above-mentioned computing resource standardized information set is incrementally updated to generate a computing resource instance information set; the above-mentioned computing resource call chain aggregate information set is incrementally updated to generate a computing resource call chain instance information set. Thus, the state information of the computing resources and the call chain can be dynamically updated. Then, the above-mentioned computing resource instance information set and the above-mentioned computing resource call chain instance information set are input into the pre-trained instance relationship prediction model to obtain the computing resource instance relationship prediction information set. Thus, the potential relationship between computing resources and their abnormal patterns can be analyzed based on the results of model prediction. Then, the above-mentioned computing resource instance relationship prediction information set is data standardized to generate a computing resource instance relationship prediction standardized information set, and the above-mentioned computing resource instance relationship prediction standardized information set is stored in the resource management database. Thus, the consistency of information can be maintained and the prediction results can be stored in the database. Then, the above-mentioned computing resource instance relationship prediction standardized information set is abnormally identified to generate abnormal computing resource information identification results. Thus, the abnormal computing resource state or relationship can be identified, providing a reliable basis for anomaly detection. Finally, in response to determining that the above abnormal computing resource information identification result meets the preset abnormal alarm condition, the above computing resource instance relationship prediction standardized information set is sent to the associated alarm terminal for abnormal alarm processing. Thus, the abnormal computing resources found can be promptly warned. Therefore, by checking multiple types of detection data, dynamic updating, standardized processing and prediction model application, an alarm can be issued in a timely manner. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] The above and other features, advantages and aspects of the embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the accompanying drawings, the same or similar reference numerals represent the same or similar elements. It should be understood that the drawings are schematic and that components and elements are not necessarily drawn to scale.

[0015] Figure 1 is a flow chart of some embodiments of the abnormal computing resource information alarm method according to the present disclosure;

[0016] Figure 2 It is a structural schematic diagram of some embodiments of the abnormal computing resource information alarm device according to the present disclosure;

[0017] Figure 3 It is a schematic diagram of the structure of an electronic device suitable for implementing some embodiments of the present disclosure. DETAILED DESCRIPTION

[0018] Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be construed as being limited to the embodiments set forth herein. On the contrary, these embodiments are provided to provide a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are only for exemplary purposes and are not intended to limit the scope of protection of the present disclosure.

[0019] It should also be noted that, for ease of description, only the parts related to the invention are shown in the drawings. In the absence of conflict, the embodiments and features in the embodiments of the present disclosure can be combined with each other.

[0020] It should be noted that the concepts such as "first" and "second" mentioned in the present disclosure are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0021] It should be noted that the modifications of "one" and "plurality" mentioned in the present disclosure are illustrative rather than restrictive, and those skilled in the art should understand that unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0022] The names of the messages or information exchanged between multiple devices in the embodiments of the present disclosure are only used for illustrative purposes and are not used to limit the scope of these messages or information.

[0023] The present disclosure will be described in detail below with reference to the accompanying drawings and in conjunction with embodiments.

[0024] Figure 11 is a flowchart of some embodiments of the abnormal computing resource information alarm method according to the present disclosure. 100 of some embodiments of the abnormal computing resource information alarm method according to the present disclosure is shown. The abnormal computing resource information alarm method comprises the following steps:

[0025] Step 101, obtain a computing resource information set and a computing resource call chain information set.

[0026] In some embodiments, the execution subject (for example, a computing device) of the abnormal computing resource information alarm method can obtain a computing resource information set and a computing resource call chain information set by means of a wired connection or a wireless connection. Among them, the computing resource information in the computing resource information set can be characterized by but not limited to: computing resource information usage, computing resource information performance indicators. The computing resource call chain information can be characterized by but not limited to: performance data of computing resource call chain information, node information of computing resource call chain information. For example, the computing resource information usage can be: CPU utilization, memory usage. The computing resource information performance indicators can be: response time, throughput. The performance data of the computing resource call chain information can be: delay, error rate. The node information of the computing resource call chain information can be: database, cache.

[0027] It should be noted that the above-mentioned wireless connection methods may include but are not limited to 3G / 4G connection, WiFi connection, Bluetooth connection, WiMAX connection, Zigbee connection, UWB (ultra wideband) connection, and other wireless connection methods currently known or to be developed in the future.

[0028] Step 102, obtaining an initial computing resource call chain information set.

[0029] In some embodiments, the execution master may obtain the initial computing resource call chain information set by wired connection or wireless connection. The initial computing resource call chain information in the initial computing resource call chain information set may be: performance data of the current computing resource call chain information measured by open telemetry, and node information of the computing resource call chain information. For example, the performance data of the computing resource call chain information may include: response time, throughput. The node information of the computing resource call chain information may include: node type, node status.

[0030] It should be noted that the computing resource information set, the computing resource call chain information set and the initial computing resource call chain information set correspond to the same application system.

[0031] Step 103: perform data standardization processing on the computing resource information set to generate a computing resource standardized information set.

[0032] In some embodiments, the execution entity may perform data standardization processing on the computing resource information set to generate a computing resource standardized information set.

[0033] In practice, the execution subject may perform data standardization processing on the computing resource information set through the following steps to generate a computing resource standardized information set:

[0034] The first step is to normalize the computing resource information set to generate a computing resource normalized information set. In practice, the execution subject can normalize the meteorological indicator information for each computing resource information in the computing resource information set by using a preset normalization algorithm to generate computing resource normalized information and obtain a computing resource normalized information set. For example, the preset normalization algorithm can be: decimal calibration method.

[0035] The second step is to perform data cleaning processing on the above-mentioned computing resource normalization information set to generate a computing resource standardized information set. In practice, the above-mentioned execution subject can perform missing value processing on each computing resource normalization information in the above-mentioned computing resource normalization information set in response to determining that the computing resource normalization information meets the preset missing condition, and generate computing resource standardized information by using a preset missing value algorithm to obtain a computing resource standardized information set. Among them, the preset missing condition can be: the computing resource normalization information representation is empty. For example, the preset missing value algorithm can be: interpolation method.

[0036] Step 104: perform data aggregation processing on the above computing resource call chain information set to generate a computing resource call chain aggregation information set.

[0037] In some embodiments, the execution master may perform data aggregation processing on the computing resource call chain information set to generate a computing resource call chain aggregation information set.

[0038] In practice, the execution subject may perform data aggregation processing on the computing resource call chain information set through the following steps to generate a computing resource call chain aggregate information set:

[0039] The first step is to perform node instantiation processing on each computing resource call chain information in the above computing resource call chain information set to generate node instance information and obtain a node instance information set. In practice, the above execution subject can perform node instantiation processing on each computing resource call chain information in the above computing resource call chain information set by using a preset node instantiation algorithm to generate node instance information and obtain a node instance information set. For example, the preset node instantiation algorithm can be: depth-first search method.

[0040] The second step is to perform chain instantiation processing on the computing resource call chain information set to generate a chain instance information set. In practice, the execution subject can perform chain instantiation processing on each computing resource call chain information in the computing resource call chain information set by using a preset chain instance algorithm to generate computing resource call chain instance information and obtain a computing resource call chain instance information set. For example, the preset chain instance algorithm can be: hierarchical instantiation method.

[0041] The third step is to perform data aggregation processing on the above-mentioned node instance information set and the above-mentioned chain instance information set to generate a computing resource call chain aggregation information set. In practice, the above-mentioned execution subject performs a fusion process on each node instance information in the above-mentioned node instance information set, the node instance information and the chain instance information corresponding to the node instance information in the chain instance information set to generate computing resource call chain aggregation information and obtain the computing resource call chain aggregation information set.

[0042] Step 105: perform incremental update processing on the above computing resource standardized information set to generate a computing resource instance information set.

[0043] In some embodiments, the execution master may perform incremental update processing on the computing resource standardized information set to generate a computing resource instance information set.

[0044] In practice, the execution subject may perform incremental update processing on the computing resource standardized information set to generate a computing resource instance information set by following the steps below:

[0045] The first step is to obtain the initial computing resource information set for each time granularity within the preset time period. In practice, the above-mentioned execution entity can obtain the initial computing resource information set for each time granularity within the preset time period through a wired connection or a wireless connection. Among them, the initial computing resource information in the initial computing resource information set can be: the current computing resource information usage and computing resource information performance indicators monitored by the resource management platform. For example, the preset time period can be: the time period from one hour before the current moment to the current moment. The time granularity can be: 60 seconds.

[0046] The second step is to perform data format update processing on the above-mentioned computing resource standardized information set based on the above-mentioned initial computing resource information set to generate a computing resource instance information set, and store the above-mentioned computing resource instance information set in a resource management database. In practice, the above-mentioned execution entity can perform data format update processing on the above-mentioned computing resource standardized information set through a preset data format update algorithm to generate a computing resource instance information set, and store the above-mentioned computing resource instance information set in a resource management database. Among them, the resource management database can be: a database that stores computing resource instance information sets. For example, the preset data format update algorithm can be: an incremental update method. The resource management database can be: a relational database (Mysql).

[0047] Step 106: perform incremental update processing on the computing resource call chain aggregation information set to generate a computing resource call chain instance information set.

[0048] In some embodiments, the execution master may perform incremental update processing on the computing resource call chain aggregation information set to generate a computing resource call chain instance information set.

[0049] In practice, the execution subject may perform incremental update processing on the computing resource call chain aggregation information set through the following steps to generate a computing resource call chain instance information set:

[0050] The first step is to perform data aggregation processing on the above-mentioned initial computing resource call chain information set to generate a computing resource link information set. In practice, the specific implementation method of performing data aggregation processing on the above-mentioned initial computing resource call chain information set to generate a computing resource link information set and the technical effect brought about by it can refer to step 104 in the above embodiment and will not be repeated here.

[0051] The second step is to perform data aggregation update processing on the computing resource call chain aggregation information set based on the computing resource link information set to generate a computing resource call chain instance information set, and store the computing resource call chain instance information set in the resource management database. In practice, the execution subject can perform data aggregation update processing on the computing resource call chain aggregation information set through a preset data aggregation update algorithm to generate a computing resource call chain instance information set, and store the computing resource call chain instance information set in the resource management database. For example, the preset data aggregation update algorithm can be: incremental update method.

[0052] In practice, the execution subject may perform incremental update processing on the computing resource call chain aggregation information set to generate a computing resource call chain instance information set by following the steps below:

[0053] The first step is to graphically process the above-mentioned initial computing resource call chain information set to generate a computing resource call chain relationship graph. In practice, the above-mentioned execution subject can graphically process the above-mentioned initial computing resource call chain information set through a preset graphical algorithm to generate a computing resource call chain relationship graph. Among them, the computing resource call chain relationship graph can be: a graph with computing resource call chain information as nodes and computing resource call chain relationships as edges. For example, the preset graphical algorithm can be: the shortest path method.

[0054] The second step is to perform data aggregation and update processing on the above computing resource call chain aggregation information set based on the above computing resource call chain relationship graph to generate a computing resource call chain instance information set, and store the above computing resource call chain instance information set in the resource management database. In practice, the above execution subject can perform data aggregation and update processing on the above computing resource call chain aggregation information set through a preset graph analysis algorithm to generate a computing resource call chain instance information set, and store the above computing resource call chain instance information set in the resource management database. For example, the preset graph analysis algorithm can be: minimum spanning tree method.

[0055] Step 107: input the computing resource instance information set and the computing resource call chain instance information set into a pre-trained instance relationship prediction model to obtain a computing resource instance relationship prediction information set.

[0056] In some embodiments, the above-mentioned execution subject may input the above-mentioned computing resource instance information set and the above-mentioned computing resource call chain instance information set into a pre-trained instance relationship prediction model to obtain a computing resource instance relationship prediction information set. Among them, the instance relationship prediction model may be: a pre-trained neural network model with a computing resource instance information set and a computing resource call chain instance information set as input, and a computing resource instance relationship prediction information set as output. Among them, the computing resource instance relationship prediction information in the computing resource instance relationship prediction information set may represent but is not limited to: computing resource information usage pattern, computing resource information and the dependency relationship between the computing resource call chain. For example, the computing resource information usage pattern may include: access frequency, load conditions. The dependency relationship between computing resource information and the computing resource call chain may include: shared resource relationship, hierarchical relationship. The instance relationship prediction model may be: a graph neural network (GNN) model, a long short-term memory network (LSTM) model.

[0057] Optionally, before inputting the computing resource instance information set and the computing resource call chain instance information set into a pre-trained instance relationship prediction model, the computing resource instance relationship prediction information set is obtained by training through the following steps:

[0058] The first step is to obtain the initial training sample set.

[0059] In some embodiments, the execution subject may obtain the initial training sample set by wired connection or wireless connection. The initial training samples in the initial training sample set may include: an initial sample computing resource instance information set, an initial sample computing resource call chain instance information set, and an initial sample computing resource instance relationship prediction information set.

[0060] In the second step, for each initial training sample in the initial training sample set, the following feature extraction steps are performed:

[0061] The first sub-step is to preprocess the initial training samples to generate a sample preprocessing information set.

[0062] In some embodiments, the execution subject may perform feature extraction processing on the initial training samples by using a preset preprocessing algorithm to generate a sample preprocessing information set. For example, the preset preprocessing algorithm may be: maximum value normalization method.

[0063] The second sub-step is to perform feature selection processing on the sample preprocessing information set to generate a sample feature information set.

[0064] In some embodiments, the execution subject may perform feature selection processing on each sample preprocessing information in the sample preprocessing information set by using a preset feature selection algorithm to generate sample feature information and obtain a sample feature information set. For example, the preset feature selection algorithm may be: embedding method.

[0065] The third sub-step is to perform sample fusion processing on the sample feature information set and the initial training sample to generate a training sample.

[0066] In some embodiments, the execution subject performs sample fusion processing on the sample feature information and the initial training sample to generate a training sample. The training samples in the training sample set include: a sample computing resource instance information set, a sample computing resource call chain instance information set, and a sample computing resource instance relationship prediction information set.

[0067] The third step is to determine the generated training samples as a training sample set;

[0068] In some embodiments, the execution entity determines the generated training samples as a training sample set.

[0069] The fourth step is to determine the initial instance relationship prediction model, wherein the initial instance relationship prediction model includes: an initial instance relationship information model and an initial instance relationship inference model.

[0070] In some embodiments, the execution subject determines an initial instance relationship prediction model, wherein the initial instance relationship prediction model includes: an initial instance relationship information model and an initial instance relationship inference model.

[0071] The initial instance relationship information model may be a model that takes the sample computing resource instance information set and the sample computing resource call chain instance information set as input and takes the initial computing resource feature information set as output. For example, the initial instance relationship information model may be: a relationship model.

[0072] The initial instance relationship inference model can be a custom model that takes the initial sample computing resource feature information set as input and the computing resource instance relationship prediction information set as output. For example, the instance relationship inference model can be a probabilistic graph model. The custom model can include three layers:

[0073] The first layer, the input layer, is used to input the initial sample computing resource feature information set into the second layer.

[0074] The second layer, the processing layer, includes a first sub-model and a second sub-model. The first sub-model may be a model that takes the initial sample computing resource feature information set as input and the first prediction information sequence as output. The second sub-model may be a model that takes the first prediction information sequence as input and the initial computing resource instance relationship prediction information set as output. For example, the first sub-model may be: a support vector machine model. The second sub-model may be: a regression tree model. The first prediction information sequence may be: a feature embedding vector.

[0075] The third layer, the output layer, is used to: use the computing resource instance relationship prediction information set as the output of the entire initial instance relationship inference model.

[0076] The fifth step is to select target training samples from the training sample set.

[0077] In some embodiments, the execution subject may select a target training sample from the training sample set. In practice, the execution subject may randomly select a training sample from the training sample set as the target training sample.

[0078] In the sixth step, the sample computing resource instance information set and the sample computing resource call chain instance information set included in the selected target training sample are input into the initial instance relationship model to obtain the initial computing resource feature information set.

[0079] In some embodiments, the execution entity may input the sample computing resource instance information set and the sample computing resource call chain instance information set included in the selected target training sample into the initial instance relationship model to obtain an initial computing resource feature information set.

[0080] In the seventh step, the initial sample computing resource feature information set is input into the initial instance relationship inference model to obtain the initial computing resource instance relationship prediction information set.

[0081] In some embodiments, the execution entity may input the initial sample computing resource feature information set into the initial instance relationship inference model to obtain the initial computing resource instance relationship prediction information set.

[0082] In the eighth step, based on a preset loss function, a difference value between the initial computing resource instance relationship prediction information set and the sample computing resource instance relationship prediction information set included in the selected target training sample is determined.

[0083] In some embodiments, the execution subject may determine the difference between the initial computing resource instance relationship prediction information set and the sample computing resource instance relationship prediction information set included in the selected target training sample based on a preset loss function. The preset loss function may be, but is not limited to, mean square error loss function (MSE), hinge loss function (SVM), cross entropy loss function (CrossEntropy), 0-1 loss function, absolute value loss function, log loss function, square loss function, exponential loss function, etc.

[0084] In a ninth step, in response to determining that the difference value is greater than or equal to a preset difference value, adjusting network parameters of the initial instance relationship prediction model.

[0085] In some embodiments, in response to determining that the difference value is greater than or equal to the preset difference value, the execution subject may adjust the network parameters of the initial instance relationship prediction model. For example, the difference between the difference value and the preset difference value may be calculated. On this basis, the network parameters of the initial instance relationship prediction model are adjusted using methods such as back propagation and gradient descent. There is no limitation on the setting of the preset difference value, for example, the preset difference value may be 0.4.

[0086] Optionally, in response to determining that the difference value is less than a preset difference value, the initial instance relationship prediction model is determined as the trained instance relationship prediction model.

[0087] In some embodiments, in response to determining that the difference value is less than a preset difference value, the initial instance relationship prediction model is determined as the trained instance relationship prediction model.

[0088] The relevant content of step 107, as an inventive point of an embodiment of the present disclosure, solves the second technical problem mentioned in the background technology, "making it impossible to effectively issue an alarm for the abnormal computing resource identification results". Among them, the inability to effectively issue an alarm for the abnormal computing resource identification results is often as follows: when processing complex computing resource instance relationship prediction information, the monitoring tool lacks an effective aggregation and standardization mechanism, which makes it difficult to accurately identify abnormal computing resource results. If the above factors are solved, the effect of reducing the decrease in alarm processing efficiency can be achieved. In order to achieve this effect, based on this, the present disclosure uses an initial instance relationship prediction model. First, an initial training sample set is obtained; thereby, the model's ability to recognize different types of alarm information can be improved. Secondly, the above initial training sample set is preprocessed to generate a sample preprocessing information set; the above sample preprocessing information set is feature selected to generate a sample feature information set; the above sample feature information set and the above initial training sample are sample fusion processed to generate a training sample. Among them, the training samples in the training sample set include: sample computing resource instance information set, sample computing resource call chain instance information set, and sample computing resource instance relationship prediction information set; thereby, the model's ability to accurately identify and process alarm information can be improved. Secondly, determine the initial instance relationship prediction model. Among them, the initial instance relationship prediction model includes: initial instance relationship information model and initial instance relationship inference model; thereby, the model's prediction accuracy for computing resource relationships can be improved. Then, select the target training sample from the training sample set; thereby, the representativeness and effectiveness of the model training can be ensured. Then, the sample computing resource instance information set and the sample computing resource call chain instance information set included in the selected target training sample are input into the initial instance relationship model to obtain the initial computing resource feature information set; the initial sample computing resource feature information set is input into the initial instance relationship inference model to obtain the initial computing resource instance relationship prediction information set; thereby, high-quality computing resource relationship prediction information can be generated. Then, based on a preset loss function, the difference value between the initial computing resource instance relationship prediction information set and the sample computing resource instance relationship prediction information set included in the selected target training sample is determined; thereby, the performance of the prediction model can be evaluated and the model optimization can be guided. Finally, in response to determining that the difference value is greater than or equal to the preset difference value, the network parameters of the initial instance relationship prediction model are adjusted. In this way, the prediction accuracy of the model can be improved, thereby improving the efficiency of alarm processing.

[0089] Step 108, performing data standardization processing on the computing resource instance relationship prediction information set to generate a computing resource instance relationship prediction standardized information set, and storing the computing resource instance relationship prediction standardized information set in a resource management database.

[0090] In some embodiments, the execution entity may perform data standardization processing on the computing resource instance relationship prediction information set to generate a computing resource instance relationship prediction standardized information set, and store the computing resource instance relationship prediction standardized information set in a resource management database.

[0091] In practice, the execution subject may perform data standardization processing on each computing resource instance relationship prediction information in the computing resource instance relationship prediction information set by using a preset standardization algorithm to generate computing resource instance relationship prediction standardized information, obtain a computing resource instance relationship prediction standardized information set, and store the computing resource instance relationship prediction standardized information set in a resource management database. For example, the preset standardization algorithm may be: minimum-maximum standardization method.

[0092] Step 109: perform abnormality identification processing on the above computing resource instance relationship prediction standardized information set to generate abnormal computing resource information identification results.

[0093] In some embodiments, the execution entity may perform anomaly identification processing on the computing resource instance relationship prediction standardized information set to generate an abnormal computing resource information identification result.

[0094] In practice, the above-mentioned execution subject can perform anomaly identification processing on the above-mentioned computing resource instance relationship prediction standardized information set through a preset anomaly identification algorithm to generate an abnormal computing resource information identification result. Among them, the abnormal computing resource information identification result can be characterized by: abnormal computing resource information performance indicator, abnormal computing resource information performance indicator. For example, the preset anomaly identification algorithm can be: outlier detection method. For example, the computing resource information performance indicator abnormality can be: CPU utilization exceeds 80%.

[0095] Step 110, in response to determining that the abnormal computing resource information identification result meets the preset abnormal alarm condition, the computing resource instance relationship prediction standardized information set is sent to the associated alarm terminal for abnormal alarm processing.

[0096] In some embodiments, in response to determining that the abnormal computing resource information identification result satisfies the preset abnormal alarm condition, the above-mentioned execution subject may send the above-mentioned computing resource instance relationship prediction standardized information set to the associated alarm terminal for abnormal alarm processing. Among them, the preset abnormal alarm condition may be: the abnormal computing resource information identification result represents an abnormality. The associated alarm terminal may be: an alarm terminal that is communicatively connected to the above-mentioned execution subject. The above-mentioned abnormal alarm processing may be to display warning text or control a speaker to emit a prompt sound.

[0097] Further references Figure 2As an implementation of the methods shown in the above figures, the present disclosure provides some embodiments of an abnormal computing resource information alarm device. These abnormal computing resource information alarm device embodiments are similar to Figure 1 Corresponding to the method embodiments shown, the abnormal computing resource information alarm device can be specifically applied to various electronic devices.

[0098] like Figure 2 As shown, the abnormal computing resource information alarm device 200 of some embodiments includes: a first acquisition unit 201, a second acquisition unit 202, a standardization unit 203, an aggregation unit 204, a first update unit 205, a second update unit 206, an input unit 207, a storage unit 208, an identification unit 209 and a sending unit 210. Among them, the first acquisition unit 201 is configured to acquire a computing resource information set and a computing resource call chain information set; the second acquisition unit 202 is configured to acquire an initial computing resource call chain information set; the standardization unit 203 is configured to perform data standardization processing on the computing resource information set to generate a computing resource standardized information set; the aggregation unit 204 is configured to perform data aggregation processing on the computing resource call chain information set to generate a computing resource call chain aggregate information set; the first update unit 205 is configured to perform incremental update processing on the computing resource standardized information set to generate a computing resource instance information set; the second update unit 206 is configured to perform incremental update processing on the computing resource call chain aggregate information set to generate a computing resource call chain instance information set; the input unit 207 is configured to update the computing resource call chain aggregate information set. The resource instance information set and the computing resource call chain instance information set are input into a pre-trained instance relationship prediction model to obtain a computing resource instance relationship prediction information set; the storage unit 208 is configured to perform data standardization processing on the computing resource instance relationship prediction information set to generate a computing resource instance relationship prediction standardized information set, and store the computing resource instance relationship prediction standardized information set in a resource management database; the identification unit 209 is configured to perform anomaly identification processing on the computing resource instance relationship prediction standardized information set to generate an abnormal computing resource information identification result; the sending unit 210 is configured to send the computing resource instance relationship prediction standardized information set to an associated alarm terminal for abnormal alarm processing in response to determining that the abnormal computing resource information identification result meets a preset abnormal alarm condition.

[0099] It can be understood that the various units recorded in the abnormal computing resource information alarm device 200 and the reference Figure 1 Therefore, the operations, features and beneficial effects described above for the method are also applicable to the abnormal computing resource information alarm device 200 and the units included therein, and will not be described in detail here.

[0100] Reference below Figure 3 , which shows a schematic diagram of the structure of an electronic device 300 (e.g., a computing device) suitable for implementing some embodiments of the present disclosure. The electronic devices in some embodiments of the present disclosure may include, but are not limited to, mobile terminals such as mobile phones, notebook computers, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 3 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0101] like Figure 3 As shown, the electronic device 300 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 301, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 302 or a program loaded from a storage device 308 into a random access memory (RAM) 303. In the RAM 303, various programs and data required for the operation of the electronic device 300 are also stored. The processing device 301, the ROM 302, and the RAM 303 are connected to each other via a bus 304. An input / output (I / O) interface 305 is also connected to the bus 304.

[0102] Typically, the following devices may be connected to the I / O interface 305: input devices 306 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; output devices 307 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; storage devices 308 including, for example, a magnetic tape, a hard disk, etc.; and communication devices 309. The communication devices 309 may allow the electronic device 300 to communicate with other devices wirelessly or by wire to exchange data. Although Figure 3 The electronic device 300 is shown with various devices, but it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed instead. Figure 3 Each block shown in the figure may represent one device, or may represent multiple devices as required.

[0103] In particular, according to some embodiments of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, some embodiments of the present disclosure include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In some such embodiments, the computer program can be downloaded and installed from the network through the communication device 309, or installed from the storage device 308, or installed from the ROM 302. When the computer program is executed by the processing device 301, the above-mentioned functions defined in the method of some embodiments of the present disclosure are executed.

[0104] It should be noted that the computer-readable medium recorded in some embodiments of the present disclosure may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In some embodiments of the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In some embodiments of the present disclosure, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. The computer readable signal medium may also be any computer readable medium other than a computer readable storage medium, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer readable medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (radio frequency), etc., or any suitable combination of the above.

[0105] In some embodiments, the client and the server may communicate using any currently known or future developed network protocol such as HTTP (HyperText Transfer Protocol), and may be interconnected with any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), an internet (e.g., the Internet), and a peer-to-peer network (e.g., an ad hoc peer-to-peer network), as well as any currently known or future developed network.

[0106] The above-mentioned computer-readable medium may be included in the above-mentioned electronic device; or it may exist independently without being assembled into the electronic device. The above-mentioned computer-readable medium carries one or more programs. When the above-mentioned one or more programs are executed by the electronic device, the electronic device: obtains a computing resource information set and a computing resource call chain information set; obtains an initial computing resource call chain information set; performs data standardization processing on the above-mentioned computing resource information set to generate a computing resource standardized information set; performs data aggregation processing on the above-mentioned computing resource call chain information set to generate a computing resource call chain aggregate information set; performs incremental update processing on the above-mentioned computing resource standardized information set to generate a computing resource instance information set; performs incremental update processing on the above-mentioned computing resource call chain aggregate information set to generate a computing resource call chain instance information set; and performs data aggregation processing on the above-mentioned computing resource call chain information set to generate a computing resource call chain aggregate information set. The information set and the computing resource call chain instance information set are input into a pre-trained instance relationship prediction model to obtain a computing resource instance relationship prediction information set; the computing resource instance relationship prediction information set is subjected to data standardization processing to generate a computing resource instance relationship prediction standardized information set, and the computing resource instance relationship prediction standardized information set is stored in a resource management database; the computing resource instance relationship prediction standardized information set is subjected to anomaly identification processing to generate an abnormal computing resource information identification result; in response to determining that the abnormal computing resource information identification result meets a preset abnormal alarm condition, the computing resource instance relationship prediction standardized information set is sent to an associated alarm terminal for abnormal alarm processing.

[0107] Computer program code for performing the operations of some embodiments of the present disclosure may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0108] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0109] The units described in some embodiments of the present disclosure may be implemented by software or by hardware. The described units may also be set in a processor, for example, may be described as: a processor comprising: a first acquisition unit, a second acquisition unit, a standardization unit, an aggregation unit, a first update unit, a second update unit, an input unit, a storage unit, an identification unit and a sending unit. Among them, the names of these units do not constitute a limitation on the unit itself under certain circumstances. For example, the sending unit may also be described as "a unit that sends the above-mentioned computing resource instance relationship prediction standardized information set to the associated alarm terminal for abnormal alarm processing in response to determining that the above-mentioned abnormal computing resource information identification result meets the preset abnormal alarm condition."

[0110] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and the like.

[0111] The above descriptions are only some preferred embodiments of the present disclosure and an explanation of the technical principles used. Those skilled in the art should understand that the scope of the invention involved in the embodiments of the present disclosure is not limited to the technical solutions formed by a specific combination of the above-mentioned technical features, but should also cover other technical solutions formed by any combination of the above-mentioned technical features or their equivalent features without departing from the above-mentioned inventive concept. For example, the above-mentioned features are replaced with the technical features with similar functions disclosed in the embodiments of the present disclosure (but not limited to) and the technical solutions formed.

Claims

1. A method for warning abnormal computing resource information, comprising: Obtain computing resource information set and computing resource call chain information set; Obtaining an initial computing resource call chain information set; Performing data standardization processing on the computing resource information set to generate a computing resource standardized information set; Performing data aggregation processing on the computing resource call chain information set to generate a computing resource call chain aggregation information set; Performing incremental update processing on the computing resource standardized information set to generate a computing resource instance information set; Performing incremental update processing on the computing resource call chain aggregation information set to generate a computing resource call chain instance information set; Inputting the computing resource instance information set and the computing resource call chain instance information set into a pre-trained instance relationship prediction model to obtain a computing resource instance relationship prediction information set; Performing data standardization processing on the computing resource instance relationship prediction information set to generate a computing resource instance relationship prediction standardized information set, and storing the computing resource instance relationship prediction standardized information set in a resource management database; Performing anomaly identification processing on the computing resource instance relationship prediction standardized information set to generate an abnormal computing resource information identification result; In response to determining that the abnormal computing resource information identification result meets the preset abnormal alarm condition, the computing resource instance relationship prediction standardized information set is sent to an associated alarm terminal for abnormal alarm processing.

2. The method according to claim 1, wherein: The performing data standardization processing on the computing resource information set to generate a computing resource standardized information set includes: Normalizing the computing resource information set to generate a computing resource normalized information set; The computing resource normalization information set is subjected to data cleaning processing to generate a computing resource standardization information set.

3. The method according to claim 1, wherein: The performing data aggregation processing on the computing resource call chain information set to generate a computing resource call chain aggregation information set includes: Performing node instantiation processing on each computing resource call chain information in the computing resource call chain information set to generate node instance information and obtain a node instance information set; Performing chain instantiation processing on the computing resource call chain information set to generate a chain instance information set; Data aggregation processing is performed on the node instance information set and the chain instance information set to generate a computing resource call chain aggregation information set.

4. The method according to claim 1, wherein: The incremental updating process of the computing resource standardized information set to generate a computing resource instance information set includes: Obtaining an initial computing resource information set for each time granularity within a preset time period; Based on the initial computing resource information set, the computing resource standardized information set is updated in data format to generate a computing resource instance information set, and the computing resource instance information set is stored in a resource management database.

5. The method according to claim 1, wherein: The incremental updating process of the computing resource call chain aggregation information set to generate a computing resource call chain instance information set includes: Performing data aggregation processing on the initial computing resource call chain information set to generate a computing resource link information set; Based on the computing resource link information set, data aggregation and update processing is performed on the computing resource call chain aggregation information set to generate a computing resource call chain instance information set, and the computing resource call chain instance information set is stored in a resource management database.

6. The method according to claim 1, wherein: The incremental updating process of the computing resource call chain aggregation information set to generate a computing resource call chain instance information set includes: Graphically processing the initial computing resource call chain information set to generate a computing resource call chain relationship graph; Based on the computing resource call chain relationship diagram, data aggregation and update processing is performed on the computing resource call chain aggregation information set to generate a computing resource call chain instance information set, and the computing resource call chain instance information set is stored in a resource management database.

7. An abnormal computing resource information alarm device, comprising: A first acquisition unit is configured to acquire a computing resource information set and a computing resource call chain information set; A second acquisition unit is configured to acquire an initial computing resource call chain information set; A standardization unit, configured to perform data standardization processing on the computing resource information set to generate a computing resource standardized information set; an aggregation unit, configured to perform data aggregation processing on the computing resource call chain information set to generate a computing resource call chain aggregation information set; A first updating unit is configured to perform incremental update processing on the computing resource standardized information set to generate a computing resource instance information set; A second updating unit is configured to perform incremental update processing on the computing resource call chain aggregation information set to generate a computing resource call chain instance information set; An input unit, configured to input the computing resource instance information set and the computing resource call chain instance information set into a pre-trained instance relationship prediction model to obtain a computing resource instance relationship prediction information set; a storage unit configured to perform data standardization processing on the computing resource instance relationship prediction information set to generate a computing resource instance relationship prediction standardized information set, and store the computing resource instance relationship prediction standardized information set in a resource management database; an identification unit configured to perform an abnormality identification process on the computing resource instance relationship prediction standardized information set to generate an abnormal computing resource information identification result; The sending unit is configured to send the computing resource instance relationship prediction standardized information set to an associated alarm terminal for abnormal alarm processing in response to determining that the abnormal computing resource information identification result meets a preset abnormal alarm condition.

8. An electronic device comprising: one or more processors; a storage device having one or more programs stored thereon; When the one or more programs are executed by the one or more processors, the one or more processors implement the method according to any one of claims 1 to 6.

9. A computer readable medium having a computer program stored thereon, wherein: When the program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

Images