Similar event query method, device and equipment and computer readable storage medium

Abstract

The invention discloses a similar event query method, device and equipment and a computer readable storage medium. The method comprises the following steps: acquiring a first event, and acquiring a historical feature sequence of each historical event in a plurality of historical events from a historical event library; under the condition that the first event is an index time sequence curve, key feature information in the index time sequence curve is extracted through a target auto-encoder, a first feature sequence is obtained, and the feature length of the first feature sequence is smaller than the preset length; determining a first similarity between the first feature sequence and each historical feature sequence by using a target twin neural network model to obtain a plurality of first similarities; and screening out the historical events with the first similarity greater than a first preset threshold value from the plurality of historical events to obtain similar events of the first event. According to the similar event query method provided by the embodiment of the invention, the accuracy of searching the similar events can be ensured, and the speed of searching the similar events is also improved.

Description

Technical Field

[0001] The present application belongs to the field of data processing technology, and in particular, relates to a similar event query method, device, equipment and computer-readable storage medium. Background Art

[0002] At present, in the process of monitoring the monitoring indicators, if an alarm occurs due to an abnormal monitoring indicator, the operation and maintenance personnel are often required to first obtain the first event corresponding to the monitoring indicator (such as the indicator time series curve, the alarm log), and then search for similar events of the first event in the historical events according to the occurrence cycle of the monitoring indicator, and then study and analyze the first event based on the similar events to determine whether the alarm is a real alarm and to handle the real alarm.

[0003] However, manual search for similar events is slow. Especially when the monitoring indicators do not meet the periodic law, manual search is not only time-consuming, but also usually cannot find the adapted similar events, resulting in a long processing time for the alarm and possible misjudgment. Therefore, manual search for similar events is not only slow, but also cannot guarantee the accuracy of similar events. Summary of the invention

[0004] The embodiments of the present application provide a similar event query method, apparatus, device, computer-readable storage medium, and computer program product, which can both ensure the accuracy of searching for similar events and improve the speed of searching for similar events.

[0005] In a first aspect, an embodiment of the present application provides a similar event query method, the method comprising:

[0006] Obtaining a first event, and obtaining a historical feature sequence of each historical event in a plurality of historical events from a historical event library;

[0007] In the case where the first event is an indicator time series curve, using a target autoencoder to extract key feature information in the indicator time series curve to obtain a first feature sequence, wherein a feature length of the first feature sequence is less than a preset length;

[0008] Using the target twin neural network model, respectively determine the first similarity between the first feature sequence and each of the historical feature sequences to obtain a plurality of first similarities;

[0009] From the multiple historical events, historical events whose first similarity is greater than a first preset threshold are screened out to obtain similar events to the first event.

[0010] In a second aspect, an embodiment of the present application provides a similar event query device, the device comprising:

[0011] A first acquisition module, used to acquire a first event, and to acquire a historical feature sequence of each of a plurality of historical events from a historical event library;

[0012] A first extraction module is used to extract key feature information from the indicator time series curve using a target autoencoder to obtain a first feature sequence when the first event is an indicator time series curve, wherein the feature length of the first feature sequence is less than a preset length;

[0013] A first determination module, used to determine the first similarity between the first feature sequence and each of the historical feature sequences respectively by using the target twin neural network model, to obtain multiple first similarities;

[0014] The first screening module is used to screen out historical events whose first similarity is greater than a first preset threshold from the multiple historical events, so as to obtain similar events of the first event.

[0015] In a third aspect, an embodiment of the present application provides an electronic device, the device comprising: a processor and a memory storing computer program instructions;

[0016] When the processor executes the computer program instructions, the processor implements any possible implementation method of the first aspect described above.

[0017] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium having computer program instructions stored thereon, which, when executed by a processor, implements a method in any possible implementation method of the first aspect described above.

[0018] In a fifth aspect, an embodiment of the present application provides a computer program product. When instructions in the computer program product are executed by a processor of an electronic device, the electronic device executes a method as any possible implementation method in the first aspect above.

[0019] The similar event query method, device, equipment, computer-readable storage medium and computer program product of the embodiment of the present application, by using the target autoencoder to extract the key feature information in the indicator time series curve when the first event is an indicator time series curve, can remove the redundant information in the curve, obtain the first feature sequence with higher information density, and ensure the validity of the information in the first feature sequence. Since the information density of the first feature sequence is higher than that of the indicator time series curve, by determining similar events according to the similarity between the first feature sequence and each historical feature sequence, the accuracy of finding similar events can be guaranteed. In addition, since the feature length of the first feature sequence is less than the preset length, by determining similar events according to the similarity between the first feature sequence and each historical feature sequence, the speed of finding similar events can also be improved. In addition, by using the target twin neural network model to respectively determine the first similarity between the first feature sequence and each historical feature sequence, the accuracy of the first similarity can be guaranteed, and then the accuracy of finding similar events can be guaranteed. In this way, through the embodiment of the present application, the accuracy of finding similar events can be guaranteed and the speed of finding similar events can be improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the technical solution of the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0021] Figure 1 It is a flowchart of a similar event query method provided in an embodiment of the present application;

[0022] Figure 2 is a schematic diagram of retrieving a similarity curve provided in an embodiment of the present application;

[0023] Figure 3 It is a flowchart of another similar event query method provided in an embodiment of the present application;

[0024] Figure 4 is a structural diagram of a similar event query device provided in an embodiment of the present application;

[0025] Figure 5 It is a structural schematic diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0026] The features and exemplary embodiments of various aspects of the present application will be described in detail below. In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only intended to explain the present application, rather than to limit the present application. For those skilled in the art, the present application can be implemented without the need for some of these specific details. The following description of the embodiments is only to provide a better understanding of the present application by illustrating the examples of the present application.

[0027] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the statement "include..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0028] As described in the background technology section, currently, in the process of monitoring monitoring indicators, if an alarm occurs due to an abnormal monitoring indicator, the operation and maintenance personnel are often required to first obtain the first event corresponding to the monitoring indicator (such as the indicator time series curve, the alarm log), and then search for similar events of the first event in historical events according to the occurrence cycle of the monitoring indicator, and then study and analyze the first event based on similar events to determine whether the alarm is a real alarm and to handle the real alarm.

[0029] However, manual search for similar events is slow. Especially when the monitoring indicators do not meet the periodic law, manual search is not only time-consuming, but also usually cannot find the adapted similar events, resulting in a long processing time for the alarm and possible misjudgment. Therefore, manual search for similar events is not only slow, but also cannot guarantee the accuracy of similar events.

[0030] For the indicator time series curve, in addition to the manual search for similar curves, the dynamic time warping (DTW) algorithm can be used to directly compare the similarity between two curves. However, since the curve itself has a lot of redundant information and contains a lot of noise, and the DTW algorithm has poor noise resistance, the accuracy of the similar curves found is low. In addition, the DTW algorithm itself has a high time complexity and the speed of finding similar curves is also slow.

[0031] In addition, in order to determine the similarity between two curves, a large amount of curve data needs to be stored in the database, resulting in a large storage pressure on the database.

[0032] For logs, in addition to manually searching for similar logs based on keywords, traditional word frequency analysis methods can also be used for log retrieval. However, traditional word frequency methods rely on word segmentation effects, and perform worse than deep learning methods in capturing long-distance dependencies and context-sensitive word representations. It is difficult to achieve good performance when the log data is large in scale and the fault types are diverse.

[0033] Thus, in order to solve the problems of the prior art, the embodiments of the present application provide a similar event query method, device, equipment, computer-readable storage medium and computer program product. Among them, the similar event query method can be applied to similar event retrieval scenarios in target fields. Among them, the target fields may include financial fields, Internet fields, power fields, medical fields and other fields involving the retrieval of indicator time series curves and logs.

[0034] The following first introduces the similar event query method provided in the embodiment of the present application.

[0035] Figure 1 FIG. 1 is a flow chart of a similar event query method provided by an embodiment of the present application. The similar event query method can be executed by a processor or a server. Figure 1 As shown, the similar event query method provided in the embodiment of the present application includes the following steps:

[0036] S110, obtaining a first event, and obtaining a historical feature sequence of each historical event in a plurality of historical events from a historical event library;

[0037] S120, when the first event is an indicator time series curve, using the target autoencoder to extract key feature information in the indicator time series curve to obtain a first feature sequence, wherein the feature length of the first feature sequence is less than a preset length;

[0038] S130, using the target twin neural network model to respectively determine the first similarity between the first feature sequence and each historical feature sequence, to obtain multiple first similarities;

[0039] S140: Filter out historical events whose first similarity is greater than a first preset threshold from multiple historical events to obtain similar events to the first event.

[0040] The similar event query method of the embodiment of the present application can remove redundant information in the curve by using the target autoencoder to extract key feature information in the indicator time series curve when the first event is an indicator time series curve, and obtain a first feature sequence with higher information density, thereby ensuring the validity of the information in the first feature sequence. Since the information density of the first feature sequence is higher than that of the indicator time series curve, the accuracy of finding similar events can be guaranteed by determining similar events based on the similarity between the first feature sequence and each historical feature sequence. In addition, since the feature length of the first feature sequence is less than the preset length, the speed of finding similar events can be improved by determining similar events based on the similarity between the first feature sequence and each historical feature sequence. In addition, by using the target twin neural network model to respectively determine the first similarity between the first feature sequence and each historical feature sequence, the accuracy of the first similarity can be guaranteed, and then the accuracy of finding similar events can be guaranteed. In this way, through the embodiment of the present application, the accuracy of finding similar events can be guaranteed and the speed of finding similar events can be improved.

[0041] The specific implementation methods of the above steps are introduced below.

[0042] In some embodiments, in S110, the first event can be used to perform fault analysis on the monitoring indicators so that the operation and maintenance personnel can perform alarm processing. Among them, the monitoring indicators may include transaction indicators, electricity consumption behavior indicators, medical case information, etc. Transaction indicators may be, for example, transaction volume, transaction amount, transaction success rate, etc. In addition, the first event may include an indicator time series curve and a log. Among them, the indicator time series curve may be a time series curve corresponding to the monitoring indicator. The indicator time series curve may be expressed, for example, as X(t) = {x1, x2, x3…x t}.x i It can be expressed as i The indicator value corresponding to the time, i can take a value from 1 to t. In addition, the log can be an alarm log.

[0043] As an example, in the process of monitoring the monitoring indicators, when alarm information is generated, the indicator time series curve and log corresponding to the alarm information can be obtained.

[0044] In addition, the historical event may be an event generated during the monitoring of the monitoring indicator. The historical event may include a historical indicator time series curve and a historical log. In the case where the first event is an indicator time series curve, the historical event may be a historical indicator time series curve. In the case where the first event is a log, the historical event may be a historical log.

[0045] The historical feature sequence may be a feature sequence obtained by extracting key feature information from historical events. The historical feature sequence does not include redundant information in historical events, and the information density of the historical feature sequence may be higher than that of historical events. In addition, since the feature length of the historical feature sequence may be less than a preset length, the memory occupied by the historical feature sequence may be less than the memory occupied by historical events.

[0046] Therefore, in order to reduce the storage pressure of the database and lower the storage cost, historical feature sequences corresponding to multiple historical events can be stored in the historical event library instead of multiple historical events.

[0047] Based on this, in order to reduce the storage pressure of the database and lower the storage cost, in some embodiments, before the above S110, the following may also be included:

[0048] Get multiple historical events;

[0049] The target autoencoder is used to extract key feature information from multiple historical events respectively, and the historical feature sequences corresponding to the multiple historical events are obtained;

[0050] The historical feature sequences corresponding to multiple historical events are stored in the historical event library.

[0051] Here, the historical event may be a historical indicator time series curve. The target autoencoder may be an autoencoder trained using an indicator time series curve sample. The target autoencoder (Autoencode, AE) may be a neural network model including an encoder and a decoder structure. Among them, the encoder may extract key feature information from a plurality of historical indicator time series curves respectively, and obtain a first historical feature sequence corresponding to each of the plurality of historical indicator time series curves. The first historical feature sequence may not include redundant information in the historical event, and its feature length may be less than a preset length.

[0052] In this way, by storing the first historical feature sequences corresponding to the multiple historical indicator time series curves respectively, rather than the multiple historical indicator time series curves, in the historical event library, the storage pressure of the database can be reduced and the storage cost can be reduced.

[0053] Based on this, in order to ensure the accuracy of feature extraction, in some embodiments, before the above S110, the following steps may also be included:

[0054] Get the first indicator time series curve sample;

[0055] Input the first indicator time series curve sample into the initial autoencoder, and use the encoder in the initial autoencoder to extract key feature information in the first indicator time series curve sample to obtain a predicted feature sequence;

[0056] The decoder in the initial autoencoder is used to decode the predicted feature sequence to obtain the predicted indicator time series curve;

[0057] Determine the similarity between the first indicator time series curve sample and the predicted indicator time series curve according to the mean square error loss function, and obtain the first loss function value;

[0058] The model parameters of the initial autoencoder are adjusted according to the first loss function value, and the target autoencoder is obtained by training.

[0059] Here, the first indicator time series curve sample can be selected from multiple historical indicator time series curves. The first indicator time series curve sample can include 210,000 historical indicator sequence curves in the past year. Each historical indicator sequence curve can include monitoring indicator data corresponding to 4320 time points. Among them, 200,000 historical indicator sequence curves can be used as a training set, and the remaining 10,000 historical indicator sequence curves can be used as a validation set.

[0060] The initial autoencoder may be an autoencoder trained using the first indicator time series curve sample. The initial autoencoder may include an encoder and a decoder. The encoder may extract key feature information from the first indicator time series curve sample to obtain a predicted feature sequence. The decoder may decode the predicted feature sequence to obtain a predicted indicator time series curve.

[0061] In addition, the mean square error loss function can be used as the loss function of the training set and the validation set at the same time. The model parameters can include a first model parameter adjusted based on the training set and a hyperparameter adjusted based on the validation set.

[0062] As an example, the method of training the autoencoder in the embodiment of the present application can be unsupervised training. The process of performing unsupervised training on the initial autoencoder using the first indicator time series curve sample to obtain the target autoencoder can be as follows:

[0063] The first step is to determine the hyperparameters of the initial autoencoder as A1;

[0064] The second step is to input the first indicator time series curve sample in the training set into the initial autoencoder, and use the encoder in the initial autoencoder to extract the key feature information in the first indicator time series curve sample to obtain the predicted feature sequence; use the decoder in the initial autoencoder to decode the predicted feature sequence to obtain the predicted indicator time series curve; determine the similarity between the first indicator time series curve sample and the predicted indicator time series curve according to the mean square error loss function, and obtain the first loss function value B1;

[0065] Step 3: If B1 is greater than a preset threshold C1 (e.g., 0.02), adjust the first model parameter of the initial autoencoder, and return to execute the above steps 2 to 3 until B1 is less than or equal to C1;

[0066] In the fourth step, the first indicator time series curve sample in the validation set is input into the initial autoencoder, and the encoder in the initial autoencoder is used to extract the key feature information in the first indicator time series curve sample to obtain the predicted feature sequence; the decoder in the initial autoencoder is used to decode the predicted feature sequence to obtain the predicted indicator time series curve; the similarity between the first indicator time series curve sample and the predicted indicator time series curve is determined according to the mean square error loss function to obtain the first loss function value B2; if B2 is greater than the preset threshold C2 (for example, 0.02), return to the first step to adjust the hyperparameters of the initial autoencoder until B2 is less than or equal to C2 to obtain the trained target autoencoder.

[0067] In this way, by using the first indicator time series sample to train the initial autoencoder to obtain the target autoencoder, the accuracy of feature extraction by the target autoencoder can be guaranteed. In addition, by using unsupervised learning to train the autoencoder, the cost of manual labeling can be reduced.

[0068] In some embodiments, in S120, the target autoencoder may be the above-mentioned trained autoencoder. By using the target autoencoder to extract key feature information in the indicator time series curve, redundant information in the curve can be removed to obtain a first feature sequence with higher information density, thereby ensuring the validity of the information in the first feature sequence. In addition, since the first feature sequence is obtained by extracting features from the indicator time series curve, the first feature sequence can represent the indicator time series curve, that is, a similar curve of the indicator time series curve can be determined based on the first feature sequence.

[0069] In addition, the preset length may be a preset characteristic length. By removing redundant information in the curve, a first characteristic sequence shorter than the preset length can often be obtained.

[0070] Based on this, in order to further improve the accuracy of feature extraction, in some embodiments, the above S120 may specifically include:

[0071] Perform bilateral filtering on the indicator time series curve to obtain the target indicator time series curve;

[0072] The target autoencoder is used to extract the key feature information in the target indicator time series curve to obtain the first feature sequence.

[0073] Here, bilateral filtering is a nonlinear filtering method, which is a compromise between the spatial proximity and pixel value similarity of the image, while considering the spatial information and grayscale similarity to achieve the purpose of edge-preserving denoising.

[0074] By first removing part of the noise in the indicator time series curve based on bilateral filtering to obtain the target indicator time series curve, and then extracting the key feature information in the target indicator time series curve, the accuracy of feature extraction can be further improved.

[0075] In some embodiments, in S130, a Siamese neural network (SNN) is a neural network model with the same parameters and two inputs. The Siamese neural network can be used for similarity assessment. The target Siamese neural network model can be a Siamese neural network model trained using the indicator time series curve sample pair. The process of determining the first similarity between the first feature sequence and each historical feature sequence respectively using the target Siamese neural network model can refer to the existing method and will not be described in detail here.

[0076] Based on this, in order to ensure the accuracy of the first similarity, in some embodiments, before the above S130, the following steps may also be included:

[0077] Obtaining an indicator time series curve sample pair and its corresponding sample label, the indicator time series curve sample pair including two second indicator time series curve samples, and the sample label representing the similarity between the two second indicator time series curve samples;

[0078] The initial twin neural network model is used to predict the similarity of the two second indicator time series curve samples in the indicator time series curve sample pair to obtain the predicted label;

[0079] Determine the similarity between the sample label and the predicted label according to the triple loss function, and obtain a second loss function value;

[0080] The model parameters of the initial twin neural network model are adjusted according to the value of the second loss function, and the target twin neural network model is obtained through training.

[0081] Here, the second indicator time series curve sample can be selected from multiple historical indicator time series curves. The sample label can be obtained by manually marking the similarity between the two second indicator time series curve samples. Among them, the greater the similarity between the two second indicator time series curve samples, the greater the value corresponding to the sample label; if the similarity between the two second indicator time series curve samples is smaller, the smaller the value corresponding to the sample label can be. The initial twin neural network model is used to predict the similarity of the two second indicator time series curve samples in the indicator time series curve sample pair. The method of obtaining the predicted label can refer to the existing method and will not be described in detail here.

[0082] As an example, if the second loss function value between the sample label and the predicted label determined by the triple loss function is greater than the preset threshold C3 (such as 20), you can return to adjust the model parameters of the twin neural network model, and repeat the above steps of calculating the second loss function value until the second loss function value is less than or equal to the preset threshold C3, so as to obtain a trained target twin neural network model.

[0083] In addition, the indicator time series curve sample pair may also include a training set and a validation set at the same time. The steps of training the twin neural network model based on the training set and the validation set can refer to the steps of training the autoencoder based on the training set and the validation set, which will not be described in detail here.

[0084] In this way, by using the indicator time series curve samples to train the initial twin neural network model and obtain the target twin neural network model, the accuracy of the similarity evaluation of the target twin neural network model can be guaranteed, and the accuracy of the first similarity can be guaranteed.

[0085] In some embodiments, in S140, the first preset threshold may be a preset similarity threshold, and the first preset threshold may be, for example, 0.8. In the case where the first event is an indicator time series curve, the similar event may be a similar curve of the indicator time series curve. The similar curve may include the shape of the curve and the time information of the indicator data in the curve. The similar curve may include a calculation method and corresponding prompts for the time information, so that the operation and maintenance personnel can determine from the similar curve whether the time is intervals of days, weeks, months, and holidays, so as to be used for the operation and maintenance personnel to make judgments and perform alarm processing.

[0086] Based on this, in order to improve the user experience of the operation and maintenance personnel for the similarity curve and further improve the efficiency of alarm processing, in some embodiments, after the above S140, the following may also be included:

[0087] By sorting multiple similar events in descending order according to the first similarity, sorted similar events are obtained. Similarity curves with higher first similarity can be provided to operation and maintenance personnel first, thereby improving the operation and maintenance personnel's experience of using similarity curves and further improving the efficiency of alarm processing.

[0088] Based on the above embodiments, in order to better describe the solution for similar curve retrieval based on the target autoencoder and the target twin neural network model, some specific examples are given.

[0089] For example, Figure 2 As shown, the embodiment of the present application can first obtain the indicator time series curve X1(t) and the historical indicator time series curve X2(t). X1(t) and X2(t) are respectively input into the target autoencoder, and the encoder in the target autoencoder can be used to extract the key feature information of X1(t) and X2(t) respectively, to obtain the first feature sequence X1'(t) and the first historical feature sequence X2'(t) with shorter feature length. By inputting X1'(t) and X2'(t) into the target twin neural network model, the first similarity of the two curves can be obtained. If the first similarity is greater than the first preset threshold, X2(t) can be determined as a similar curve to X1(t).

[0090] It should be noted that, in the embodiment of the present application, the time when X1(t) and X2(t) are input into the target autoencoder can be the same or different, which is not limited here. Specifically, before obtaining X1(t), X2(t) can be obtained first and X2'(t) can be determined by the target autoencoder, and then X2'(t) can be stored in the historical event library to alleviate the data storage pressure of the database.

[0091] Through the embodiments of the present application, since the feature sequence contains information of different scales adaptively extracted by the deep neural network, the information density is higher, and compared with the original curve containing a large amount of redundant information, the storage capacity of the feature sequence is only about 1 / 10. Therefore, by first extracting the feature sequence and then performing similarity calculation, compared with the traditional method of directly using the original curve for similarity calculation, on the one hand, it can reduce the storage cost of historical events, and on the other hand, it can improve the query efficiency of similar curves.

[0092] In addition, the similarity calculation uses a target twin neural network trained with professional field data. Compared with traditional similarity algorithms, it effectively suppresses the influence of noise and can effectively utilize the shape information of different scales extracted from the feature sequence. It is more accurate than traditional algorithms that only rely on original curve matching points.

[0093] Through the embodiment of the present application, the recall rate of similar transaction indicator curve retrieval can reach more than 90%, and the precision rate can reach more than 85%. For similar curve retrieval tasks with a retrieval time range of 6 months, the consistency with manual retrieval based on expert experience is more than 90%, and the retrieval time is within 30 seconds, which is only within 15% of manual; and the retrieval time is stable. For transaction curves with uncommon cycles such as holidays and key marketing days, the retrieval time is within 5% of manual, and the recall rate is 15% higher than that of manual. In addition, the use of target autoencoders to convert historical indicator time series into historical feature sequences saves 90% of storage space, and the recall rate is increased by 15% compared to directly using the Euclidean distance between historical indicator time series and indicator time series as the similarity measurement index for retrieval; the similarity calculation part uses a target twin neural network trained with professional field data. Compared with the DTW algorithm commonly used in the industry, the overall algorithm recall rate is increased by about 30%, and the similarity evaluation time does not increase exponentially with the increase of the time series length like the DTW algorithm, which can improve the efficiency of similarity evaluation.

[0094] In addition, as another implementation of the present application, the present application also provides another implementation of the similar event query method, please refer to the following embodiments for details.

[0095] See also Figure 3 The similar event query method provided in the embodiment of the present application may specifically include the following steps S310 to S340.

[0096] S310, obtaining a first event, and obtaining a historical feature sequence of each historical event in a plurality of historical events from a historical event library.

[0097] In the case where the first event is a log, in order to reduce the storage pressure of the database and reduce the storage cost, in some embodiments, before the above S310, the following may also be included:

[0098] Get multiple historical events;

[0099] The pre-trained language model is used to extract key feature information from multiple historical events, and the historical feature sequences corresponding to the multiple historical events are obtained;

[0100] The historical feature sequences corresponding to multiple historical events are stored in the historical event library.

[0101] Here, the pre-trained language model can be a pre-trained language representation model (Bidirectional Encoder Representations from Transformers, BERT). BERT can be a bidirectional encoder representation model using Transformer. BERT is generally used to understand the contextual information of the language. In an embodiment of the present application, the last hidden layer vector of BERT can be selected as the feature representation of the historical log, that is, the second historical feature sequence. The second historical feature sequence may not include redundant information in historical events, and its feature length may be less than a preset length.

[0102] In this way, by storing the second historical feature sequences corresponding to the multiple historical logs respectively, rather than the multiple historical logs, in the historical event library, the storage pressure of the database can be reduced and the storage cost can be reduced.

[0103] S320: When the first event is a log, use a pre-trained language model to extract key feature information in the log to obtain a second feature sequence.

[0104] In the embodiment of the present application, the last hidden layer vector of BERT can be selected as the feature representation of the log, that is, the second feature sequence.

[0105] As an example, when using a pre-trained language model to extract the second feature sequence of a log, a word segmentation tool can be used to segment the log first to obtain types such as nouns, adjectives, adverbs, and tag symbols. Since adverbs and tag symbols do not contribute to the substantive content of the log, adverbs and tag symbols can be determined as invalid words. By filtering invalid words, valid words that can represent the content of the log can be obtained, and the valid words are input into the pre-trained language model, and the key feature information in the valid words is extracted using the pre-trained language model to obtain the second feature sequence.

[0106] S330, respectively determine the second similarity between the second feature sequence and each historical feature sequence to obtain multiple second similarities, where the second similarity may be, for example, cosine similarity.

[0107] S340: Filter out historical events whose second similarity is greater than a second preset threshold from multiple historical events to obtain similar events to the first event.

[0108] Here, the second preset threshold may be a preset similarity threshold, and the second preset threshold may be, for example, 0.9. In the case where the first event is a log, the similar event may refer to a similar log of the log. Similar logs may be used by operation and maintenance personnel for analysis and judgment and alarm processing.

[0109] Based on this, in order to improve the operation and maintenance personnel's experience of using similar logs and further improve the efficiency of alarm processing, in some embodiments, after the above S340, the following may also be included:

[0110] By sorting multiple similar events in descending order of the second similarity, sorted similar events are obtained. Similar logs with higher second similarity can be provided to operation and maintenance personnel in priority, improving the operation and maintenance personnel's experience of using similar logs and further improving the efficiency of alarm processing.

[0111] In addition, the other steps of the method in the embodiment of the present application can be seen above Figure 1 The relevant description of the illustrated embodiment will not be repeated here.

[0112] The embodiment of the present application uses a pre-trained BERT model to extract feature vectors. Compared with the traditional method of manually selecting keywords, it can effectively utilize long-distance keyword relationship information, capture the keyword relationship that constitutes an event, and improve the retrieval accuracy. At the same time, there is no process of manually selecting keywords - evaluating based on retrieval results - selecting keywords for secondary retrieval, which improves the efficiency of log retrieval.

[0113] In addition, by directly using the pre-trained BERT model for text feature extraction, the cost of manual annotation is reduced.

[0114] Through the embodiments of the present application, the recall rate of similar log retrieval reaches more than 90%, and the precision rate reaches more than 90%. For log retrieval within a retrieval time range of 12 months, the consistency with manual retrieval is more than 90%, and the retrieval time is within 15 seconds, which is only less than 20% of manual retrieval; for transaction objects with large-scale multi-type logs, historical logs of similar fault types can be obtained through one retrieval, without the need for secondary retrieval and manual setting of retrieval keywords. The retrieval time is within 5% of manual retrieval, and the recall rate is 10% higher than manual retrieval. In addition, the use of the BERT model increases the recall rate by 30% and the accuracy rate by 20% compared to the traditional BOW algorithm commonly used in the industry.

[0115] In addition, the memory used by the model for feature extraction and similarity evaluation in the embodiment of the present application is small, the memory used for training the model is also small, and the hardware requirements are low. Moreover, the hardware scale can be increased in the feature extraction stage or the similarity evaluation stage to perform similarity calculation in parallel and improve the query speed of similar events.

[0116] In summary, through the embodiments of the present application, as the business continues to develop, the scale of operation and maintenance continues to expand, and the situation becomes more complex and changeable, historical curves and similar logs can be provided to front-line operation and maintenance personnel for fault analysis, meeting the troubleshooting needs of actual abnormal scenarios, and improving the timeliness and accuracy of fault analysis and subsequent fault handling.

[0117] Based on the similar event query method provided in the above embodiment, the present application also provides a specific implementation of a similar event query device. Please refer to the following embodiment.

[0118] like Figure 4 As shown, the similar event query device 400 provided in the embodiment of the present application includes the following modules:

[0119] A first acquisition module 410 is used to acquire a first event and acquire a historical feature sequence of each historical event in a plurality of historical events from a historical event library;

[0120] A first extraction module 420 is used to extract key feature information from the indicator time series curve using a target autoencoder to obtain a first feature sequence when the first event is an indicator time series curve, and the feature length of the first feature sequence is less than a preset length;

[0121] A first determination module 430 is used to determine the first similarity between the first feature sequence and each historical feature sequence respectively by using the target twin neural network model to obtain multiple first similarities;

[0122] The first screening module 440 is used to screen out historical events with a first similarity greater than a first preset threshold from multiple historical events, and obtain similar events to the first event.

[0123] The similar event query device 400 is described in detail below, as follows:

[0124] In some embodiments, the similar event query device 400 may further include:

[0125] The first sorting module is used to sort the multiple similar events in descending order according to the first similarity after obtaining the similar events of the first event, so as to obtain sorted similar events.

[0126] In some embodiments, the similar event query device 400 may further include:

[0127] The second acquisition module is used to acquire multiple historical events;

[0128] The second extraction module is used to use the target autoencoder to extract key feature information from multiple historical events respectively, and obtain historical feature sequences corresponding to the multiple historical events respectively;

[0129] The first storage module is used to store historical feature sequences corresponding to multiple historical events in a historical event library.

[0130] In some embodiments, the similar event query device 400 may further include:

[0131] A third acquisition module is used to obtain a time series curve sample of the first indicator;

[0132] A third extraction module is used to input the first indicator time series curve sample into the initial autoencoder, and use the encoder in the initial autoencoder to extract key feature information in the first indicator time series curve sample to obtain a prediction feature sequence;

[0133] A decoding module is used to decode the prediction feature sequence using the decoder in the initial autoencoder to obtain a prediction indicator time series curve;

[0134] A second determination module is used to determine the similarity between the first indicator time series curve sample and the prediction indicator time series curve according to the mean square error loss function to obtain a first loss function value;

[0135] The first training module is used to adjust the model parameters of the initial autoencoder according to the first loss function value, and train to obtain the target autoencoder.

[0136] In some embodiments, the similar event query device 400 may further include:

[0137] A fourth acquisition module is used to acquire an indicator time series curve sample pair and its corresponding sample label, the indicator time series curve sample pair includes two second indicator time series curve samples, and the sample label represents the similarity between the two second indicator time series curve samples;

[0138] A prediction module, used to use the initial twin neural network model to perform similarity prediction on two second indicator time series curve samples in the indicator time series curve sample pair to obtain a prediction label;

[0139] A third determination module is used to determine the similarity between the sample label and the predicted label according to the triple loss function to obtain a second loss function value;

[0140] The second training module is used to adjust the model parameters of the initial twin neural network model according to the second loss function value, and train to obtain the target twin neural network model.

[0141] In some embodiments, the first extraction module 420 may specifically include:

[0142] A processing unit, used for performing bilateral filtering on the indicator time series curve to obtain a target indicator time series curve;

[0143] The extraction unit is used to extract key feature information from the target indicator time series curve using the target autoencoder to obtain a first feature sequence.

[0144] In some embodiments, the similar event query device 400 may further include:

[0145] A fourth extraction module, configured to extract key feature information in the log using a pre-trained language model to obtain a second feature sequence when the first event is a log;

[0146] a fourth determination module, configured to respectively determine a second similarity between the second feature sequence and each historical feature sequence to obtain a plurality of second similarities;

[0147] The second screening module is used to screen out historical events with a second similarity greater than a second preset threshold from multiple historical events to obtain similar events to the first event.

[0148] In some embodiments, the similar event query device 400 may further include:

[0149] A fifth acquisition module, used to acquire multiple historical events;

[0150] A fifth extraction module is used to extract key feature information from multiple historical events using a pre-trained language model to obtain historical feature sequences corresponding to the multiple historical events;

[0151] The second storage module is used to store historical feature sequences corresponding to multiple historical events in a historical event library.

[0152] In some embodiments, the similar event query device 400 may further include:

[0153] The second sorting module is used to sort the multiple similar events in descending order according to the second similarity after obtaining the similar events of the first event, so as to obtain sorted similar events.

[0154] The similar event query device of the embodiment of the present application can remove redundant information in the curve by using the target autoencoder to extract key feature information in the indicator time series curve when the first event is an indicator time series curve, so as to obtain a first feature sequence with higher information density and ensure the validity of the information in the first feature sequence. Since the information density of the first feature sequence is higher than that of the indicator time series curve, the accuracy of finding similar events can be guaranteed by determining similar events according to the similarity between the first feature sequence and each historical feature sequence. In addition, since the feature length of the first feature sequence is less than the preset length, the speed of finding similar events can be improved by determining similar events according to the similarity between the first feature sequence and each historical feature sequence. In addition, by using the target twin neural network model to respectively determine the first similarity between the first feature sequence and each historical feature sequence, the accuracy of the first similarity can be guaranteed, and then the accuracy of finding similar events can be guaranteed. In this way, through the embodiment of the present application, the accuracy of finding similar events can be guaranteed and the speed of finding similar events can be improved.

[0155] Based on the similar event query method provided in the above embodiment, the embodiment of the present application also provides a specific implementation of the electronic device. Figure 5 A schematic diagram of an electronic device 500 provided in an embodiment of the present application is shown.

[0156] The electronic device 500 may include a processor 510 and a memory 520 storing computer program instructions.

[0157] Specifically, the processor 510 may include a central processing unit (CPU), or an application specific integrated circuit (ASIC), or may be configured to implement one or more integrated circuits of the embodiments of the present application.

[0158] The memory 520 may include a large capacity memory for data or instructions. By way of example and not limitation, the memory 520 may include a hard disk drive (HDD), a floppy disk drive, a flash memory, an optical disk, a magneto-optical disk, a magnetic tape, or a universal serial bus (USB) drive or a combination of two or more of these. Where appropriate, the memory 520 may include a removable or non-removable (or fixed) medium. Where appropriate, the memory 520 may be inside or outside the electronic device 500. In a particular embodiment, the memory 520 is a non-volatile solid-state memory.

[0159] The memory may include a read-only memory (ROM), a random access memory (RAM), a magnetic disk storage medium device, an optical storage medium device, a flash memory device, an electrical, optical or other physical / tangible memory storage device. Thus, typically, the memory includes one or more tangible (non-transitory) computer-readable storage media (e.g., a memory device) encoded with software including computer-executable instructions, and when the software is executed (e.g., by one or more processors), it is operable to perform the operations described with reference to the method according to the first aspect of the present application.

[0160] The processor 510 implements any one of the similar event query methods in the above embodiments by reading and executing computer program instructions stored in the memory 520 .

[0161] In one example, the electronic device 500 may further include a communication interface 530 and a bus 540. Figure 5 As shown, the processor 510, the memory 520, and the communication interface 530 are connected via a bus 540 and communicate with each other.

[0162] The communication interface 530 is mainly used to implement communication between various modules, devices, units and / or equipment in the embodiments of the present application.

[0163] Bus 540 includes hardware, software or both, and the parts of electronic equipment are coupled to each other. For example, but not limitation, bus may include accelerated graphics port (AGP) or other graphics bus, enhanced industrial standard architecture (EISA) bus, front side bus (FSB), hypertransport (HT) interconnection, industrial standard architecture (ISA) bus, infinite bandwidth interconnection, low pin count (LPC) bus, memory bus, micro channel architecture (MCA) bus, peripheral component interconnection (PCI) bus, PCI-Express (PCI-X) bus, serial advanced technology attachment (SATA) bus, video electronics standard association local (VLB) bus or other suitable bus or two or more of these combinations. In appropriate cases, bus 540 may include one or more buses. Although the present application embodiment describes and shows a specific bus, the application considers any suitable bus or interconnection.

[0164] Exemplarily, the electronic device 500 may be a mobile phone, a tablet computer, a laptop computer, a PDA, an in-vehicle electronic device, an ultra-mobile personal computer (UMPC), a netbook, or a personal digital assistant (PDA).

[0165] The electronic device can execute the similar event query method in the embodiment of the present application, thereby realizing the combination Figures 1 to 4 The described similar event query method and device.

[0166] In addition, in combination with the similar event query method in the above embodiment, the embodiment of the present application can provide a computer-readable storage medium for implementation. The computer-readable storage medium stores computer program instructions; when the computer program instructions are executed by a processor, any similar event query method in the above embodiment is implemented.

[0167] It should be clear that the present application is not limited to the specific configuration and processing described above and shown in the figures. For the sake of simplicity, a detailed description of the known method is omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of the present application is not limited to the specific steps described and shown, and those skilled in the art can make various changes, modifications and additions, or change the order between the steps after understanding the spirit of the present application.

[0168] The functional blocks shown in the above-described block diagram can be implemented as hardware, software, firmware or a combination thereof. When implemented in hardware, it can be, for example, an electronic circuit, an application specific integrated circuit (ASIC), appropriate firmware, a plug-in, a function card, etc. When implemented in software, the elements of the present application are programs or code segments that are used to perform the required tasks. The program or code segment can be stored in a machine-readable medium, or transmitted on a transmission medium or a communication link by a data signal carried in a carrier wave. "Machine-readable medium" can include any medium capable of storing or transmitting information. Examples of machine-readable media include electronic circuits, semiconductor memory devices, ROM, flash memory, erasable ROM (EROM), floppy disks, CD-ROMs, optical disks, hard disks, optical fiber media, radio frequency (RF) links, etc. The code segment can be downloaded via a computer network such as the Internet, an intranet, etc.

[0169] It should also be noted that the exemplary embodiments mentioned in this application describe some methods or systems based on a series of steps or devices. However, this application is not limited to the order of the above steps, that is, the steps can be performed in the order mentioned in the embodiment, or in a different order from the embodiment, or several steps can be performed simultaneously.

[0170] The above reference is according to the method of the embodiment of the present application, the flow chart of the device (system) and the computer program product and / or the block diagram described various aspects of the present application.It should be understood that each square box in the flow chart and / or the block diagram and the combination of each square box in the flow chart and / or the block diagram can be realized by computer program instructions.These computer program instructions can be provided to the processor of a general-purpose computer, a special-purpose computer or other programmable data processing device to produce a machine so that these instructions executed by the processor of the computer or other programmable data processing device enable the realization of the function / action specified in one or more square boxes of the flow chart and / or the block diagram.Such a processor can be but is not limited to a general-purpose processor, a special-purpose processor, a special application processor or a field programmable logic circuit.It can also be understood that each square box in the block diagram and / or the flow chart and the combination of the square boxes in the block diagram and / or the flow chart can also be realized by the dedicated hardware that performs the specified function or action, or can be realized by the combination of dedicated hardware and computer instructions.

[0171] The above is only a specific implementation of the present application. Those skilled in the art can clearly understand that for the convenience and simplicity of description, the specific working processes of the systems, modules and units described above can refer to the corresponding processes in the aforementioned method embodiments, and will not be repeated here. It should be understood that the protection scope of the present application is not limited to this. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed in this application, and these modifications or replacements should be included in the protection scope of this application.

Claims

1. A similar event query method, characterized in that: include: Obtaining a first event, and obtaining a historical feature sequence of each historical event in a plurality of historical events from a historical event library; In the case where the first event is an indicator time series curve, using a target autoencoder to extract key feature information in the indicator time series curve to obtain a first feature sequence, wherein a feature length of the first feature sequence is less than a preset length; Using the target twin neural network model, respectively determine the first similarity between the first feature sequence and each of the historical feature sequences to obtain a plurality of first similarities; From the multiple historical events, historical events whose first similarity is greater than a first preset threshold are screened out to obtain similar events to the first event.

2. The method according to claim 1, characterized in that After obtaining the similar events of the first event, the method further includes: The multiple similar events are sorted in descending order according to the first similarities to obtain sorted similar events.

3. The method according to claim 1, characterized in that Before acquiring the historical feature sequence of each of the multiple historical events from the historical event library, the method further includes: Acquire the multiple historical events; Using the target autoencoder to extract key feature information from the multiple historical events respectively, to obtain historical feature sequences corresponding to the multiple historical events respectively; The historical feature sequences respectively corresponding to the multiple historical events are stored in the historical event library.

4. The method according to any one of claims 1 to 3, characterized in that: Before acquiring the first event and acquiring the historical feature sequence of each of the multiple historical events from the historical event library, the method further includes: Get the first indicator time series curve sample; Inputting the first indicator time series curve sample into an initial autoencoder, and using the encoder in the initial autoencoder to extract key feature information in the first indicator time series curve sample to obtain a predicted feature sequence; Decoding the predicted feature sequence using the decoder in the initial autoencoder to obtain a predicted indicator time series curve; Determine the similarity between the first indicator time series curve sample and the predicted indicator time series curve according to the mean square error loss function to obtain a first loss function value; The model parameters of the initial autoencoder are adjusted according to the first loss function value, and the target autoencoder is obtained by training.

5. The method according to claim 1, characterized in that Before using the target twin neural network model to respectively determine the first similarity between the first feature sequence and each of the historical feature sequences, the method further includes: Obtaining an indicator time series curve sample pair and its corresponding sample label, wherein the indicator time series curve sample pair includes two second indicator time series curve samples, and the sample label represents the similarity between the two second indicator time series curve samples; Using the initial twin neural network model, similarity prediction is performed on two of the second indicator time series curve samples in the indicator time series curve sample pair to obtain a prediction label; Determine the similarity between the sample label and the predicted label according to the triple loss function to obtain a second loss function value; The model parameters of the initial twin neural network model are adjusted according to the second loss function value, and the target twin neural network model is obtained by training.

6. The method according to claim 1, characterized in that The step of extracting key feature information from the indicator time series curve using the target autoencoder to obtain a first feature sequence includes: Performing bilateral filtering on the indicator time series curve to obtain a target indicator time series curve; The target autoencoder is used to extract key feature information in the target indicator time series curve to obtain the first feature sequence.

7. The method according to claim 1, characterized in that The method further comprises: When the first event is a log, extract key feature information in the log using a pre-trained language model to obtain a second feature sequence; respectively determining a second similarity between the second feature sequence and each of the historical feature sequences to obtain a plurality of second similarities; From the multiple historical events, historical events whose second similarity is greater than a second preset threshold are screened out to obtain similar events to the first event.

8. The method according to claim 7, characterized in that Before acquiring the historical feature sequence of each of the multiple historical events from the historical event library, the method further includes: Acquire the multiple historical events; Using the pre-trained language model, respectively extract key feature information from the multiple historical events to obtain the historical feature sequences corresponding to the multiple historical events; The historical feature sequences respectively corresponding to the multiple historical events are stored in the historical event library.

9. The method according to claim 8, characterized in that After obtaining the similar events of the first event, the method further includes: The plurality of similar events are sorted in descending order according to the second similarities to obtain sorted similar events.

10. A similar event query device, characterized in that: The device comprises: A first acquisition module, used to acquire a first event, and to acquire a historical feature sequence of each of a plurality of historical events from a historical event library; A first extraction module is used to extract key feature information from the indicator time series curve using a target autoencoder to obtain a first feature sequence when the first event is an indicator time series curve, wherein the feature length of the first feature sequence is less than a preset length; A first determination module, used to determine the first similarity between the first feature sequence and each of the historical feature sequences respectively by using the target twin neural network model, to obtain multiple first similarities; The first screening module is used to screen out historical events whose first similarity is greater than a first preset threshold from the multiple historical events, so as to obtain similar events of the first event.

11. An electronic device, characterized in that: The electronic device comprises: a processor and a memory storing computer program instructions; When the processor executes the computer program instructions, the similar event query method according to any one of claims 1 to 9 is implemented.

12. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer program instructions, and when the computer program instructions are executed by a processor, the similar event query method according to any one of claims 1 to 9 is implemented.

13. A computer program product, characterized in that When the instructions in the computer program product are executed by a processor of an electronic device, the electronic device executes the similar event query method as described in any one of claims 1 to 9.

Images