Abnormal task repairing method and device based on log, electronic equipment and medium

Abstract

The embodiment of the invention provides a log-based abnormal task repairing method and device, electronic equipment and a medium, and belongs to the technical field of financial science and technology and artificial intelligence. The method comprises the steps of obtaining initial task repair data of abnormal task data from a task repair rule base; performing validity evaluation on the initial task repair data to obtain a valid or invalid evaluation effect; if yes, taking the initial task repair data as target task repair data; and if not, obtaining target task repair data through the task repair model. According to the embodiment of the invention, by performing validity evaluation on the initial task repair data, invalid or wrong repair attempts are avoided, when the initial task repair data is invalid, the target task repair data are acquired through the task repair model, the reliability of repairing the abnormal task is improved in combination with historical data, manual intervention of abnormal task repair is not needed, and the efficiency of repairing the abnormal task is improved. The abnormal task can be automatically repaired, and the repairing effect of the abnormal task is improved.

Description

Technical Field

[0001] The present application relates to the fields of financial technology and artificial intelligence technology, and in particular to a log-based abnormal task repair method and device, electronic equipment and medium. Background Art

[0002] At present, the method of repairing abnormal tasks based on logs is mainly to have operation and maintenance personnel analyze the abnormal tasks in the historical task operation logs and repair the abnormal tasks. For example, in the financial technology scenario, if there is an online insurance claims system that has a transaction request abnormality when processing a large number of claim requests, the operation and maintenance personnel will analyze the abnormal task of the system as a database access task, and the database access task is caused by excessive database access traffic, and repair the database access task to adjust the database access resource allocation. However, this method requires manual intervention in the repair of abnormal tasks. Since the repair process requires manual intervention to first spend time looking for the cause of the abnormal task, and then repair the abnormal task based on the repair experience, the effect of abnormal task repair is poor. Therefore, how to improve the repair effect of abnormal task repair has become an urgent problem to be solved. Summary of the invention

[0003] The main purpose of the embodiments of the present application is to propose a log-based abnormal task repair method and device, electronic device and medium, aiming to improve the repair effect of abnormal tasks.

[0004] To achieve the above-mentioned purpose, a first aspect of an embodiment of the present application proposes a log-based abnormal task repair method, the method comprising:

[0005] Obtaining original task data including original transaction logs according to preset product transaction tasks;

[0006] Performing structured processing on the original task data to obtain structured task data including the original transaction log;

[0007] Based on the structured task data, anomaly identification is performed on the product transaction task to obtain abnormal task data;

[0008] Acquire initial task repair data of the abnormal task data from a preset task repair rule library;

[0009] Performing validity evaluation on the initial task repair data to obtain an evaluation result; wherein the evaluation result is used to indicate that the initial task repair data is valid or that the initial task repair data is invalid;

[0010] If the evaluation result is used to indicate that the initial task repair data is valid, the initial task repair data is used as the target task repair data;

[0011] If the evaluation result is used to indicate that the initial task repair data is invalid, the target task repair data of the abnormal task data is obtained from existing similar task repair cases through a preset task repair model.

[0012] In some embodiments, the performing effectiveness evaluation on the initial task repair data to obtain an evaluation result includes:

[0013] Obtaining an initial repair transaction log of the initial task repair data;

[0014] Determine the repair accuracy and the repair recall of the initial task repair data according to the original transaction log and the initial repair transaction log;

[0015] Scoring the repair effect of the initial task repair data according to the repair accuracy and the repair recall rate to obtain a repair effectiveness score;

[0016] The effectiveness of the repair effectiveness score is evaluated according to a preset effectiveness threshold to obtain the evaluation effect.

[0017] In some embodiments, the step of obtaining the initial task repair data of the abnormal task data from a preset task repair rule library includes:

[0018] Constructing an abnormal query statement according to the abnormal task data;

[0019] Acquire an abnormal task rule matching the abnormal task data from the task repair rule library according to the abnormal query;

[0020] Initial task repair data of the abnormal task data is acquired from the task repair rule library based on the abnormal task rule.

[0021] In some embodiments, the step of obtaining target task repair data of the abnormal task data from existing similar task repair cases using a preset task repair model includes:

[0022] Using the task repair model to extract features from the abnormal task data to obtain abnormal task features;

[0023] Finding similar abnormal task features of the abnormal task features from existing similar abnormal task cases;

[0024] Performing an abnormality cause query on the abnormal task feature according to the similar abnormal task feature to obtain the task abnormality cause;

[0025] The target task repair data is obtained from existing similar task repair cases according to the task abnormality cause.

[0026] In some embodiments, the performing abnormality identification on the product transaction task based on the structured task data to obtain abnormal task data includes:

[0027] Obtaining original transaction log features of the structured task data;

[0028] Assigning the original transaction log features to the nearest preset cluster center for clustering to obtain clustered transaction log features;

[0029] Obtaining the average cluster distance between all the clustered transaction log features and the preset cluster center;

[0030] Identifying the characteristic abnormality of the clustered transaction log characteristics according to the cluster average distance;

[0031] The product transaction task is identified as abnormal according to a preset abnormality degree threshold and the characteristic abnormality degree to obtain the abnormal task data.

[0032] In some embodiments, obtaining the original transaction log features of the structured task data includes:

[0033] Dividing the original transaction log by using a preset sliding window to obtain an original transaction log sequence;

[0034] Obtaining log events of the original transaction log sequence;

[0035] Log feature extraction is performed on the structured task data according to the log event and the original transaction log sequence to obtain the original transaction log feature.

[0036] In some embodiments, the original task data is structured to obtain structured task data including the original transaction log, and the method further includes:

[0037] Obtaining an original transaction log parse tree of the original task data;

[0038] Obtaining a log token of the original transaction log, and obtaining a log token length of the log token;

[0039] Performing event grouping on each tree node in the original transaction log parsing tree based on the log token and the log token length to obtain a grouped transaction log;

[0040] Matching the grouped transaction log with a preset log template to obtain a matching event transaction log;

[0041] The matching event transaction log is structured to obtain structured task data containing the original transaction log.

[0042] To achieve the above-mentioned purpose, a second aspect of an embodiment of the present application proposes a log-based abnormal task repair device, the device comprising:

[0043] A task data acquisition module, used to acquire original task data including original transaction logs according to a preset product transaction task;

[0044] A structured processing module, used for performing structured processing on the original task data to obtain structured task data including the original transaction log;

[0045] An abnormality identification module, used to identify abnormalities of the product transaction task based on the structured task data to obtain abnormal task data;

[0046] An initial repair data acquisition module, used to acquire initial task repair data of the abnormal task data from a preset task repair rule library;

[0047] A validity evaluation module, used to evaluate the validity of the initial task repair data to obtain an evaluation result; wherein the evaluation result is used to indicate that the initial task repair data is valid or the initial task repair data is invalid;

[0048] A repair data acquisition module is used to use the initial task repair data as target task repair data if the evaluation result is used to indicate that the initial task repair data is valid; if the evaluation result is used to indicate that the initial task repair data is invalid, obtain the target task repair data of the abnormal task data from existing similar task repair cases through a preset task repair model.

[0049] To achieve the above objectives, a third aspect of an embodiment of the present application proposes an electronic device, which includes a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the method described in the first aspect is implemented.

[0050] To achieve the above-mentioned purpose, the fourth aspect of the embodiments of the present application proposes a computer-readable medium, wherein the computer-readable medium stores a computer program, and when the computer program is executed by a processor, the method described in the first aspect is implemented.

[0051] The log-based abnormal task repair method and device, electronic device and medium proposed in the present application obtain original task data containing original transaction logs according to preset product transaction tasks; perform structured processing on the original task data to obtain structured task data containing original transaction logs; perform abnormal identification on the product transaction tasks based on the structured task data to obtain abnormal task data; obtain initial task repair data of the abnormal task data from a preset task repair rule library; perform validity evaluation on the initial task repair data to obtain an evaluation effect; wherein the evaluation effect is used to indicate that the initial task repair data is valid or invalid; if the evaluation effect is used to indicate that the initial task repair data is valid, the initial task repair data is used as the target task repair data; if the evaluation effect is used to indicate that the initial task repair data is invalid, the target task repair data of the abnormal task data is obtained from existing similar task repair cases through a preset task repair model. The present application first performs structured processing on the original task data, is able to convert unstructured data into structured data, and performs anomaly identification on product transaction tasks based on the structured task data. Without the need for manual intervention in abnormal tasks, the potential problems and risk points of abnormal tasks can be quickly located, thereby facilitating the subsequent improvement of the repair effect of abnormal tasks. Secondly, an effectiveness evaluation is performed on the initial task repair data obtained from the task repair rule library, which helps to determine the effectiveness of the abnormal task to ensure that the repair measures taken are feasible and avoid invalid or erroneous repair attempts. Finally, when the initial task repair data is invalid, the target task repair data of the abnormal task data is obtained from existing similar task repair cases through the task repair model, and the reliability of repairing abnormal tasks is improved by combining historical data. Without the need for manual intervention in the repair of abnormal tasks, the abnormal task can be automatically repaired, thereby improving the repair effect of abnormal tasks. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] Figure 1 is a flow chart of a log-based abnormal task repair method provided in an embodiment of the present application;

[0053] Figure 2 yes Figure 1 Flow chart of step S102 in FIG.

[0054] Figure 3 yes Figure 1 Flow chart of step S103 in FIG.

[0055] Figure 4 yes Figure 3 Flow chart of step S301 in FIG.

[0056] Figure 5 yes Figure 1 Flow chart of step S104 in FIG.

[0057] Figure 6 yes Figure 1 Flow chart of step S105 in FIG.

[0058] Figure 7 yes Figure 1 Flow chart of step S107 in FIG.

[0059] Figure 8 It is a structural diagram of a log-based abnormal task repair device provided in an embodiment of the present application;

[0060] Fig. 9 It is a schematic diagram of the hardware structure of the electronic device provided in the embodiment of the present application. DETAILED DESCRIPTION

[0061] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0062] It should be noted that, although the functional modules are divided in the device schematic diagram and the logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than the module division in the device or the order in the flowchart. The terms "first", "second", etc. in the specification, claims and the above drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0063] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used herein are only for the purpose of describing the embodiments of this application and are not intended to limit this application.

[0064] First, some nouns involved in this application are analyzed:

[0065] Artificial intelligence (AI) is a new technical science that studies and develops theories, methods, technologies and application systems for simulating, extending and expanding human intelligence. AI is a branch of computer science that attempts to understand the essence of intelligence and produce a new type of intelligent machine that can respond in a similar way to human intelligence. Research in this field includes robots, language recognition, image recognition, natural language processing and expert systems. AI can simulate the information process of human consciousness and thinking. AI is also a theory, method, technology and application system that uses digital computers or machines controlled by digital computers to simulate, extend and expand human intelligence, perceive the environment, acquire knowledge and use knowledge to obtain the best results.

[0066] Based on this, the embodiments of the present application provide a log-based abnormal task repair method and device, electronic device and medium, aiming to improve the repair effect of abnormal tasks.

[0067] The log-based abnormal task repair method and device, electronic device and medium provided in the embodiments of the present application are specifically described through the following embodiments. First, the log-based abnormal task repair method in the embodiments of the present application is described.

[0068] The embodiments of the present application can acquire and process relevant data based on artificial intelligence technology. Artificial Intelligence (AI) is the theory, method, technology and application system that uses digital computers or machines controlled by digital computers to simulate, extend and expand human intelligence, perceive the environment, acquire knowledge and use knowledge to obtain the best results.

[0069] The basic technologies of artificial intelligence generally include sensors, dedicated artificial intelligence chips, cloud computing, distributed storage, big data processing technology, processing / interaction systems, mechatronics, etc. Artificial intelligence software technologies mainly include computer vision technology, robotics technology, biometrics technology, speech processing technology, natural language processing technology, and machine learning / deep learning.

[0070] The log-based abnormal task repair method provided in the embodiment of the present application relates to the fields of financial technology and artificial intelligence technology. The log-based abnormal task repair method provided in the embodiment of the present application can be applied to the terminal, can also be applied to the server side, and can also be software running in the terminal or the server side. In some embodiments, the terminal can be a smart phone, a tablet computer, a laptop computer, a desktop computer, etc.; the server side can be configured as an independent physical server, or it can be configured as a server cluster or distributed system composed of multiple physical servers, and can also be configured as a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms; the software can be an application that implements a log-based abnormal task repair method, etc., but is not limited to the above forms.

[0071] The present application can be used in many general or special computer system environments or configurations. For example: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, distributed computing environments including any of the above systems or devices, etc. The present application can be described in the general context of computer executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. The present application can also be practiced in distributed computing environments, in which tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules can be located in local and remote computer media including storage devices.

[0072] It should be noted that in each specific implementation of the present application, when it comes to the need to perform relevant processing based on data related to user identity or characteristics such as user image data, user video data, and business text data, the user's permission or consent will be obtained first, and the collection, use and processing of these data will comply with relevant laws, regulations and standards. In addition, when the embodiment of the present application needs to obtain the user's sensitive personal information, the user's separate permission or consent will be obtained through a pop-up window or jump to a confirmation page. After clearly obtaining the user's separate permission or consent, the necessary user-related data for the normal operation of the embodiment of the present application will be obtained.

[0073] Figure 1 is an optional flowchart of the log-based abnormal task repair method provided in an embodiment of the present application. Figure 1 The method may include but is not limited to steps S101 to S107.

[0074] Step S101, obtaining original task data including original transaction logs according to a preset product transaction task.

[0075] Step S102, structural processing is performed on the original task data to obtain structured task data including the original transaction log.

[0076] Step S103, performing abnormality identification on the product transaction task based on the structured task data to obtain abnormal task data.

[0077] Step S104, obtaining initial task repair data of abnormal task data from a preset task repair rule library.

[0078] Step S105, evaluating the effectiveness of the initial task repair data to obtain an evaluation result; wherein the evaluation result is used to indicate whether the initial task repair data is effective or not.

[0079] Step S106: If the evaluation result indicates that the initial task repair data is valid, the initial task repair data is used as the target task repair data.

[0080] Step S107: if the evaluation result indicates that the initial task repair data is invalid, the target task repair data of the abnormal task data is obtained from existing similar task repair cases through a preset task repair model.

[0081] Steps S101 to S107 shown in the embodiment of the present application are as follows: obtaining original task data including an original transaction log according to a preset product transaction task; performing structured processing on the original task data to obtain structured task data including the original transaction log; performing abnormality identification on the product transaction task based on the structured task data to obtain abnormal task data; obtaining initial task repair data of the abnormal task data from a preset task repair rule library; performing validity evaluation on the initial task repair data to obtain an evaluation effect; wherein the evaluation effect is used to indicate that the initial task repair data is valid or the initial task repair data is invalid; if the evaluation effect is used to indicate that the initial task repair data is valid, the initial task repair data is used as the target task repair data; if the evaluation effect is used to indicate that the initial task repair data is invalid, the target task repair data of the abnormal task data is obtained from existing similar task repair cases through a preset task repair model. The present application first performs structured processing on the original task data, is able to convert unstructured data into structured data, and performs anomaly identification on product transaction tasks based on the structured task data. Without the need for manual intervention in abnormal tasks, the potential problems and risk points of abnormal tasks can be quickly located, thereby facilitating the subsequent improvement of the repair effect of abnormal tasks. Secondly, an effectiveness evaluation is performed on the initial task repair data obtained from the task repair rule library, which helps to determine the effectiveness of the abnormal task to ensure that the repair measures taken are feasible and avoid invalid or erroneous repair attempts. Finally, when the initial task repair data is invalid, the target task repair data of the abnormal task data is obtained from existing similar task repair cases through the task repair model, and the reliability of repairing abnormal tasks is improved by combining historical data. Without the need for manual intervention in the repair of abnormal tasks, the abnormal task can be automatically repaired, thereby improving the repair effect of abnormal tasks.

[0082] In step S101 of some embodiments, specifically, the product transaction task refers to a product transaction application submitted by a user on a transaction platform.

[0083] For example, in various financial fields, a product transaction task is an insurance claim request submitted by a user on a product transaction platform. The product transaction task includes receiving a claim application, verifying user information, querying policy status, calculating the claim amount, updating database records, etc.

[0084] Specifically, the original transaction log is used to describe the warnings, status, errors and operation-related information that occur in the product transaction tasks on the transaction system, and records the detailed information of all product transaction tasks, including but not limited to transaction time, transaction source, transaction content and transaction results.

[0085] Furthermore, in order to enable flexible analysis, developers usually use print statements to generate unstructured text information of the original transaction log to describe the message header and message content of the product transaction task, where the message header is described based on the time, level, and component of the product transaction task, and the message content is described based on constant fields and variable fields. The constant part includes template fields that commonly appear in the original transaction log, and the variable part includes status information when the product transaction task is running on the transaction system.

[0086] For example, the original transaction log is 2024-06-08,17:40:28,INFO gbd-c li:Updated configuration for task id=500,jvm_heap updated by 128Mb. Among them, the time when the product trading task occurred is 2024-06-08, 17:40:28, the level is I NFO (the I NFO level provides information about the normal operation of the trading platform), the component is gbd-cli (indicating that the name of the component performing the operation is the trading platform of the real-time product trading task), the content is Updated configuration for task id=500, jvm_heap updated by128Mb (that is, for the real-time product trading task with ID 500, the JVM heap memory is increased by 128Mb), the variables are id=500, a unique identifier indicating that the real-time product trading task is updated, jvm_heap (indicating the heap memory size of the Java virtual machine to be adjusted), and add128Mb (indicating that the JVM heap memory is increased to 128Mb).

[0087] Specifically, raw task data refers to the original, unprocessed or preliminarily processed data set generated when executing a product transaction task, and the raw task data generally includes but is not limited to raw transaction records, transaction details, transaction platform status, and transaction error information.

[0088] For example, in the financial field, if the product transaction task is a commodity transaction task on an e-commerce platform, the original task data may include transaction logs (recording that the user purchased commodity A at 2:30 pm on June 8, 2024, the payment amount was 100 yuan, and the transaction status was successful), e-commerce platform logs (recording the e-commerce platform when processing commodity transaction tasks, reading commodity information from the e-commerce database, verifying user payment information, and updating commodity inventory quantities, etc.), configuration information (recording data such as the size of the e-commerce database connection pool and the timeout of the payment interface), and user behavior data (recording the user's stay time on the commodity A page, the time when the purchase button is clicked, etc.).

[0089] See also Figure 2 In some embodiments, step S102 includes but is not limited to steps S201 to S205:

[0090] Step S201, obtaining an original transaction log parse tree of original task data.

[0091] Step S202, obtaining a log token of the original transaction log, and obtaining a log token length of the log token.

[0092] Step S203 , grouping events for each tree node in the original transaction log parsing tree based on the log token and the log token length to obtain a grouped transaction log.

[0093] Step S204, matching the grouped transaction log with a preset log template to obtain a matching event transaction log.

[0094] Step S205 , structurally process the matching event transaction log to obtain structured task data including the original transaction log.

[0095] In step S201 of some embodiments, specifically, the original transaction log parse tree is a data storage structure used to represent and store the original transaction log, and the parse tree can clearly express the hierarchical relationship, time sequence and dependency relationship between the original transaction logs.

[0096] Specifically, the original transaction log is divided into log text fields, and regular expressions are used to replace or process useless fields, so as to realize preprocessing of the original transaction log.

[0097] For example, unimportant IP addresses and port numbers in the original transaction logs can be removed through regular expressions.

[0098] Furthermore, the original transaction log in the original task data is converted into a tree structure using regular expressions according to the preset tree depth and similarity value.

[0099] For example, in the financial field, the original transaction log message is "User [U ID123] performed a transfer operation at [2023-04-0110:00:00], the transfer-out account [ACCT456], the transfer-in account [ACCT789], the amount is 100 yuan," and the original transaction log is converted into an original transaction log parse tree according to the regular expression, where the root node of the parse tree represents the transaction type, and the child nodes represent information such as user ID, time, transfer-out account, transfer-in account, and amount.

[0100] In step S202 of some embodiments, specifically, the log token is a keyword or data unit used to identify or distinguish different parts in the original transaction log, such as a user ID, a timestamp, an account number, etc.

[0101] Specifically, the log token length refers to the number of characters contained in the day token.

[0102] For example, if the original transaction log is “user [U ID123]”, the corresponding log token is “U ID123” and the corresponding log token length is 6.

[0103] In step S203 of some embodiments, specifically, grouping transaction logs means grouping tree nodes in the parse tree according to log token content and log token length, and grouping original transaction logs belonging to the same category of events into one group.

[0104] Specifically, the original transaction log length refers to the sum of the lengths of all log tokens (constants and variables) of a log. Since the lengths of variable-length original transaction logs are equal after calculating the lengths of constant tokens, grouping the original transaction logs by constant tokens is conducive to grouping similar event logs into the same group.

[0105] Specifically, since the variables of the original transaction log contain state information when the product transaction task is running on the trading system, the state variables need to be retained in the structuring process to ensure reasonable event grouping of the original transaction log, and usually the form of the state variables is the same as that of the constant log token. Only using constant log tokens to group events of different tree nodes can effectively retain the state variables.

[0106] For example, in the financial field, all raw transaction logs containing log tokens of "transfer" events and having similar or equal log token lengths can be grouped together, and all raw transaction logs containing log tokens of "deposit" events and having similar or equal log token lengths can be grouped together in another group.

[0107] In this embodiment, events are grouped for each tree node in the original transaction log parsing tree based on log tokens and log token lengths, so that similar transaction logs can be clustered together, which helps to understand the generation frequency of different types of transaction event logs and optimize resource allocation.

[0108] In step S204 of some embodiments, specifically, the log template may be set based on the entity's business situation.

[0109] For example, in the financial field, a log template for a transfer operation can be defined, which includes log fields such as user ID, timestamp, transfer-out account, transfer-in account, and amount.

[0110] Specifically, by matching the grouped transaction logs with the corresponding log templates, matching event transaction logs that conform to the log templates can be found.

[0111] Specifically, first calculate the similarity between the grouped transaction log and each candidate log template, and compare the similarity with the preset similarity threshold. If the similarity is greater than the preset similarity threshold, the grouped transaction log matches the log template. If the similarity is less than or equal to the preset similarity threshold, a new log template is generated with the grouped transaction log as the event template.

[0112] In this embodiment, by matching the grouped transaction log with the preset log template, a matching event transaction log is obtained, which facilitates the subsequent transaction platform to quickly locate the specific problem event log, thereby improving the efficiency of subsequent abnormal task data identification.

[0113] In step S205 of some embodiments, structured processing refers to converting unstructured text log data into a structured data format, such as JSON, XML, etc.

[0114] For example, in the financial field, the transfer event log can be converted into JSON format data.

[0115] In this embodiment, by performing structured processing on the matching time transaction log, key information in the log (such as timestamp, operation type, related parameters, etc.) can be extracted and organized into a structured format, which facilitates rapid understanding and analysis of the log data and improves the efficiency of subsequent abnormal task data identification.

[0116] See also Figure 3 In some embodiments, step S103 includes but is not limited to steps S301 to S305:

[0117] Step S301, obtaining original transaction log features of structured task data.

[0118] Step S302: distribute the original transaction log features to the nearest preset cluster center for clustering to obtain clustered transaction log features.

[0119] Step S303, obtaining the average cluster distance between all clustered transaction log features and the preset cluster center.

[0120] Step S304: identifying the characteristic abnormality of the clustered transaction log characteristics according to the cluster average distance.

[0121] Step S305, performing abnormal identification on the product transaction task according to the preset abnormality level threshold and characteristic abnormality level to obtain abnormal task data.

[0122] See also Figure 4 In some embodiments, step S301 includes but is not limited to steps S401 to S403:

[0123] Step S401, divide the original transaction log using a preset sliding window to obtain an original transaction log sequence.

[0124] Step S402, obtaining log events of the original transaction log sequence.

[0125] Step S403: extract log features from the structured task data according to the log events and the original transaction log sequence to obtain original transaction log features.

[0126] In step S401 of some embodiments, specifically, the original transaction log is a sequence consisting of multiple continuous transaction logs obtained by partitioning through a sliding window, and each sequence is a subset of the original transaction log.

[0127] For example, in the financial field, if the original transaction log records the time, type, amount and other information of commodity transactions in detail, a sliding window of size N is set to slide on the original transaction log with a step size of 1, and each time the sliding window slides, it will cover M consecutive commodity transaction log records to obtain a commodity transaction log sequence.

[0128] In step S402 of some embodiments, specifically, the log event refers to a transaction event in the original transaction log sequence.

[0129] For example, in the financial field, different log events can be distinguished based on the transaction type field features in the original transaction log sequence, such as transfer, recharge or withdrawal log events.

[0130] In step S403 of some embodiments, specifically, the original transaction log feature refers to a quantitative indicator extracted from the original transaction log sequence and capable of describing a log event.

[0131] Specifically, TF-IDF is used to count the number of occurrences of log events in the original transaction log sequence to generate an event count matrix, where the values ​​in the cells of the event count matrix represent the number of times the log event occurs on the original transaction log sequence. Based on the number, log features are extracted from the structured task data through word embedding operations to obtain the original transaction log vector space including the number of occurrences of log events.

[0132] For example, in the financial field, by counting the number and total amount of transfer events in a log sequence, we can understand the transfer activity of the account in the log sequence.

[0133] In step S302 of some embodiments, specifically, the preset cluster center may be a center point determined based on historical data or expert experience, and the preset cluster center may be used to represent different categories of transaction behaviors.

[0134] Specifically, the distances from all original transaction log features to different cluster centers are calculated, the original transaction log features are divided into the clusters closest to them, the original transaction log features included in the clusters are updated, and clustered transaction log features are obtained. The distances from the original transaction log features to different cluster centers can be calculated using the Euclidean distance.

[0135] For example, in the financial field, if the original transaction log record contains transaction amount and transaction time features, three cluster centers are preset based on historical data, representing small daily transaction clusters, large transfer clusters, and abnormal transaction clusters. The distance between the features of each transaction record and these three cluster centers is calculated through Euclidean distance. The original transaction features are assigned to the nearest cluster center according to the distance to obtain the clustered transaction log features.

[0136] In step S303 of some embodiments, specifically, the cluster average distance refers to the average distance from the original transaction log features in each cluster to the cluster center. The smaller the average distance is, the more similar the transaction behaviors within the cluster are, and the better the clustering effect is.

[0137] In step S304 of some embodiments, specifically, the feature abnormality refers to that the distance from each clustered transaction log feature to its corresponding cluster center exceeds the cluster average distance.

[0138] Specifically, the feature abnormality is used to indicate that the clustered transaction log feature is a potential abnormal log feature, which can be represented by the number of abnormal occurrences. For example, if the distance from a clustered transaction log feature to its corresponding cluster center exceeds the cluster average distance, the feature abnormality is represented by a value of 1. If the number of clustered transaction log features that exceed the cluster average distance is 5, the feature abnormality is represented by a value of 5.

[0139] In this embodiment, the characteristic abnormality of clustered transaction log features is identified based on the cluster average distance, which can accurately identify abnormal transaction log features, help to preliminarily distinguish normal transaction behaviors from potential abnormal transaction behaviors, and facilitate subsequent improvement of the accuracy of abnormal task identification.

[0140] In step S305 of some embodiments, specifically, the abnormality level threshold is used to indicate whether the product transaction task is an abnormal transaction, and the abnormality level threshold can be determined by the number of abnormal cluster transaction log features appearing in the cluster.

[0141] Specifically, if the feature abnormality is greater than the abnormality threshold, it indicates that there is abnormal trading behavior in the product trading task, and the abnormal clustering transaction log features in the abnormal trading task are obtained, and the abnormal task data is extracted from the original task data based on the abnormal clustering transaction features; if the feature abnormality is less than or equal to the abnormality threshold, it indicates that there is no abnormal trading behavior in the product trading task.

[0142] In this embodiment, product transaction tasks are identified for anomalies based on preset anomaly level thresholds and feature anomaly levels, without the need for manual intervention in task anomaly identification, thereby improving the efficiency of abnormal task identification. The anomaly level threshold is further combined for abnormal identification judgment, effectively reducing the misjudgment rate of abnormal task identification, further improving the accuracy of abnormal task identification, and facilitating subsequent improvement in the repair effect of abnormal tasks.

[0143] See also Figure 5 In some embodiments, step S104 includes but is not limited to steps S501 to S503:

[0144] Step S501, constructing an abnormal query statement according to abnormal task data.

[0145] Step S502: Acquire abnormal task rules matching the abnormal task data from the task repair rule library according to the abnormal query.

[0146] Step S503: acquiring initial task repair data of the abnormal task data from a task repair rule library based on the abnormal task rule.

[0147] In step S501 of some embodiments, specifically, the abnormal query statement is used to query the abnormal rules matching the abnormal task data in the preset task repair rule library, and the abnormal query statement may be an SQL query statement.

[0148] In step S502 of some embodiments, specifically, the task repair rule base refers to a database storing various abnormal task rules and corresponding abnormal task repair strategies, the rules define different categories of abnormal tasks, and provide repair or processing suggestions for these abnormal tasks.

[0149] Specifically, if there is an abnormal task rule of commodity purchase failure in the task repair rule library, the commodity purchase failure rule matches the commodity payment failure in the abnormal task data, so the commodity purchase failure task is retrieved from the task repair rule library as the abnormal task rule.

[0150] In step S503 of some embodiments, specifically, the initial task repair data is used as a measure to resolve the abnormal task.

[0151] For example, in the financial field, the initial repair suggestion data corresponding to the failed product purchase stored in the task repair rule library is to update the product payment page and prompt the user to pay the product price again.

[0152] In this embodiment, initial task repair data of abnormal task data is obtained from a task repair rule library based on abnormal task rules, and the abnormal task is automatically repaired without manual intervention in the abnormal task repair process, which preliminarily improves the repair effect of the abnormal task.

[0153] See also Figure 6 In some embodiments, step S105 includes but is not limited to steps S601 to S604:

[0154] Step S601, obtaining an initial repair transaction log of initial task repair data.

[0155] Step S602: determining the repair accuracy and the repair recall of the initial task repair data according to the original transaction log and the initial repair transaction log.

[0156] Step S603, scoring the repair effect of the initial task repair data according to the repair accuracy and the repair recall rate to obtain a repair effectiveness score.

[0157] Step S604, evaluating the effectiveness of the repair effectiveness score according to a preset effectiveness threshold to obtain an evaluation result.

[0158] In step S601 of some embodiments, specifically, the initial repair transaction log refers to a new log record generated by the trading platform after the initial task repair data is applied, and these log records reflect the modification and impact of the repair operation on the abnormal task.

[0159] For example, in the financial field, the abnormal task log records the transaction amount of a commodity transaction as 1,000 yuan. Since the actual value of the commodity should be 100 yuan, the transaction amount recorded in the initial repair transaction log is 100 yuan.

[0160] In step S602 of some embodiments, specifically, the repair accuracy rate refers to the ratio of the number of abnormal task records that are correctly repaired to the number of all repaired records.

[0161] Specifically, the repair recall rate refers to the ratio of the number of abnormal task records that are correctly repaired to the number of all actual abnormal task records.

[0162] For example, in the financial field, 100 commodity transactions are recorded in the original transaction log, of which 10 commodity transactions are abnormal. After preliminary repair, 10 commodity transaction repair records are recorded in the initial repair transaction log, and 9 commodity transactions are successfully repaired. The repair accuracy is 90% and the repair recall is 100%, because all actual abnormal task transactions are marked as repaired (although there are erroneous repair commodity transactions).

[0163] In step S603 of some embodiments, specifically, the repair effectiveness score is used to describe the repair effect of the initial task repair data.

[0164] Specifically, the effective score of the repair can be obtained by 2x(precision x recall) / (precision + recall).

[0165] For example, if the precision is 90% and the recall is 100%, the repair effectiveness score is 1.8 / 1.9=0.95.

[0166] In this embodiment, the repair effect score of the initial task repair data is scored according to the repair accuracy and the repair recall rate. The two evaluation indicators of accuracy and recall rate can be combined to determine the final repair effect score of the initial task repair data, which helps to comprehensively detect the repair effect of the initial task repair data and facilitates improving the repair accuracy of abnormal tasks.

[0167] In step S604 of some embodiments, specifically, the preset validity threshold is a restoration effectiveness evaluation threshold determined based on expert experience, and is used to evaluate the validity or invalidity of the initial task restoration data.

[0168] Specifically, if the effective threshold is 0.8 and the effective repair score is 0.95, it means that the initial task repair data is a valid repair. If the effective repair score is less than or equal to the effective threshold, it means that the initial task repair data is an invalid repair. It is necessary to regenerate the abnormal task repair plan in combination with the large language model to ensure the effectiveness of the repair plan.

[0169] In this embodiment, the effectiveness of the repair effectiveness score is evaluated according to a preset effective threshold, which helps to further determine the effectiveness of the abnormal task repair in combination with the effective threshold, so as to ensure that the repair measures taken are feasible, avoid invalid or erroneous repair attempts, and effectively improve the abnormal task repair effect.

[0170] In step S106 of some embodiments, specifically, if the evaluation result is used to indicate that the initial task repair data is valid, the initial task repair data is used as the target task repair data.

[0171] Specifically, after the initial task repair data is used as the target task repair data, the target task repair data is sent to the trading platform. The trading platform identifies the repair log in the target task repair data, and generates a repair instruction based on the repair log, and implements the repair of the abnormal task through the trading platform.

[0172] In an optional embodiment of the present application, the operation of product trading tasks, the identification of abnormal trading tasks and the repair process of abnormal trading tasks can also be monitored in real time through the trading platform. When abnormal trading tasks occur and abnormal trading tasks are repaired, the abnormal trading task conditions and abnormal trading task data are sent to the operation and maintenance personnel client in a timely manner, thereby further improving the effect of abnormal task repair.

[0173] In this embodiment, when the evaluation effect is used to indicate that the initial task repair data is valid, the initial task repair data is directly used as the target task repair data, and the corresponding repair measures can be quickly and automatically extracted from the task repair rule library, thereby reducing manual intervention and improving the repair efficiency of abnormal tasks.

[0174] See also Figure 7 In some embodiments, step S107 includes but is not limited to steps S701 to S704:

[0175] Step S701: Use the task repair model to extract features from abnormal task data to obtain abnormal task features.

[0176] Step S702: searching for similar abnormal task features of abnormal task features from existing similar abnormal task cases.

[0177] Step S703, query the abnormal cause of the abnormal task features according to the similar abnormal task features to obtain the task abnormal cause.

[0178] Step S704, obtaining target task repair data from existing similar task repair cases according to the task abnormality cause.

[0179] In step S701 of some embodiments, specifically, the task repair model may be a large language model, which is used to analyze and identify abnormal task patterns of product transaction tasks and provide a repair solution for the abnormal task patterns.

[0180] Specifically, abnormal task features refer to abnormal task log features and abnormal task running status features that map abnormal task data to a high-dimensional vector space through word embedding operations.

[0181] In step S702 of some embodiments, specifically, the similar abnormal task case refers to a task abnormality record that occurred in the past and has similar characteristics to the current abnormal task, and the similar abnormal task case can be obtained from the trading platform or public trading data.

[0182] Specifically, similar abnormal task features are used to identify possible causes of task abnormalities.

[0183] For example, in the financial field, if the abnormal task data is a failed payment for a product order, and the abnormal task characteristics are abnormal payment time or frequent changes in payment methods, the large language model can be used to find failed payment cases of product orders similar to the current abnormal task, and the similar abnormal task characteristics of this case are abnormal payment time or frequent changes in payment methods.

[0184] In step S703 of some embodiments, specifically, by comparing similar abnormal task features of similar abnormal task cases, the abnormal cause of the similar abnormal task feature can be obtained, and the abnormal cause is used as the task abnormal cause.

[0185] For example, in the financial field, if the cause of a similar abnormal task is the failure of commodity payment due to the instability of the bank payment interface, then the cause of the task abnormality is also the failure of commodity payment due to the instability of the bank payment interface.

[0186] In step S704 of some embodiments, specifically, the target task repair data refers to specific repair data for repairing the abnormal task obtained from similar task repair cases.

[0187] For example, in the financial field, the cause of task abnormality in similar abnormal task cases is the instability of the bank payment interface. The repair solution for similar abnormal task cases is to temporarily replace the payment interface or add a retry mechanism. If the abnormal task is successfully repaired through the repair solution, the temporary replacement of the payment interface or the addition of the retry mechanism will be used as the target task repair data.

[0188] In this embodiment, when the initial task repair data is invalid, the target task repair data of the abnormal task data is obtained from the existing similar task repair cases through the task repair model, which can improve the reliability of repairing the abnormal task in combination with historical data. There is no need for manual intervention in the repair of the abnormal task, and the abnormal task can be automatically repaired, further improving the repair effect of the abnormal task.

[0189] The embodiment of the present application obtains original task data including original transaction logs according to preset product transaction tasks; performs structured processing on the original task data to obtain structured task data including original transaction logs; performs abnormal identification on the product transaction tasks based on the structured task data to obtain abnormal task data; obtains initial task repair data of the abnormal task data from a preset task repair rule library; performs validity evaluation on the initial task repair data to obtain an evaluation effect; wherein the evaluation effect is used to indicate that the initial task repair data is valid or the initial task repair data is invalid; if the evaluation effect is used to indicate that the initial task repair data is valid, the initial task repair data is used as the target task repair data; if the evaluation effect is used to indicate that the initial task repair data is invalid, the target task repair data of the abnormal task data is obtained from existing similar task repair cases through a preset task repair model. The present application first performs structured processing on the original task data, is able to convert unstructured data into structured data, and performs anomaly identification on product transaction tasks based on the structured task data. Without the need for manual intervention in abnormal tasks, the potential problems and risk points of abnormal tasks can be quickly located, thereby facilitating the subsequent improvement of the repair effect of abnormal tasks. Secondly, an effectiveness evaluation is performed on the initial task repair data obtained from the task repair rule library, which helps to determine the effectiveness of the abnormal task to ensure that the repair measures taken are feasible and avoid invalid or erroneous repair attempts. Finally, when the initial task repair data is invalid, the target task repair data of the abnormal task data is obtained from existing similar task repair cases through the task repair model, and the reliability of repairing abnormal tasks is improved by combining historical data. Without the need for manual intervention in the repair of abnormal tasks, the abnormal task can be automatically repaired, thereby improving the repair effect of abnormal tasks.

[0190] See also Figure 8 The embodiment of the present application further provides a log-based abnormal task repairing device, which can implement the above-mentioned log-based abnormal task repairing method, and the device includes:

[0191] A task data acquisition module is used to acquire original task data including original transaction logs according to a preset product transaction task;

[0192] A structured processing module is used to perform structured processing on the original task data to obtain structured task data containing the original transaction log;

[0193] An abnormality identification module is used to identify abnormalities of product transaction tasks based on structured task data to obtain abnormal task data;

[0194] An initial repair data acquisition module is used to obtain initial task repair data of abnormal task data from a preset task repair rule library;

[0195] The validity evaluation module is used to evaluate the validity of the initial task repair data to obtain an evaluation result; wherein the evaluation result is used to indicate that the initial task repair data is valid or invalid;

[0196] A repair data acquisition module is used to use the initial task repair data as the target task repair data if the evaluation result indicates that the initial task repair data is valid; if the evaluation result indicates that the initial task repair data is invalid, the target task repair data of the abnormal task data is obtained from the existing similar task repair cases through a preset task repair model.

[0197] The specific implementation of the log-based abnormal task repairing device is basically the same as the specific implementation of the log-based abnormal task repairing method described above, and will not be repeated here.

[0198] The embodiment of the present application also provides an electronic device, the electronic device includes a memory and a processor, the memory stores a computer program, and the processor implements the above-mentioned log-based abnormal task repair method when executing the computer program. The electronic device can be any intelligent terminal including a tablet computer, a car computer, etc.

[0199] See also Fig. 9 , Fig. 9 The hardware structure of an electronic device of another embodiment is illustrated, and the electronic device includes:

[0200] The processor 901 may be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of the present application.

[0201] The memory 902 can be implemented in the form of a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 902 can store processing systems and other applications. When the technical solution provided in the embodiment of this specification is implemented by software or firmware, the relevant program code is stored in the memory 902, and the processor 901 calls and executes the log-based abnormal task repair method of the embodiment of this application;

[0202] Input / output interface 903, used to implement information input and output;

[0203] Communication interface 904, used to realize communication interaction between the device and other devices, which can be realized through wired mode (such as USB, network cable, etc.) or wireless mode (such as mobile network, WI FI, Bluetooth, etc.);

[0204] A bus 905 that transmits information between various components of the device (e.g., the processor 901, the memory 902, the input / output interface 903, and the communication interface 904);

[0205] The processor 901 , the memory 902 , the input / output interface 903 and the communication interface 904 are connected to each other in communication within the device via a bus 905 .

[0206] An embodiment of the present application also provides a computer-readable medium, which stores a computer program. When the computer program is executed by a processor, the above-mentioned log-based abnormal task repair method is implemented.

[0207] The memory, as a non-transitory computer-readable medium, can be used to store non-transitory software programs and non-transitory computer executable programs. In addition, the memory may include a high-speed random access memory, and may also include a non-transitory memory, such as at least one disk storage device, a flash memory device, or other non-transitory solid-state storage device. In some embodiments, the memory may optionally include a memory remotely disposed relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0208] The log-based abnormal task repair method, log-based abnormal task repair device, electronic device and medium provided in the embodiments of the present application obtain original task data including original transaction log according to preset product transaction task; perform structured processing on the original task data to obtain structured task data including original transaction log; perform abnormal identification on the product transaction task based on the structured task data to obtain abnormal task data; obtain initial task repair data of the abnormal task data from a preset task repair rule library; perform validity evaluation on the initial task repair data to obtain evaluation effect; wherein the evaluation effect is used to indicate that the initial task repair data is valid or the initial task repair data is invalid; if the evaluation effect is used to indicate that the initial task repair data is valid, the initial task repair data is used as the target task repair data; if the evaluation effect is used to indicate that the initial task repair data is invalid, the target task repair data of the abnormal task data is obtained from existing similar task repair cases through a preset task repair model. The present application first performs structured processing on the original task data, is able to convert unstructured data into structured data, and performs anomaly identification on product transaction tasks based on the structured task data. Without the need for manual intervention in abnormal tasks, the potential problems and risk points of abnormal tasks can be quickly located, thereby facilitating the subsequent improvement of the repair effect of abnormal tasks. Secondly, an effectiveness evaluation is performed on the initial task repair data obtained from the task repair rule library, which helps to determine the effectiveness of the abnormal task to ensure that the repair measures taken are feasible and avoid invalid or erroneous repair attempts. Finally, when the initial task repair data is invalid, the target task repair data of the abnormal task data is obtained from existing similar task repair cases through the task repair model, and the reliability of repairing abnormal tasks is improved by combining historical data. Without the need for manual intervention in the repair of abnormal tasks, the abnormal task can be automatically repaired, thereby improving the repair effect of abnormal tasks.

[0209] The embodiments described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application and do not constitute a limitation on the technical solutions provided in the embodiments of the present application. Those skilled in the art will appreciate that with the evolution of technology and the emergence of new application scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0210] Those skilled in the art will appreciate that the technical solutions shown in the figures do not constitute a limitation on the embodiments of the present application, and may include more or fewer steps than shown in the figures, or a combination of certain steps, or different steps.

[0211] The device embodiments described above are merely illustrative, and the units described as separate components may or may not be physically separated, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0212] Those skilled in the art will appreciate that all or some of the steps in the methods disclosed above, and the functional modules / units in the systems and devices may be implemented as software, firmware, hardware, or a suitable combination thereof.

[0213] The terms "first", "second", "third", "fourth", etc. (if any) in the specification of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0214] It should be understood that in the present application, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the objects associated before and after are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0215] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the above units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. The mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0216] The units described above as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0217] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0218] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a medium, including multiple instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of various embodiments of the present application. The aforementioned media include: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc., various media that can store programs.

[0219] The preferred embodiments of the present invention are described above with reference to the accompanying drawings, but the scope of the rights of the present invention is not limited thereto. Any modification, equivalent substitution and improvement made by a person skilled in the art without departing from the scope and essence of the present invention should be within the scope of the rights of the present invention.

Claims

1. A log-based abnormal task repair method, characterized in that: The method comprises: Obtaining original task data including original transaction logs according to preset product transaction tasks; Performing structured processing on the original task data to obtain structured task data including the original transaction log; Based on the structured task data, anomaly identification is performed on the product transaction task to obtain abnormal task data; Acquire initial task repair data of the abnormal task data from a preset task repair rule library; Performing validity evaluation on the initial task repair data to obtain an evaluation result; wherein the evaluation result is used to indicate that the initial task repair data is valid or that the initial task repair data is invalid; If the evaluation result is used to indicate that the initial task repair data is valid, the initial task repair data is used as the target task repair data; If the evaluation result is used to indicate that the initial task repair data is invalid, the target task repair data of the abnormal task data is obtained from existing similar task repair cases through a preset task repair model.

2. The method according to claim 1, characterized in that The performing effectiveness evaluation on the initial task repair data to obtain an evaluation result includes: Obtaining an initial repair transaction log of the initial task repair data; Determine the repair accuracy and the repair recall of the initial task repair data according to the original transaction log and the initial repair transaction log; Scoring the repair effect of the initial task repair data according to the repair accuracy and the repair recall rate to obtain a repair effectiveness score; The effectiveness of the repair effectiveness score is evaluated according to a preset effectiveness threshold to obtain the evaluation effect.

3. The method according to claim 1, characterized in that The step of obtaining the initial task repair data of the abnormal task data from a preset task repair rule library includes: Constructing an abnormal query statement according to the abnormal task data; Acquire an abnormal task rule matching the abnormal task data from the task repair rule library according to the abnormal query; Initial task repair data of the abnormal task data is acquired from the task repair rule library based on the abnormal task rule.

4. The method according to claim 1, characterized in that: The step of obtaining target task repair data of the abnormal task data from existing similar task repair cases by using a preset task repair model includes: Using the task repair model to extract features from the abnormal task data to obtain abnormal task features; Finding similar abnormal task features of the abnormal task features from existing similar abnormal task cases; Performing an abnormality cause query on the abnormal task feature according to the similar abnormal task feature to obtain the task abnormality cause; The target task repair data is obtained from existing similar task repair cases according to the task abnormality cause.

5. The method according to claim 1, characterized in that The performing abnormal identification on the product transaction task based on the structured task data to obtain abnormal task data includes: Obtaining original transaction log features of the structured task data; Assigning the original transaction log features to the nearest preset cluster center for clustering to obtain clustered transaction log features; Obtaining the average cluster distance between all the clustered transaction log features and the preset cluster center; Identifying the characteristic abnormality of the clustered transaction log characteristics according to the cluster average distance; The product transaction task is identified as abnormal according to a preset abnormality degree threshold and the characteristic abnormality degree to obtain the abnormal task data.

6. The method according to claim 5, characterized in that The obtaining of original transaction log features of the structured task data includes: Dividing the original transaction log by using a preset sliding window to obtain an original transaction log sequence; Obtaining log events of the original transaction log sequence; Log feature extraction is performed on the structured task data according to the log event and the original transaction log sequence to obtain the original transaction log feature.

7. The method according to any one of claims 1 to 6, characterized in that: The original task data is subjected to structural processing to obtain structured task data containing the original transaction log, and the method further comprises: Obtaining an original transaction log parse tree of the original task data; Obtaining a log token of the original transaction log, and obtaining a log token length of the log token; Performing event grouping on each tree node in the original transaction log parsing tree based on the log token and the log token length to obtain a grouped transaction log; Matching the grouped transaction log with a preset log template to obtain a matching event transaction log; The matching event transaction log is structured to obtain structured task data containing the original transaction log.

8. A log-based abnormal task repair device, characterized in that: The device comprises: A task data acquisition module is used to acquire original task data including original transaction logs according to a preset product transaction task; A structured processing module, used for performing structured processing on the original task data to obtain structured task data including the original transaction log; An abnormality identification module, used to identify abnormalities of the product transaction task based on the structured task data to obtain abnormal task data; An initial repair data acquisition module, used to acquire initial task repair data of the abnormal task data from a preset task repair rule library; A validity evaluation module, used to evaluate the validity of the initial task repair data to obtain an evaluation result; wherein the evaluation result is used to indicate that the initial task repair data is valid or the initial task repair data is invalid; A repair data acquisition module is used to use the initial task repair data as target task repair data if the evaluation result is used to indicate that the initial task repair data is valid; if the evaluation result is used to indicate that the initial task repair data is invalid, obtain the target task repair data of the abnormal task data from existing similar task repair cases through a preset task repair model.

9. An electronic device, characterized in that: The electronic device includes a memory and a processor, the memory stores a computer program, and the processor implements the log-based abnormal task repair method according to any one of claims 1 to 7 when executing the computer program.

10. A computer-readable medium storing a computer program, characterized in that: When the computer program is executed by a processor, the log-based abnormal task repair method according to any one of claims 1 to 7 is implemented.

Images