Index anomaly positioning method and device based on feature analysis and storage medium

Abstract

The invention discloses an index anomaly positioning method and device based on feature analysis and a storage medium, and the method comprises the steps: obtaining the real-time index data of a charging system, carrying out the application scene analysis of the real-time index data, extracting the real-time feature attribute of the application scene of the real-time index data, and obtaining the real-time feature attribute of the application scene of the real-time index data; the real-time index data and the feature attributes are stored in an index library, and the real-time feature attributes are extracted through application scene analysis, so that the accuracy of anomaly detection of the real-time index data can be improved; the time sequence data and the time sequence characteristic attributes are subjected to characteristic analysis processing through the AIOps brain, the algorithm atomic capability of the anomaly detection model capability service is called to detect whether the real-time index data have abnormal points or not, when the abnormal points exist, the abnormal points are pushed to a monitoring system, and compared with an existing scheme of manually pre-defining rules, the real-time index data can be monitored more accurately. According to the invention, anomaly detection can be automatically carried out through the AIOps brain, and the anomaly detection operation and maintenance requirements under the business expansion condition can be met.

Description

Technical Field

[0001] The present invention relates to the field of computers, and in particular to a method, a device and a storage medium for locating anomalies of indicators based on feature analysis. Background Art

[0002] Nowadays, with the development of computer technology, the billing system is automated in operation and maintenance. The existing billing system mainly automatically triggers and executes common and repetitive anomaly detection and other operation and maintenance tasks through predefined rules specified by operation experts based on operation and maintenance experience. With the rapid expansion of business and the complexity and diversity of application clusters and service clusters, the predefined rules specified by operation experts have gradually become incapable of meeting the needs. The existing automated operation and maintenance methods cannot meet the growing operation and maintenance needs of business monitoring and system indicator monitoring. Therefore, new operation and maintenance solutions such as anomaly detection are needed. Summary of the invention

[0003] In view of this, in order to solve at least one of the above technical problems, an object of the present invention is to provide a method, device and storage medium for locating indicator anomalies based on feature analysis.

[0004] The embodiment of the present invention provides a method for locating anomalies of indicators based on feature analysis, including:

[0005] Obtain real-time indicator data of the billing system;

[0006] Performing application scenario analysis on the real-time indicator data, extracting real-time characteristic attributes of the application scenario of the real-time indicator data, and storing the real-time indicator data and the characteristic attributes in an indicator library; the indicator library has time series data including the real-time indicator data and time series characteristic attributes including the real-time characteristic attributes;

[0007] The AIOps brain performs feature analysis on the time series data and the time series feature attributes, and calls the algorithm atomic capability of the anomaly detection model capability service to detect whether there are abnormal points in the real-time indicator data. If there are abnormal points, they are pushed to the monitoring system.

[0008] Further, the performing application scenario analysis on the real-time indicator data to extract real-time characteristic attributes of the application scenario of the real-time indicator data includes:

[0009] Obtaining business promotion information, and determining a promotion activity cycle according to the business promotion information;

[0010] The real-time indicator data is subjected to time feature analysis according to the promotion activity cycle, and the real-time feature attributes of the application scenario of the real-time indicator data are extracted.

[0011] Furthermore, the feature analysis and processing of the time series data and the time series feature attributes is performed through the AIOps brain, and the algorithm atomic capabilities of the anomaly detection model capability service are called, including:

[0012] Push the time series data and the time series feature attributes to the AIOps brain via a Kafka queue;

[0013] The AIOps brain receives the time series data and the time series feature attributes, performs pre-processing and classification processing, and calls the algorithm atomic capability of the anomaly detection model capability service according to the classification processing result.

[0014] Further, the time series data is filled in the nearest place or in the same period by using the fillna function, wherein the nearest filling is: calculating the mean of the first preset number of data of the missing position in the time series data, and filling the missing position with the mean; the same period filling is: dividing the time series data into a certain number of periods by a preset time length, determining the target period where the missing position is located, and filling the missing position with the data in the target period;

[0015] Marking the outlier value of the time series feature attribute as a preset value and storing it in a feature label library;

[0016] The normal distribution of the time series data after the nearest filling or the same period filling is determined by the n-sigma algorithm, and the data beyond the normal distribution is deleted to obtain the preprocessed time series data.

[0017] Furthermore, the classification process includes:

[0018] Perform data standardization on the preprocessed time series data;

[0019] The dimensionality reduction processing is performed on the data standardization processing results, and the dimensionality reduction processing results are input into the classifier for classification processing, so as to classify the pre-processed time series data into three types: periodicity, stationarity and irregularity.

[0020] Furthermore, the algorithm atomic capability of calling the anomaly detection model capability service according to the classification processing result includes:

[0021] Performing feature analysis according to the classification processing result to extract time dimension features, converting the time dimension features into feature codes of binary variables and performing feature standardization to obtain a feature set;

[0022] The anomaly detection model capability service is called according to the feature set to determine a target anomaly detection model from at least one anomaly detection model in the anomaly detection model library to call the algorithm atomic capability.

[0023] Furthermore, the anomaly detection model is trained by the following steps:

[0024] Obtain time series sample training data;

[0025] Performing feature standardization and PCA dimension reduction processing on the time series sample training data to obtain a first feature, performing date feature extraction on the time series sample training data to obtain a second feature, performing lag feature extraction and window statistical feature extraction on the time series sample training data to obtain a third feature, and storing the first feature, the second feature and the third feature in the feature label library;

[0026] The model process is orchestrated through the algorithm atomic capabilities and scenarios, and the model is trained according to the process orchestration results and the content in the feature tag library to obtain an anomaly detection model.

[0027] The embodiment of the present invention further provides an indicator abnormality location device based on feature analysis, comprising:

[0028] The acquisition module is used to obtain real-time indicator data of the billing system;

[0029] An analysis module, used to perform application scenario analysis on the real-time indicator data, extract real-time characteristic attributes of the application scenario of the real-time indicator data, and store the real-time indicator data and the characteristic attributes in an indicator library; the indicator library has time series data including the real-time indicator data and time series characteristic attributes including the real-time characteristic attributes;

[0030] The detection module is used to perform feature analysis and processing on the time series data and the time series feature attributes through the AIOps brain, call the algorithm atomic capability of the anomaly detection model capability service to detect whether there are abnormal points in the real-time indicator data, and push them to the monitoring system when there are abnormal points.

[0031] An embodiment of the present invention also provides an indicator anomaly locating device based on feature analysis, the indicator anomaly locating device based on feature analysis includes a processor and a memory, the memory stores at least one instruction, at least one program, code set or instruction set, the at least one instruction, the at least one program, the code set or instruction set is loaded and executed by the processor to implement the method.

[0032] An embodiment of the present invention also provides a computer-readable storage medium, in which at least one instruction, at least one program, a code set or an instruction set is stored, and the at least one instruction, the at least one program, the code set or the instruction set is loaded and executed by a processor to implement the method.

[0033] The beneficial effects of the present invention are:

[0034] By acquiring the real-time indicator data of the billing system, performing application scenario analysis on the real-time indicator data, extracting the real-time characteristic attributes of the application scenario of the real-time indicator data, and storing the real-time indicator data and the characteristic attributes in the indicator library, extracting the real-time characteristic attributes through application scenario analysis is beneficial to improving the accuracy of anomaly detection of real-time indicator data; performing feature analysis and processing on the time series data and the time series characteristic attributes through the AIOps brain, calling the algorithm atomic capability of the anomaly detection model capability service to detect whether there are anomalies in the real-time indicator data, and pushing anomalies to the monitoring system when there are anomalies, compared with the existing solution of manually predefined rules, it can automatically perform anomaly detection through the AIOps brain, which is beneficial to meeting the anomaly detection operation and maintenance needs under business expansion conditions.

[0035] For better understanding and implementation, the present invention is described in detail below with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1 It is a schematic diagram of the steps of the method for locating abnormal indicators based on feature analysis of the present invention;

[0037] FIG2(a) is a schematic diagram of a periodic type of a specific embodiment of the present invention, FIG2(b) is a schematic diagram of a stationary type of a specific embodiment of the present invention, and FIG2(c) is a schematic diagram of an irregular type of a specific embodiment of the present invention;

[0038] Figure 3 It is a schematic diagram of the basic characteristics of date according to a specific embodiment of the present invention. DETAILED DESCRIPTION

[0039] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0040] The terms "first", "second", "third" and "fourth" etc. in the specification and claims of the present application and the drawings are used to distinguish different objects, rather than to describe a specific order. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not limited to the listed steps or units, but optionally includes steps or units that are not listed, or optionally includes other steps or units inherent to these processes, methods, products or devices.

[0041] Reference to "embodiments" herein means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0042] like Figure 1 As shown, an embodiment of the present invention provides an indicator abnormality location method based on feature analysis, including steps S100-S300:

[0043] S100. Obtain real-time indicator data of the billing system.

[0044] In an embodiment of the present invention, by connecting to the monitoring system corresponding to the billing system, all indicator data of the billing system are obtained for indicator access, so that real-time indicator data and historical indicator data are stored in the indicator library. The update frequency of real-time indicator data includes but is not limited to a minimum of 1 minute. When the indicator is accessed, the data source is registered. For example, the monitoring system can be one of the data sources. The data sources are isolated from each other and can push indicator data queue information in real time and store it in the indicator library. Optionally, real-time indicator data and historical indicator data can include indicator values, indicator dimensions, data frequency and other information. For example, a billing call sheet can include the processing volume of the billing call sheet. The dimensions can include the time, service node, and service name of the billing call sheet. The indicators include TPS, number of calls, etc. Table 1 shows examples of indicator values ​​and dimensions of billing call sheets:

[0045] Table 1

[0046] Province Code Dimensions Local Network Dimensions node Dimensions Area Dimensions Business Type Dimensions Batch identification Dimensions Input call order number in the quotation module Index value The batch price module outputs the normal number of orders Index value The number of wrong call orders output by the pricing module Index value The batch price module outputs no main call number Index value Price start time Dimensions End time of quotation Dimensions

[0047] S200: Analyze the application scenarios of the real-time indicator data, extract the real-time characteristic attributes of the application scenarios of the real-time indicator data, and store the real-time indicator data and the characteristic attributes into an indicator library.

[0048] Optionally, performing application scenario analysis on the real-time indicator data in step S200 to extract real-time characteristic attributes of the application scenario of the real-time indicator data includes steps S210-S220:

[0049] S210: Obtain business promotion information, and determine a promotion activity cycle according to the business promotion information.

[0050] In an embodiment of the present invention, business promotion messages are obtained, such as market promotion conditions (a service provider has a promotional activity: such as recharge 100 and get 50), and the call index value of the recharge service during the activity will definitely exceed the daily level. Therefore, business promotion messages are needed to determine the promotion activity cycle to analyze the index data, thereby ensuring that the index data can be effectively analyzed in daily scenarios as well as promotional application scenarios.

[0051] S220: Perform time feature analysis on the real-time indicator data according to the promotion activity cycle, and extract real-time feature attributes of application scenarios of the real-time indicator data.

[0052] Optionally, time characteristic analysis is performed on the real-time indicator data according to the promotion activity cycle, so as to extract the real-time characteristic attributes corresponding to the application scenarios of the daily cycle and the application scenarios of the promotion activity cycle in the real-time indicator data, and extract different real-time characteristic attributes reflecting the characteristics of the real-time indicator data in different application scenarios, and store them in the indicator library.

[0053] It should be noted that the indicator library contains time series data including real-time indicator data and time series feature attributes including real-time feature attributes. Both time series data and time series feature attributes can be automatically encoded into Python objects and json strings using json.dumps and json.loads, and stored in the indicator library.

[0054] S300, through the AIOps brain, performs feature analysis and processing on time series data and time series feature attributes, calls the algorithm atomic capability of the anomaly detection model capability service to detect whether there are abnormal points in the real-time indicator data, and pushes them to the monitoring system when there are abnormal points.

[0055] In the embodiment of the present invention, the AIOps brain can perform indicator anomaly detection. The AIOps brain has functions such as data preprocessing, data classification, feature analysis, experimental training, anomaly detection, and algorithm atomic capabilities. The AIOps brain is used to detect indicators of time series data and monitor indicators in real time through feature analysis and machine algorithms.

[0056] Optionally, in step S300, the AIOps brain performs feature analysis on the time series data and the time series feature attributes, and calls the algorithm atomic capability of the anomaly detection model capability service, including steps S301-S302:

[0057] S301. Push time series data and time series feature attributes to the AIOps brain using the Kafka queue.

[0058] In an embodiment of the present invention, time series data and time series feature attributes can be pushed to the AIOps brain via a monitoring system or an indicator library using a Kafka queue to trigger the real-time detection link of the real-time detection function.

[0059] S302: Receive time series data and time series feature attributes through the AIOps brain, perform pre-processing and classification processing, and call the algorithm atomic capability of the anomaly detection model capability service according to the classification processing results.

[0060] Optionally, in the real-time detection phase, the AIOps brain receives time series data and time series feature attributes, performs pre-processing and classification, and calls the algorithm atomic capability of the anomaly detection model capability service based on the classification processing results.

[0061] Optionally, the preprocessing in step S302 includes S3021-S3023:

[0062] S3021. Use the fillna function to perform nearby filling or same-cycle filling on the time series data, where nearby filling is: calculating the mean of the first preset number of data in the missing position in the time series data, and filling the mean into the missing position; same-cycle filling is: dividing the time series data into a certain number of periods according to a preset time length, determining the target period where the missing position is located, and filling the missing position with the data in the target period.

[0063] Optionally, for a complete time series data, the missing value is 0. If the time series data is missing time point data, the missing value needs to be filled. If the missing value is deleted or ignored, it will cause a difference in the data time connection between the missing value and the real data set, so the missing value filling process needs to be performed. Specifically, use pandas data loading, and use the fillna function to fill the missing value. The missing value filling process can include nearby filling or same period filling. Specifically, fillna(method='ffill',inplace=True) is used to fill the missing value, and data.median() is used to fill the missing value and repair the outliers.

[0064] Among them, the nearest filling is: calculating the mean of the preset number of data before the missing position in the time series data, and filling the mean to the missing position. For example, using forward fill, find the missing position in the time series data, and then calculate the mean of the preset number of data before the missing position in the time series data, and fill the mean to the missing position; the preset number can be set according to actual needs.

[0065] Among them, the same cycle filling is: divide the time series data into a certain number of periods by a preset time length, determine the target period where the missing position is located, and fill the missing position with the data in the target period. It should be noted that since the closer the time series data position is, the more important the data is, such as the more reasonable the data filling of the previous period and the period before that, the time series data can be divided into a certain number of periods by a preset time length including but not limited to 7 days, and then find the missing position, determine the target period where the missing position is located, and finally fill the missing position with the data in the target period. Optionally, the first average value can be calculated using the data in the target period, or the second average value can be calculated using the data after the missing position in the target period, and the missing position can be filled with the first average value or the second average value, without specific limitation.

[0066] It should be noted that the conventional practice for filling missing values ​​is to fill the missing values ​​with the mean / mode of historical data or nearby periods. Since time series data is sensitive to the location of the data, and the various indicator data in the billing system have periodicity and trends, if the conventional practice is adopted, the periodicity will be disrupted and the accuracy of the time series data will be affected. Therefore, this solution adopts the nearest filling and the same period filling to minimize the deviation of missing values ​​and improve accuracy.

[0067] S3022. Mark the outlier value of the time series feature attribute as a preset value and store it in a feature label library.

[0068] Optionally, since time series data may contain abnormal data, if these abnormal data are not processed, it will lead to incorrect calculation of subsequent models. Therefore, the embodiment of the present invention combines the billing system with relevant useful information processing when processing abnormal values. Specifically, special event labeling is performed: this processing method is caused by the existing abnormalities in the data and the system business background, such as abnormalities caused by promotional activities in certain time periods. Therefore, it is necessary to label the data according to the abnormalities caused by known factors, and produce a feature item to specifically handle these abnormal values ​​(outliers) caused by promotional activities. The outliers of the time series feature attributes are marked as preset values, such as 1, indicating the occurrence of special events such as promotional activities, and other abnormal points are marked as 0 for abnormal push, which are all stored in the feature label library as samples in the time series sample training data. When the model is trained later, this information in the feature label library will be used and different weight coefficients of 1 and 0 will be assigned for training, thereby improving the effect of model training.

[0069] S3023. Determine the normal distribution of the time series data after the nearest filling or the same period filling through the n-sigma algorithm, delete the data beyond the normal distribution, and obtain the preprocessed time series data.

[0070] Optionally, the normal distribution of the time series data after the nearest filling or the same period filling is determined by the n-sigma algorithm. For example, in the normal distribution, σ represents the standard deviation, μ represents the mean, the probability of the value being distributed in (μ—σ, μ+σ) is 0.6526, the probability of the value being distributed in (μ—2σ, μ+2σ) is 0.9544, and the probability of the value being distributed in (μ—3σ, μ+3σ) is 0.9974. The stddev function of Spark SQL is used to calculate the high / low values ​​to determine the normal distribution. When the data exceeds the normal distribution, it is identified as an outlier and deleted to obtain the preprocessed time series data.

[0071] Optionally, the classification process in step S302 includes S3024-S3025:

[0072] S3024. Perform data standardization on the preprocessed time series data.

[0073] S3025. Perform dimensionality reduction processing on the data standardization processing result, and input the dimensionality reduction processing result into a classifier for classification processing, so as to classify the pre-processed time series data into three types: periodicity, stationarity and irregularity.

[0074] In the embodiment of the present invention, for example, the pre-processed time series data can be standardized by StandardScaler feature standardization, and then the data standardization result is reduced in dimension, and finally the dimension reduction result is input into the classifier for classification, so as to classify the pre-processed time series data into three types: periodicity, stability and irregularity, as shown in Figure 2 (a), Figure 2 (b) and Figure 2 (c), respectively. In the business indicator monitoring of the billing system, there are many periodic wave types, including call list processing indicators, data processing indicators, cost indicators and other core indicators are all periodic. Optionally, the classifier is implemented by CNN (convolutional neural network), by window data processing of the training data, converting it into a graphic format, loading the training data and test data after window data processing, constructing a CNN model model = Sequential(), compiling the model model.compile, training the model model.fit(), using the test data to test the trained model to predict model.predict_classes(X_new) and judge the indicator type, until the requirements are met to obtain the final model, i.e., the classifier.

[0075] Optionally, the algorithm atomic capability of calling the anomaly detection model capability service according to the classification processing result in step S302 includes S3026-S3027:

[0076] S3026. Perform feature analysis based on the classification processing results to extract time dimension features, convert the time dimension features into feature codes of binary variables and perform feature standardization to obtain a feature set.

[0077] Optionally, the real-time detection stage also includes feature analysis based on the classification processing results, specifically using Pandas, holidays, numpy, and sklearn libraries to achieve feature extraction and selection of time dimension features. The time dimension features include but are not limited to timestamp, month, day of the week, whether it is a working day, holiday, promotion day, etc., and use numpy's concatenate to convert the time dimension features into feature encodings of binary variables. The features are standardized through StandardScaler's fit_transform to obtain a feature set with a simplified dimension.

[0078] S3027. Call the anomaly detection model capability service according to the feature set to determine a target anomaly detection model from at least one anomaly detection model in the anomaly detection model library to call the algorithm atomic capability.

[0079] In the embodiment of the present invention, after obtaining the feature set, the experimental training phase is entered, and several anomaly detection models are trained in advance and stored in the anomaly detection model library in the experimental training phase. Specifically, in the experimental training phase, the anomaly detection model capability service is called according to the feature set, and the target anomaly detection model is determined from at least one anomaly detection model in the anomaly detection model library to call the algorithm atomic capability, thereby performing anomaly detection and detecting whether there are anomalies in the real-time indicator data. If anomalies are detected in the real-time indicator data, the anomalies are pushed to the monitoring system for timely discovery by the monitoring personnel, thereby realizing automated anomaly monitoring.

[0080] Optionally, the algorithm atomic capabilities include, but are not limited to, the Isolation Forest algorithm of the sklearn library, StandardScaler, the Sequential CNN model of the Keras library, xgboost, TF-IDF, GBDT, ARIMA, etc. Exemplarily, the target anomaly detection model used can identify abnormal data through the isolation forest algorithm, judge the abnormal point according to the outlier degree score of the indicator point, and combine the algorithm atomic capabilities of the IsolationForest model library of sklearn, fit_predict(features) of the model fitting and prediction result y_pred according to the feature set, and find outliers of abnormal data points marked with y_pred as -1.

[0081] Optionally, the number of target anomaly detection models can be one or more, for example, it can include target anomaly detection models for detecting three types of periodicity, stationarity and irregularity respectively, or it can include target anomaly detection models that can universally detect three types of periodicity, stationarity and irregularity, without specific limitation.

[0082] It should be noted that the storage layer of the PAAS component (Platform as a Service) is provided in the embodiment of the present invention, and different storage components are used according to different types of data. Among them, the storage layer is provided with an indicator library (including an indicator database and a time series database TSDB), a distributed queue and a feature tag library. The indicator database and the tag library can realize distributed storage, the indicator database can store the accessed indicator data, the time series database TSDB in the indicator library is used to store time series data and time series feature attributes, and the distributed message queue is mainly used for real-time indicator push, real-time detection of abnormal points and other data push, so as to make the whole system data more stable, data response faster, and user experience better.

[0083] Optionally, the open source technology and algorithm components of the embodiments of the present invention include but are not limited to Python, pyspark.sql, pyspark.ml, pandas, keras, Hbase, Hdfs, Hive, Kafka, etc.

[0084] Optionally, the experimental training function can manage samples of time series data, register algorithm atomic capabilities, orchestrate model processes, train and evaluate models, and publish models.

[0085] Optionally, the anomaly detection model is trained by the following steps S310-S330:

[0086] S310: Obtain time series sample training data.

[0087] Optionally, the time series sample training data may include historical time series data, which includes historical time series data and historical feature attributes, which are also stored in the time series database TSDB of the indicator library, and the historical time series data may have corresponding real labels to distinguish positive samples from negative samples. It is understandable that the historical feature attributes are also obtained by analyzing the application scenarios of the historical indicator data.

[0088] S320, perform feature standardization and PCA dimension reduction on the time series sample training data to obtain a first feature, perform date feature extraction on the time series sample training data to obtain a second feature, perform lag feature extraction on the time series sample training data and perform window statistics to obtain a third feature, and store the first feature, the second feature, and the third feature in a feature tag library. Optionally, the window statistics include but are not limited to sliding window statistics features over partition by statistics window period AVG, STD, MAX and other indicators.

[0089] Optionally, after obtaining the time series sample training data, preprocessing is required, such as performing StandardScaler feature standardization on the time series sample training data and PCA dimensionality reduction processing on the data to obtain the first feature and store it in the feature label library; wherein the PCA dimensionality reduction processing includes obtaining the data variance matrix, calculating the eigenvalues ​​and vectors of the variance matrix, obtaining the main characteristic vector in the vector according to the eigenvalue size, and generating a new feature, i.e., the first feature, by specifying the dimension. Then, date feature extraction is performed on the time series sample training data, such as obtaining the basic date features of the time series data through Pandas. The basic date features are as follows: Figure 3 As shown in the figure, the time series sample training data is disassembled according to the basic characteristics of the date, and the date judgment class features and holiday processing Prophet library are used to generate new features, namely the second features, in the specified dimensions.

[0090] Optionally, statistical feature extraction is performed on the time series sample training data: a third feature is obtained through lag feature extraction and window statistical feature extraction, and the first feature, the second feature and the third feature are stored in a feature label library.

[0091] S330, orchestrate the model's process through the algorithm's atomic capabilities and scenarios, train the model based on the process orchestration results and the content in the feature tag library, and obtain an anomaly detection model.

[0092] Optionally, the model process is orchestrated through the atomic capabilities of the algorithm that has been installed and the specific application scenarios. According to the process orchestration results, the information of outliers in the feature label library, the weight coefficient, the first feature, the second feature and the third feature, etc., the model is trained offline and the model parameters are adjusted to obtain the anomaly detection model. The arranged detection process is used to perform simulated detection and test the anomaly detection effect. After model evaluation, the evaluated anomaly detection model is put into the formal anomaly detection model library to provide services for real-time anomaly detection of indicators.

[0093] Compared with the prior art, the indicator anomaly locating method based on feature analysis in the embodiment of the present invention is:

[0094] 1) Enable the operation and maintenance of the billing system to move from the manual + automation mode to the "automation + AIOps" mode;

[0095] 2) Based on AIOps-related technologies and algorithms, the indicator data of the billing system can be detected and predicted in real time, and the fault problems of the billing system can be accurately identified and abnormal points can be located. For example, the TPS performance of the system processing call data is intelligently monitored. Since the TPS of call data processing belongs to time series data, the method of the present invention can be used to extract abnormal indicator data and predict indicator trends based on feature analysis to meet the health monitoring of the system;

[0096] 3) Based on the billing system indicator data, the scientific and innovative trial of intelligent operation (AIOps) has realized the detection of abnormal points in the indicator time series data. Through the feature analysis of the indicator time series data, the abnormal points in the time series data are extracted to solve the false alarms caused by the previous fixed threshold of the indicator. With the growth of business, the cluster processing capacity can be intelligently analyzed and detected.

[0097] 4) With the increase of 5G users and the large business, this solution adopts intelligent atomic capability in the pilot of scientific and technological operation monitoring of the billing system. After model training and evaluation, it can be put into production and iterated quickly. It can quickly and elastically expand capacity according to the amount of time series data and channels;

[0098] 5) Use Python, PySpark.sql, pandas, keras, Hbase, HDFS, Kafka and other related technologies, write programs in Python executable language, use PySpark SQL to obtain data, call sklearn and numpy libraries to obtain feature data, use Pandas to derive the time features of time series data, and use the sequential model in the keras framework to implement linear and sequential models;

[0099] 6) Real-time detection based on time series streaming push, anomaly point messaging, algorithm atomic capability, model training and testing through anomaly detection model orchestration and scheduling engine, feature analysis of time series data, parameter tuning, to ensure that each indicator meets the system application scenario, to ensure accuracy of indicator anomaly points, high performance, high reliability, and high availability;

[0100] 7) Fill missing values ​​and handle outliers in time series data. Use Mean and Median filling methods to repair data. Use Spark SQL to find window data. Use over partition by to query each window data to fill missing values. Use the n-sigma algorithm to implement data mean and standard deviation to handle outliers and ensure the completeness and validity of the data.

[0101] The embodiment of the present invention further provides an indicator abnormality location device based on feature analysis, comprising:

[0102] The acquisition module is used to obtain real-time indicator data of the billing system;

[0103] An analysis module is used to perform application scenario analysis on the real-time indicator data, extract the real-time characteristic attributes of the application scenario of the real-time indicator data, and store the real-time indicator data and the characteristic attributes in an indicator library; the indicator library has time series data including the real-time indicator data and time series characteristic attributes including the real-time characteristic attributes;

[0104] The detection module is used to perform feature analysis and processing on time series data and time series feature attributes through the AIOps brain, and call the algorithm atomic capabilities of the anomaly detection model capability service to detect whether there are abnormal points in the real-time indicator data, and push them to the monitoring system when there are abnormal points.

[0105] The contents of the above method embodiments are all applicable to the present device embodiments. The functions specifically implemented by the present device embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments, and will not be repeated herein.

[0106] An embodiment of the present invention also provides another indicator anomaly locating device based on feature analysis, which includes a processor and a memory, wherein at least one instruction, at least one program, code set or instruction set is stored in the memory, and the at least one instruction, at least one program, code set or instruction set is loaded and executed by the processor to implement the indicator anomaly locating method based on feature analysis of the aforementioned embodiment.

[0107] The contents of the above method embodiments are all applicable to the present device embodiments. The functions specifically implemented by the present device embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments, and will not be repeated herein.

[0108] An embodiment of the present invention also provides a computer-readable storage medium, in which at least one instruction, at least one program, code set or instruction set is stored, and the at least one instruction, at least one program, code set or instruction set is loaded and executed by a processor to implement the indicator anomaly location method based on feature analysis of the aforementioned embodiment.

[0109] The embodiment of the present invention also provides a computer program product or a computer program, which includes a computer instruction stored in a computer-readable storage medium. The processor of the computer device reads the computer instruction from the computer-readable storage medium, and the processor executes the computer instruction, so that the computer device executes the indicator anomaly location method based on feature analysis of the aforementioned embodiment.

[0110] The terms "first", "second", "third", "fourth", etc. (if any) in the specification of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0111] It should be understood that in the present application, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the objects associated before and after are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0112] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic, for example, the division of units is only a logical function division, and there may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point, the coupling or direct coupling or communication connection between each other shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms. The units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the scheme of this embodiment. In addition, each functional unit in each embodiment of the present application can be integrated in a processing unit, or each unit can exist physically separately, or two or more units can be integrated in one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units.

[0113] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including multiple instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of each embodiment method of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, referred to as ROM), random access memory (Random Access Memory, referred to as RAM), disk or optical disk and other media that can store programs.

[0114] The above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some of the technical features therein by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for locating abnormal indicators based on feature analysis, characterized in that: include: Obtain real-time indicator data of the billing system; Performing application scenario analysis on the real-time indicator data, extracting real-time characteristic attributes of the application scenario of the real-time indicator data, and storing the real-time indicator data and the characteristic attributes in an indicator library; the indicator library has time series data including the real-time indicator data and time series characteristic attributes including the real-time characteristic attributes; The AIOps brain performs feature analysis on the time series data and the time series feature attributes, and calls the algorithm atomic capability of the anomaly detection model capability service to detect whether there are abnormal points in the real-time indicator data. If there are abnormal points, they are pushed to the monitoring system.

2. The method for locating abnormal indicators based on feature analysis according to claim 1, characterized in that: The performing application scenario analysis on the real-time indicator data to extract real-time characteristic attributes of the application scenario of the real-time indicator data includes: Obtaining business promotion information, and determining a promotion activity cycle according to the business promotion information; The real-time indicator data is subjected to time feature analysis according to the promotion activity cycle, and the real-time feature attributes of the application scenario of the real-time indicator data are extracted.

3. The method for locating abnormal indicators based on feature analysis according to claim 1, characterized in that: The feature analysis and processing of the time series data and the time series feature attributes is performed through the AIOps brain, and the algorithm atomic capabilities of the anomaly detection model capability service are called, including: Push the time series data and the time series feature attributes to the AIOps brain via a Kafka queue; The AIOps brain receives the time series data and the time series feature attributes, performs pre-processing and classification processing, and calls the algorithm atomic capability of the anomaly detection model capability service according to the classification processing result.

4. The method for locating abnormal indicators based on feature analysis according to claim 3 is characterized in that: The preprocessing comprises: The fillna function is used to perform nearby filling or same-cycle filling on the time series data, wherein nearby filling is: calculating the mean of the first preset number of data of the missing position in the time series data, and filling the missing position with the mean; same-cycle filling is: dividing the time series data into a certain number of periods according to a preset time length, determining the target period where the missing position is located, and filling the missing position with the data in the target period; Marking the outlier value of the time series feature attribute as a preset value and storing it in a feature label library; The normal distribution of the time series data after the nearest filling or the same period filling is determined by the n-sigma algorithm, and the data beyond the normal distribution is deleted to obtain the preprocessed time series data.

5. The method for locating abnormal indicators based on feature analysis according to claim 4 is characterized in that: The classification process comprises: Perform data standardization on the preprocessed time series data; The dimensionality reduction processing is performed on the data standardization processing results, and the dimensionality reduction processing results are input into the classifier for classification processing, so as to classify the pre-processed time series data into three types: periodicity, stationarity and irregularity.

6. The method for locating abnormal indicators based on feature analysis according to claim 5 is characterized in that: The algorithm atomic capability of calling the anomaly detection model capability service according to the classification processing result includes: Performing feature analysis based on the classification processing results to extract time dimension features, converting the time dimension features into feature codes of binary variables and performing feature standardization to obtain a feature set; The anomaly detection model capability service is called according to the feature set to determine a target anomaly detection model from at least one anomaly detection model in the anomaly detection model library to call the algorithm atomic capability.

7. The method for locating abnormal indicators based on feature analysis according to claim 6 is characterized in that: The anomaly detection model is trained by the following steps: Obtain time series sample training data; Performing feature standardization and PCA dimension reduction processing on the time series sample training data to obtain a first feature, performing date feature extraction on the time series sample training data to obtain a second feature, performing lag feature extraction and window statistical feature extraction on the time series sample training data to obtain a third feature, and storing the first feature, the second feature and the third feature in the feature label library; The model process is orchestrated through the algorithm atomic capabilities and scenarios, and the model is trained according to the process orchestration results and the content in the feature tag library to obtain an anomaly detection model.

8. A device for locating abnormal indicators based on feature analysis, characterized in that: include: The acquisition module is used to obtain real-time indicator data of the billing system; An analysis module, used to perform application scenario analysis on the real-time indicator data, extract real-time characteristic attributes of the application scenario of the real-time indicator data, and store the real-time indicator data and the characteristic attributes in an indicator library; the indicator library has time series data including the real-time indicator data and time series characteristic attributes including the real-time characteristic attributes; The detection module is used to perform feature analysis and processing on the time series data and the time series feature attributes through the AIOps brain, call the algorithm atomic capability of the anomaly detection model capability service to detect whether there are abnormal points in the real-time indicator data, and push them to the monitoring system when there are abnormal points.

9. A device for locating abnormal indicators based on feature analysis, characterized in that: The indicator anomaly locating device based on feature analysis includes a processor and a memory, wherein the memory stores at least one instruction, at least one program, a code set or an instruction set, and the at least one instruction, the at least one program, the code set or the instruction set is loaded and executed by the processor to implement the method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The storage medium stores at least one instruction, at least one program, a code set or an instruction set, and the at least one instruction, the at least one program, the code set or the instruction set is loaded and executed by the processor to implement the method as described in any one of claims 1-7.

Images