Abnormal root cause positioning method and device and electronic equipment

Abstract

The invention discloses an abnormal root cause positioning method, an abnormal root cause positioning device and electronic equipment. The method comprises the steps that a report data set to be subjected to root cause positioning is obtained, the report data set comprises at least one index and a plurality of dimensions, and each dimension comprises a plurality of dimension elements; constructing a root cause positioning tree according to the report data set; and determining an abnormal root cause path corresponding to the report data set according to the root cause positioning tree. According to the method and the device, the technical problem that the root cause positioning of the abnormal index cannot be quickly and accurately implemented in a multi-dimensional data scene in the related technology is solved.

Description

Technical Field

[0001] The present application relates to the field of data analysis, and in particular to a method, device and electronic device for locating an abnormality root cause. Background Art

[0002] In the process of digital transformation of enterprises, various data screens, indicator dashboards, cockpits and other products have quickly become important tools for managers to monitor and optimize operational activities. Most of these products provide the changing trends of key indicators in a visual form, but do not provide capabilities such as indicator anomaly location and correlation analysis. With the increase in indicators and dimensions, managers often need to spend a lot of time to complete anomaly location. Taking multidimensional reports as an example, assuming that there are 10 dimensions in the report, each dimension has 5 elements, and the number of different dimension combinations is 9765625. It is difficult to complete the roll-up and drill-down and comparative analysis of all combinations manually. Therefore, the relevant technology cannot quickly and accurately implement the root cause location of indicator anomalies in multidimensional data scenarios.

[0003] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0004] The embodiments of the present application provide a method, device and electronic device for locating the root cause of anomalies, so as to at least solve the technical problem in the related art that the root cause of indicator anomalies cannot be located quickly and accurately in a multi-dimensional data scenario.

[0005] According to one aspect of an embodiment of the present application, a method for locating an abnormal root cause is provided, comprising: obtaining a report data set for root cause location, wherein the report data set includes at least one indicator and multiple dimensions, and each dimension includes multiple dimensional elements; constructing a root cause location tree based on the report data set; and determining the abnormal root cause path corresponding to the report data set based on the root cause location tree.

[0006] Optionally, a root cause location tree is constructed based on a report data set, including: determining first-level branches of the root cause location tree based on the report data set, wherein the first-level branches include first-dimensional report information that satisfies a first condition in multiple dimensions of the report data set, and the first-level branches are all branches directly connected to the root node of the root cause location tree; determining second-level branches corresponding to dimensional elements in each layer of the root cause location tree after the first-level branches from other dimensional report information in multiple dimensions except the first-dimensional report information; determining tree nodes under the first-level branches and the second-level branches; and determining the root cause location tree based on the root node, the first-level branches, the second-level branches and the tree nodes.

[0007] Optionally, determining the first-level branch of the root cause location tree based on the report data set includes: determining the surprise value, influence value and comprehensive value of all dimensions from the report data set, wherein the surprise value is used to represent the change in the proportion of indicators of the dimensional element of the dimension in the first period and the second period, the first period and the second period are adjacent, and the first period is the next period of the second period, the influence value is used to represent the abnormal situation of the indicator of the dimensional element of the dimension, and the comprehensive value is determined based on the surprise value and the influence value; determining the dimension corresponding to the maximum value of the surprise value among all the surprise values ​​as the first strategy, determining the dimension corresponding to the maximum value of the influence value among all the influence values ​​as the second strategy, and determining the dimension corresponding to the maximum value of the comprehensive value among all the comprehensive values ​​as the third strategy; determining the dimension corresponding to the strategy that meets the first condition from the first strategy, the second strategy and the third strategy as the first-level branch of the root cause location tree.

[0008] Optionally, second-level branches corresponding to dimensional elements in each layer after the first-level branches of the root cause location tree are determined from dimensional report information other than the first-level report information among multiple dimensions, including: determining preliminary candidates based on the criteria of the first strategy, the criteria of the second strategy, and the criteria of the third strategy from the other dimensional report information; deduplicating the dimensions in the preliminary candidates to obtain a candidate set; pre-calculating the candidate dimensions in each candidate set to obtain a potential benefit score corresponding to each candidate dimension; and determining the dimension with the highest benefit score as the second-level branch corresponding to the dimensional element in each layer after the first-level branch.

[0009] Optionally, the candidate dimensions in each candidate set are pre-calculated to obtain the potential benefit score corresponding to each candidate dimension, including: sorting the dimensional elements under each candidate dimension from large to small according to the influence value, and determining the isolation value of each dimensional element in turn starting from the dimensional element with the largest influence value, wherein the isolation value is used to represent the difference in the index value of the dimensional element in the previous and subsequent periods; storing the dimensional elements whose isolation value of each dimensional element under each candidate dimension is greater than the isolation value of the parent node of the corresponding dimensional element and whose explanation value of each dimensional element under each candidate dimension is greater than the first threshold in a temporary set in turn, and stopping when the explanation value of the dimensional element in the temporary set reaches a second threshold, wherein the explanation value is used to represent the proportion of the indicator change of the dimensional element in the first period and the second period, and the parent node is the dimensional element under the branch of the previous layer of the current branch; determining the influence value of the temporary set, and determining the mean of the isolation value of the temporary set; determining the potential benefit score corresponding to each candidate dimension based on the influence value of the temporary set, the mean of the isolation value, the influence value of each candidate dimension and the isolation value of the parent node of the temporary set, wherein the parent node corresponding to each dimensional element under each candidate dimension is the same.

[0010] Optionally, determining the tree nodes under the first-level branches and the second-level branches includes: sorting the dimensional elements under the target branch in descending order according to the influence value, and determining the isolation value of each dimensional element of the target branch starting from the dimensional element with the largest influence value, wherein the isolation value is used to represent the difference in the index value of the dimensional element between the previous and next cycles, and the target branch is any one of the first-level branches and the second-level branches; adding the dimensional elements of the target branch whose isolation value is greater than the isolation value of the parent node of the corresponding dimensional element and whose explanation value of the dimensional element of the target branch is greater than the third threshold to the result set in turn, and stopping until the explanation value of the dimensional element in the result set reaches the fourth threshold, wherein the explanation value is used to represent the proportion of the indicator change of the dimensional element between the first cycle and the second cycle; determining the dimensional elements in the result set as the tree nodes under the target branch in the root cause location tree.

[0011] Optionally, the method further includes: traversing the tree nodes, determining the tree nodes that do not satisfy the second condition as target tree nodes, and continuing to determine branches under the target tree nodes; and determining the tree nodes that satisfy the second condition as leaf nodes.

[0012] Optionally, determining a tree node that meets the second condition as a leaf node includes: obtaining a first index value of the first tree node in the first period, a second index value of the first tree node in the second period, and obtaining a global index value of the first tree node in all periods, wherein the first tree node is any tree node in the root cause location tree; determining a difference between the first index value and the second index value; determining that the first tree node meets the second condition when the ratio of the difference to the global index value is less than or equal to a preset threshold; and determining the first tree node as a leaf node.

[0013] Optionally, determining an abnormal root cause path corresponding to a report data set based on a root cause location tree includes: determining the contribution of all leaf nodes in the root cause location tree, wherein the contribution is the ratio of the sum of the changes in the index values ​​of the leaf nodes in the first period and the second period to the difference between the first index value and the second index value, wherein the first index value is the index value of the leaf node in the first period, and the second index value is the index value of the leaf node in the second period; determining the path of the leaf node in the root cause location tree whose contribution is less than a fifth threshold as an abnormal root cause path; and when the contribution is greater than or equal to the fifth threshold, determining the root cause path in the report data set except for the root cause location tree. The third indicator value of other data in the first period and the fourth indicator value of other data in the second period other than the data corresponding to the root cause path; determine a first difference between the third indicator value and the first indicator value, and determine a second difference between the fourth indicator value and the second indicator value; when the change directions of the first difference and the second difference are inconsistent, the root cause location process ends; when the change directions of the first difference and the second difference are consistent, delete the data used in the root cause location tree from the report data set to obtain the remaining data; continue to build a new root cause location tree based on the remaining data, and initialize the root node and depth of the new root cause location tree.

[0014] Optionally, the method includes: adding all abnormal root cause paths in the root cause location tree to the target result set, and deduplicating the target result set; determining the parent node of each leaf node corresponding to the abnormal root cause path in the target result set; determining the sum of the explanation values ​​of all leaf nodes under the parent node, wherein the explanation value is used to represent the proportion of the indicator change of the dimension element in the first period and the second period; when the sum of the explanation values ​​is less than or equal to a sixth threshold, deleting all abnormal root cause paths associated with the leaf nodes under the parent node from the target result value.

[0015] According to another aspect of an embodiment of the present application, a device for locating an abnormal root cause is also provided, including: an acquisition module, used to acquire a report data set to be root cause located, wherein the report data set includes at least one indicator and multiple dimensions, and each dimension contains multiple dimensional elements; a construction module, used to construct a root cause location tree based on the report data set; and a determination module, used to determine the abnormal root cause path corresponding to the report data set based on the root cause location tree.

[0016] According to another aspect of an embodiment of the present application, an electronic device is provided, including: a memory and a processor, the memory being used to store program instructions; the processor being connected to the memory and being used to execute the method for locating the root cause of the abnormality.

[0017] According to another aspect of the embodiments of the present application, a non-volatile storage medium is provided, which includes a stored computer program, wherein the device where the non-volatile storage medium is located executes the above-mentioned method for locating the root cause of the abnormality by running the computer program.

[0018] According to another aspect of the embodiments of the present application, a computer program product is provided, including computer instructions, which implement the above-mentioned method for locating the root cause of the abnormality when executed by a processor.

[0019] In an embodiment of the present application, by obtaining a report data set to be root-caused, wherein the report data set includes multiple dimensions, each dimension includes at least one indicator and multiple dimensional elements; constructing a root-cause location tree based on the report data set; and determining the abnormal root cause path corresponding to the report data set based on the root cause location tree, the purpose of quickly locating the abnormal cause of the report data is achieved, thereby realizing the technical effect of locating the abnormal root cause in a multi-dimensional data scenario, and further solving the technical problem in the related art that the root cause location of the indicator abnormality cannot be implemented quickly and accurately in a multi-dimensional data scenario. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0021] Figure 1 It is a hardware structure block diagram of a computer terminal for implementing a method for locating an abnormality root cause according to an embodiment of the present application;

[0022] Figure 2 is a flow chart of a method for locating the root cause of an abnormality according to an embodiment of the present application;

[0023] Figure 3 is a schematic diagram of a root cause location tree according to an embodiment of the present application;

[0024] Figure 4 It is a structural diagram of a device for locating the root cause of an abnormality according to an embodiment of the present application. DETAILED DESCRIPTION

[0025] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0026] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0027] Among the related technologies, the Adtributor algorithm proposed by Microsoft mainly solves the problem of how to locate the root cause from multiple dimensions when the KPI indicators in the advertising system fluctuate abnormally. This method does not consider the situation of cross-dimensionality, nor does it consider the correlation between different indicators. The iDice algorithm proposes a series of heuristic rules to help solve the problem of how to locate software defects in multi-dimensional attribute combinations. This method assumes that when the indicators are abnormal, the indicator values ​​of the root cause dimension combination will change greatly. This assumption is often not valid in the business problem diagnosis scenario. The Squeeze algorithm proposes a generalized "chain reaction" concept for the problem of multi-dimensional anomaly location in operation and maintenance scenarios, pointing out that the more the "chain reaction" conditions are met between the dimension combination and its child nodes, the more likely it is to be the root cause. This concept does not hold true in the business problem diagnosis scenario.

[0028] In view of the technical problem that the root cause location of indicator abnormalities cannot be implemented quickly and accurately in multi-dimensional data scenarios in related technologies, an embodiment of the present application provides a method for locating the root cause of abnormalities, which can be run on Figure 1 In the computer terminal shown, the computer terminal is explained below.

[0029] The method embodiment of abnormality root cause location provided in the embodiment of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Figure 1 FIG. 1 shows a hardware structure block diagram of a computer terminal for implementing a method for locating the root cause of an abnormality. Figure 1As shown, the computer terminal 10 may include one or more (102a, 102b, ..., 102n are used to illustrate) processors (the processor may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 104 for storing data, and a transmission module 106 for communication functions connected via a wired and / or wireless network. In addition, it may also include: a display, a keyboard, a cursor control device, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the I / O interface), a network interface, and a BUS bus. Those skilled in the art can understand that Figure 1 The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations are shown.

[0030] It should be noted that the one or more processors and / or other data processing circuits described above may generally be referred to herein as "data processing circuits". The data processing circuits may be embodied in whole or in part as software, hardware, firmware, or any other combination thereof. In addition, the data processing circuit may be a single independent processing module, or may be incorporated in whole or in part into any of the other components in the computer terminal 10. As described in the embodiments of the present application, the data processing circuit acts as a processor control (e.g., selection of a variable resistor terminal path connected to an interface).

[0031] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the method for locating the root cause of abnormality in the embodiment of the present application. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory 104, that is, the method for locating the root cause of abnormality is realized. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 104 may further include a memory remotely arranged relative to the processor, and these remote memories may be connected to the computer terminal 10 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0032] The transmission module 106 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the computer terminal 10. In one example, the transmission module 106 includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission module 106 can be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0033] The display may be, for example, a touch screen liquid crystal display (LCD) that enables a user to interact with a user interface of the computer terminal 10 .

[0034] It should be noted that, in some optional embodiments, the above Figure 1 The computer terminal shown may include hardware elements (including circuits), software elements (including computer code stored on a computer-readable medium), or a combination of hardware elements and software elements. It should be noted that Figure 1 This is merely one example of a particular embodiment and is intended to illustrate the types of components that may be present in the computer terminal described above.

[0035] In the above operating environment, an embodiment of the present application provides a method embodiment for locating the root cause of an exception. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although the logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0036] Figure 2 is a flow chart of a method for locating the root cause of an abnormality according to an embodiment of the present application. Figure 2 As shown, the method comprises the following steps:

[0037] Step S202: obtaining a report data set for root cause location, wherein the report data set includes at least one indicator and multiple dimensions, and each dimension includes multiple dimension elements.

[0038] In the above step S202, dimension is a core concept in data analysis, which is used to segment and organize data sets so as to observe and analyze data from different angles. In the report data set, dimension can be understood as the classification standard or perspective of data. For example, in the sales report of an e-commerce platform, it may include time dimensions (such as year, month, date), regional dimensions (such as country, province, city), product dimensions (such as product type, brand, price range), etc. Dimension elements are specific instances or classifications under dimensions. They form the basis of data analysis and reports. Continuing with the sales report of an e-commerce platform as an example, elements under the time dimension may include "2023", "first quarter", "March", etc.; elements under the regional dimension may include "China", "Beijing", "Chaoyang District", etc.; elements under the product dimension may include "electronic products", "mobile phones", etc. Business indicators are specific values ​​that measure business operations, such as sales, number of users, etc. These indicators directly reflect the health and performance of the business. In the report data set, each dimension element can be associated with one or more business indicators to show the performance of the element in a specific aspect. When the system has performance degradation, abnormal fluctuations or other problems, in order to locate the root cause of the problem, it is necessary to obtain relevant report data sets for analysis. This data set should contain sufficiently rich dimensions and dimension elements to observe the problem from different angles and levels of detail.

[0039] Specifically, the report attribute information of multiple dimensions included in the report data set can be expressed as dimension information D={D1, D2, ..., D n}, for each dimension D i , there exists an element set E i ={e i1 ,e i2 ,...,e in}, m is the business indicator of interest, such as sales volume, operating income, etc. This indicator has simple additivity. The indicator values ​​of m in the current cycle (i.e., the first cycle) and the previous cycle (i.e., the second cycle) are expressed as A(m) and A'(m), respectively, where A(m) can be called the first indicator value and A'(m) can be called the second indicator value.

[0040] Step S204: construct a root cause location tree based on the report data set.

[0041] In the above step S204, the root cause location tree is a tree structure, in which each node represents a step or a judgment point in the problem analysis process, and the connection between the nodes reflects the logical relationship between these steps or judgment points.

[0042] Step S206: determine the abnormal root cause path corresponding to the report data set according to the root cause location tree.

[0043] In the above step S206, the abnormal root cause path refers to a path starting from the root node, through a series of logical reasoning and data analysis steps, and finally reaching the leaf node (root cause). Each node on this path represents a key step or judgment point in the analysis process, and the connection between the nodes reveals the causal relationship or logical connection between them.

[0044] Through the above steps S202 to S206, the purpose of quickly locating the abnormal cause of the report data is achieved, thereby achieving the technical effect of locating the abnormal root cause in the multidimensional data scenario, and further solving the technical problem in the related art that the root cause of the indicator abnormality cannot be quickly and accurately located in the multidimensional data scenario. The following is an explanation.

[0045] In step S204 of the above-mentioned method for locating the root cause of anomaly, a root cause locating tree is constructed based on the report data set, including: determining the first-level branches of the root cause locating tree based on the report data set, wherein the first-level branches include the first-dimensional report information that satisfies the first condition in multiple dimensions of the report data set, and the first-level branches are all branches directly connected to the root cause locating tree; determining the second-level branches corresponding to the dimensional elements in each layer after the first-level branches of the root cause locating tree from the other dimensional report information in multiple dimensions except the first-dimensional report information; determining the tree nodes under the first-level branches and the second-level branches; and determining the root cause locating tree based on the root node, the first-level branches, the second-level branches and the tree nodes.

[0046] In an embodiment of the present application, constructing a root cause location tree (RCATree) is a method for identifying the root cause of a problem by systematically analyzing multidimensional data. This method is suitable for troubleshooting in complex systems or business processes, which involve multiple interrelated factors. When constructing the root cause location tree, it is necessary to select a dimension from multiple dimensions of the report data set based on a first condition as a first-level branch. The first condition can be the one with the most votes after voting. Information is selected from the remaining dimensions to construct the second-level branches corresponding to the dimensional elements in each layer of the root cause location tree after the first-level branches. The root cause location tree is determined by determining the tree nodes under the first-level branches and the second-level branches, and based on the root node, the first-level branches, the second-level branches and the tree nodes. It should be noted that the root node of the root cause location tree is determined by initialization.

[0047] In the above steps, the first-level branch of the root cause location tree is determined based on the report data set, including: determining the surprise value, influence value and comprehensive value of all dimensions from the report data set, wherein the surprise value is used to represent the change in the proportion of the indicator of the dimension element of the dimension in the first period and the second period, the first period and the second period are adjacent, and the first period is the next period of the second period, the influence value is used to represent the abnormality of the indicator of the dimension element of the dimension, and the comprehensive value is determined based on the surprise value and the influence value; determining the dimension corresponding to the maximum value of the surprise value among all the surprise values ​​as the first strategy, determining the dimension corresponding to the maximum value of the influence value among all the influence values ​​as the second strategy, and determining the dimension corresponding to the maximum value of the comprehensive value among all the comprehensive values ​​as the third strategy; determining the dimension corresponding to the strategy that meets the first condition from the first strategy, the second strategy and the third strategy as the first-level branch of the root cause location tree.

[0048] In an embodiment of the present application, the surprise value is used to measure the degree of change in the proportion of indicators of a dimensional element of a certain dimension between two adjacent periods (the first period and the second period, where the first period is the next period of the second period, for example, the first period is the current period, and the second period is the previous period). If the proportion of indicators of a dimensional element changes significantly between two periods, the surprise value of the dimension will be higher. This helps to identify factors that have changed significantly in a short period of time. The impact value is used to indicate the abnormality of the indicators of the dimensional elements of a dimension, and the impact value helps to identify factors that have a significant impact on the system or business. The comprehensive value is calculated based on the surprise value and the impact value, and is used to comprehensively consider the importance of the two factors.

[0049] After determining the surprise value, influence value, and comprehensive value of all dimensions, select the dimension corresponding to the maximum value among all surprise values ​​as the first strategy, select the dimension corresponding to the maximum value among all influence values ​​as the second strategy, select the dimension corresponding to the maximum value among all comprehensive values ​​as the third strategy, and select the corresponding dimension from the strategies that meet the first condition as the root node of the root cause location tree. For example, the first condition may be to select the dimension corresponding to the strategy with the most votes from the three strategies as the first-level branch of the root cause location tree.

[0050] Specifically, the surprise value describes the change in the proportion of the dimension elements in the current period and the previous period, which is expressed as formula (1):

[0051]

[0052] Among them, S(e ij ) represents the dimension element e ij The surprise value, pij =A ij (m) / A(m),q ij =A' ij (m) / A'(m), p ij and q ij Represents intermediate data.

[0053] The explanation value describes the proportion of the indicator change of the dimension element in the current cycle and the previous cycle, which is expressed as formula (2):

[0054] EP(e ij )=(A ij (m)-A' ij (m)) / (A(m)-A'(m)) (2)

[0055] Among them, EP(e ij ) represents the dimension element e ij The interpretation value, A ij (m) is the index value of the jth element in the i-th dimension in the first period (current period), A' ij (m) The index value of the jth element in the i-th dimension in the second period (the previous period).

[0056] The surprise value of a dimension is obtained by summing the surprise values ​​of all dimension elements, expressed as formula (3):

[0057]

[0058] Among them, S(D i ) represents dimension D i The surprise value.

[0059] The impact value weighs the abnormality of the indicator of the dimension element by multiplying two values, which is expressed as formula (4):

[0060] IV(e ij )=EP(e ij )S(e ij ) (4)

[0061] Among them, IV(e ij ) represents the dimension element e ij The impact value of .

[0062] The influence value of a dimension is the sum of the influence values ​​of all non-negative dimension elements, expressed as formula (5):

[0063]

[0064] Among them, IV(D i ) represents dimension D i The impact value of .

[0065] The comprehensive value of a dimension is equal to the product of the dimension's influence value and the dimension's surprise value, expressed as formula (6):

[0066] T(D i )=S(D i )IV(D i ) (6)

[0067] Among them, T(D i ) represents dimension D i The comprehensive value of .

[0068] The surprise value, influence value and comprehensive value of the dimension will be used as the selection criteria for the three optimal dimension selection strategies (Strategy A, Strategy B and Strategy C). Among them, Strategy A selects the dimension with the highest surprise value, Strategy B selects the dimension with the highest influence value, and Strategy C selects the dimension with the highest comprehensive value. On this basis, the expert voting mechanism is adopted to vote on the optimal dimension. The dimension with the most votes (that is, the dimension corresponding to the strategy that meets the first condition) is determined as the first-level branch of the root cause location tree.

[0069] In the above steps, the second-level branches corresponding to the dimensional elements in each layer after the first-level branches of the root cause location tree are determined from the dimensional report information of other dimensions except the first-level report information among multiple dimensions, including: determining preliminary candidates based on the standards of the first strategy, the standards of the second strategy and the standards of the third strategy from the other dimensional report information; deduplicating the dimensions in the preliminary candidates to obtain a candidate set; pre-calculating the candidate dimensions in each candidate set to obtain the potential benefit score corresponding to each candidate dimension; and determining the dimension with the highest benefit score as the second-level branch corresponding to the dimensional element in each layer after the first-level branch.

[0070] In an embodiment of the present application, for the dimensional elements in each layer after the first layer of branches in the root cause location tree, when determining the branches below it, the dimension with the highest surprise value, the dimension with the highest influence value, and the dimension with the highest comprehensive value can be determined from other dimensional report information as preliminary candidates. After the preliminary candidates are determined, in order to avoid some dimensions being selected as candidates under multiple strategies. Therefore, deduplication processing is required to ensure that each candidate is unique in the candidate set, thereby obtaining a candidate set. For each candidate dimension in the candidate set, pre-calculation is performed to evaluate its potential value as a root cause. The potential value can be measured by the potential benefit score. The potential benefit scores of all candidate dimensions are compared, and the dimension with the highest score is selected as the optimal dimension. The optimal dimension is also the second-level branch corresponding to the dimensional element in each layer after the first layer of branches in the root cause location tree.

[0071] Specifically, the optimal dimension needs to be finally determined through two rounds of expert voting and pre-calculation. First, the three strategies select a dimension from other dimension report information as a preliminary candidate based on their own standards, and then remove duplicates after expert voting to obtain a candidate set. Next, the pre-calculation step calculates the potential benefit score of each candidate. The dimension with the highest potential benefit score is selected as the optimal dimension, that is, the second-level branch corresponding to the dimension element in each layer after the first-level branch in the root cause location tree.

[0072] In the above steps, the candidate dimensions in each candidate set are pre-calculated to obtain the potential benefit score corresponding to each candidate dimension, including: sorting the dimensional elements under each candidate dimension from large to small according to the influence value, and determining the isolation value of each dimensional element in turn starting from the dimensional element with the largest influence value, wherein the isolation value is used to represent the difference in the index value of the dimensional element in the previous and subsequent periods; storing the dimensional elements whose isolation value of each dimensional element under each candidate dimension is greater than the isolation value of the parent node of the corresponding dimensional element and whose explanation value of each dimensional element under each candidate dimension is greater than the first threshold in a temporary set in turn, until the explanation value of the dimensional element in the temporary set reaches the second threshold, wherein the explanation value is used to represent the proportion of the indicator change of the dimensional element in the first period and the second period, and the parent node is the dimensional element under the upper branch of the current branch; determining the influence value of the temporary set, and determining the mean of the isolation value of the temporary set; determining the potential benefit score corresponding to each candidate dimension based on the influence value of the temporary set, the mean of the isolation value, the influence value of each candidate dimension and the isolation value of the parent node of the temporary set, wherein the parent node corresponding to each dimensional element under each candidate dimension is the same.

[0073] In an embodiment of the present application, for each candidate dimension, first, the influence value of the dimension element is sorted from large to small, and the influence value reflects the importance or influence of the dimension element on the analysis target (such as business indicators, etc.). The isolation value is used to quantify the degree of change of the indicator value of the dimension element in the previous and subsequent periods (or different time periods, different conditions), which helps to identify those characteristic values ​​that can significantly distinguish the performance under different time periods or conditions. Starting from the dimension element with the largest influence value, the isolation value of each dimension element is calculated in turn. Those dimension elements whose isolation value is greater than the isolation value of its parent node and whose explanation value is greater than the first threshold are selected into a temporary set. The explanation value represents the proportion of the dimension element in the change of the indicator in two different periods, reflecting the contribution of its change to the overall change. This process continues until the sum of the explanation values ​​of the dimension elements in the temporary set reaches the second threshold, at which time stop adding more elements. Determine the overall influence value of the temporary set and the mean of the isolation value of the temporary set, based on the influence value of the temporary set, the mean of the isolation value, the influence value of each candidate dimension itself, and the isolation value of the parent node of the temporary set, comprehensively evaluate the potential benefit score of each candidate dimension. This score aims to quantify the potential contribution corresponding to the candidate dimension.

[0074] Specifically, in the pre-calculation process, for each candidate dimension, the dimensional elements under the candidate dimension are first sorted from large to small according to the influence value, and the isolation value of each dimensional element is calculated in sequence starting from the dimensional element with the largest influence value. The calculation of the isolation value is expressed as formula (11):

[0075]

[0076] Among them, IP1(e ij )、IP2(e ij )、IP3(e ij ) and IP4(e ij ) represents the sub-isolation value, and the sub-isolation value is determined from four perspectives, for example, it can be recorded as the first sub-isolation value, the second sub-isolation value, the third sub-isolation value, and the fourth sub-isolation value, respectively. IP(e ij ) represents the dimension element e ij The isolation value describes the difference in the index values ​​of elements of different dimensions in the previous and subsequent cycles.

[0077] Add the dimension elements whose isolation value is greater than the isolation value of the parent node and whose interpretation value is greater than the given minimum threshold (i.e. the first threshold mentioned above) to the temporary set S in sequence. tmpAt the same time, the explanation values ​​in the temporary set are accumulated until the accumulated explanation value reaches the specified upper threshold (i.e., the second threshold mentioned above). The sum of the influence values ​​of all dimensional elements in the temporary set (i.e., the influence value of the temporary set) and the mean of the isolation values ​​are calculated, which are expressed as formula (12) and formula (13), respectively.

[0078]

[0079]

[0080] Among them, k represents the temporary set S tmp The number of dimension elements stored in IV(S tmp ) represents the influence value of the temporary set, IP avg (S tmp ) represents the mean of the isolation values ​​of the temporary set.

[0081] On this basis, S tmp The ratio of the influence value of the corresponding candidate dimension to the influence value of the corresponding candidate dimension, multiplied by S tmp The difference between the mean isolation value of the candidate node and the isolation value of its parent node is used to calculate the potential benefit score of the candidate dimension, which is expressed as formula (14). This means that the more the isolation from the parent node to the child node increases, or the greater the influence of the selected dimension elements, the higher the potential benefit score will be.

[0082]

[0083] Among them, Gain(D i ) represents the candidate dimension D i The corresponding potential benefit score, IV(D i ) represents the candidate dimension D i The corresponding influence value, IP parent (S tmp ) represents the isolation value of the parent node corresponding to the dimension element in the temporary collection.

[0084] In the above steps, the tree nodes under the first-level branches and the second-level branches are determined, including: sorting the dimensional elements under the target branch in descending order according to the influence value, and determining the isolation value of each dimensional element of the target branch starting from the dimensional element with the largest influence value, wherein the isolation value is used to represent the difference in the index value of the dimensional element between the previous and next cycles, and the target branch is any one of the first-level branches and the second-level branches; the dimensional elements of the target branch whose isolation value is greater than the isolation value of the parent node of the corresponding dimensional element and whose explanation value of the dimensional element of the target branch is greater than the third threshold are added to the result set in turn, until the explanation value of the dimensional element in the result set reaches the fourth threshold, wherein the explanation value is used to represent the proportion of the indicator change of the dimensional element between the first cycle and the second cycle; the dimensional elements in the result set are determined as the tree nodes under the target branch in the root cause location tree.

[0085] In an embodiment of the present application, after determining the first-level branches and the second-level branches, one or more dimensional elements under the branch are further selected to generate a tree node. The selection of dimensional elements is similar to the pre-calculation step. First, the dimensional elements under the target branch are sorted from large to small according to the influence value, and the isolation value of each dimensional element is calculated in sequence starting from the element with the largest influence value. The dimensional element of the target branch whose isolation value is greater than the isolation value of its parent node and whose interpretation value is greater than the given minimum threshold (i.e., the third threshold mentioned above) is selected to generate a tree node and added to the result set. At the same time, the interpretation values ​​of the dimensional elements in the result set are accumulated until the accumulated interpretation value reaches the specified upper limit threshold (i.e., the fourth threshold mentioned above). The structure of the tree node is shown in Table 1. Each tree node retains important information such as the node ID of the parent node, whether it is a leaf node, isolation (value), and the index value of the dimensional element in the current cycle and the previous cycle, which is convenient for comparative calculations, path output and other operations.

[0086] Table 1 Node information of root cause diagnosis tree

[0087]

[0088]

[0089] In the above steps, the method further includes: traversing the tree nodes, determining the tree nodes that do not meet the second condition as target tree nodes, and continuing to determine the branches under the target tree nodes; determining the tree nodes that meet the second condition as leaf nodes.

[0090] In an embodiment of the present application, in the process of determining the leaf node, starting from the root node, each node of the root cause location tree is traversed. During the traversal process, the second condition is used to determine whether each node meets the conditions for becoming a leaf node. If the current node does not meet the conditions for becoming a leaf node (ie, the second condition), the depth of the tree increases by 1, and continues to explore more child nodes under the node, including branches under the node and tree nodes corresponding to the branches. When a node is traversed and the node meets the conditions for becoming a leaf node, further exploration under the node is stopped. This node represents a possible explanation for the root cause of the problem and is an end point in the root cause location tree. Through the above steps, a complete root cause location tree will eventually be obtained, such as Figure 3 shown.

[0091] In the above steps, a tree node that meets the second condition is determined as a leaf node, including: obtaining a first index value of the first tree node in the first period, a second index value of the first tree node in the second period, and obtaining a global index value of the first tree node in all periods, wherein the first tree node is any tree node in the root cause location tree; determining a difference between the first index value and the second index value; when the ratio of the difference to the global index value is less than or equal to a preset threshold, determining that the first tree node meets the second condition; and determining the first tree node as a leaf node.

[0092] In the embodiment of the present application, the above tree nodes are traversed in sequence. For any tree node in the tree nodes, taking the first tree node as an example, its first index value in the first cycle is obtained, the second index value of the first tree node in the second cycle is obtained, and the global index value of the first tree node in all cycles is obtained. When the ratio of the difference between the first index value and the second index value and the global index value is greater than the preset threshold, it is determined that the first tree node does not meet the second condition, then the first tree node is continued to be the parent node, the depth of the root cause location tree is increased by 1, and the above steps of determining the optimal dimension (i.e. determining the branch) and determining the tree node are repeated; when the ratio of the difference between the first index value and the second index value and the global index value is less than or equal to the preset threshold, it is determined that the first tree node meets the second condition, then the first tree node is determined as a leaf node, and drilling down is not continued. When drilling down is finished, all nodes in the result set form a root cause diagnosis path (or abnormal root cause path) from top to bottom according to the parent-child relationship.

[0093] In step S206 of the above-mentioned method for locating the abnormal root cause, determining the abnormal root cause path corresponding to the report data set according to the root cause location tree includes: determining the contribution of all leaf nodes in the root cause location tree, wherein the contribution is the ratio of the sum of the changes in the index values ​​of the leaf nodes in the first period and the second period to the difference between the first index value and the second index value, wherein the first index value is the index value of the leaf node in the first period, and the second index value is the index value of the leaf node in the second period; determining the path of the leaf node whose contribution is less than the fifth threshold in the root cause location tree as the abnormal root cause path; and determining the report data set when the contribution is greater than or equal to the fifth threshold. The third indicator value of other data in the first period except the data corresponding to the root cause path in the root cause location tree and the fourth indicator value of other data in the second period are combined; a first difference between the third indicator value and the first indicator value is determined, and a second difference between the fourth indicator value and the second indicator value is determined; when the changing directions of the first difference and the second difference are inconsistent, the root cause location process ends; when the changing directions of the first difference and the second difference are consistent, the data used in the root cause location tree are deleted from the report data set to obtain the remaining data; a new root cause location tree is continued to be constructed based on the remaining data, and the root node and depth of the new root cause location tree are initialized.

[0094] In the embodiment of the present application, the sum of the changes in the index values ​​of all leaf nodes in the root cause location tree obtained in each round in the two previous and next cycles (that is, the sum of the changes in the index values ​​of the leaf nodes in the first cycle and the second cycle) is calculated, and divided by the difference between A(m) and A'(m) to obtain the contribution of the leaf node, wherein A(m) is the first index value, and A'(m) is the second index value. If the contribution is less than the set minimum threshold (that is, the fifth threshold), the entire root cause location process ends and a new round is not started; otherwise, the index value size of the data set after removing the root cause paths of all root cause location trees in the current cycle and the previous cycle is continued to be evaluated, expressed as A_(m )(i.e., the third indicator value) and A_'(m)(i.e., the fourth indicator value), determine the first difference between the third indicator value and the first indicator value, and determine the second difference between the fourth indicator value and the second indicator value; if the change directions of the first difference and the second difference are inconsistent, for example, the first difference>0, the second difference<0, or the first difference<0, the second difference>0, then there is no need to proceed to the next round, and the whole process ends; if the change directions of the first difference and the second difference are consistent, for example, the first difference and the second difference are both>0, or the first difference and the second difference are both<0, then the data set corresponding to the root cause path of this round is deleted, and the dimension set D={D1,D2,...,D n The remaining data in} is used as the input for a new round of positioning. A root node with a node ID of 0 is initialized, the depth of the tree is initialized to 1, and a new root cause positioning tree is constructed.

[0095] In step S206 of the above-mentioned method for locating the root cause of abnormality, the method also includes: adding the abnormal root cause paths in all root cause locating trees to the target result set, and deduplicating the target result set; determining the parent node of each leaf node corresponding to the abnormal root cause path in the target result set; determining the sum of the explanation values ​​of all leaf nodes under the parent node, wherein the explanation value is used to represent the proportion of the indicator change of the dimensional element in the first period and the second period; when the sum of the explanation values ​​is less than or equal to the sixth threshold, deleting the abnormal root cause paths associated with all leaf nodes under the parent node from the target result value.

[0096] In an optional embodiment of the present application, all abnormal root cause paths in the root cause location tree are added to the target result set, and the target result set is deduplicated; or the first round of root cause diagnosis results (i.e., the abnormal root cause paths in the first round) are directly added to the target result set, and the merging with the target result set is completed in sequence from the second round. The merging requires two steps. The first step is to determine in turn whether each root cause diagnosis path has an intersection with the path in the target result set. If so, it is not added to the target result set. Otherwise, the path is added to the target result set. The second step is to find the parent node of each leaf node of the path, and determine whether the cumulative explanation value of all leaf nodes under the parent node is still higher than the specified upper limit threshold (i.e., the sixth threshold mentioned above). If it is higher, it will be retained. Otherwise, the root cause diagnosis path associated with all leaf nodes under the parent node will be deleted from the target result set.

[0097] The method for locating the root cause of anomalies provided in the embodiments of the present application has the following advantages: (1) a multi-strategy is proposed to combine expert voting and pre-calculation to achieve the selection of the optimal dimension, starting from the problem dimension, thereby improving the accuracy and efficiency of anomaly diagnosis; secondly, the method makes full use of expert experience and has good scalability. New strategies can be flexibly added as needed in the future without affecting the existing strategies and decision-making mechanisms; (2) by merging the results of multiple rounds of diagnosis, the main causes affecting the abnormal indicators can be located to the greatest extent, thereby enhancing the accuracy and coverage of root cause location; (3) based on the selection of the optimal dimension, a pruning strategy is formulated in combination with indicators such as isolation, influence, and explanation value, which greatly accelerates the efficiency of anomaly location, and the average location time of a single anomaly is less than 1 second.

[0098] The following is an explanation of the method for locating the root cause of the above anomaly in combination with specific steps:

[0099] The dimension set D corresponding to the report data set = {D1, D2, ..., D n}, the dimensions include product name, channel, province organization, gender, age, city level, etc. For each dimension D i , there exists an element set E i ={e i1 ,ei2 ,...,e in For example, the dimension element set of city level is {first-tier cities, quasi-first-tier cities, second-tier cities, third-tier cities, fourth-tier cities, fifth-tier cities}, m represents operating income, and the unit is yuan. The diagnosis cycle is one month, the current cycle is the current month, and the m indicator is abnormal compared with the previous cycle, that is, the previous month, and the operating income has decreased by 35%. The abnormality is located by building a root cause location tree. The specific steps are as follows:

[0100] (I) Selection of the optimal dimensions corresponding to the first-level branches and the second-level branches. The first optimal dimension (i.e., the optimal dimension corresponding to the first-level branches) is determined by simple voting of multiple strategies. First, the surprise value, influence value, and comprehensive value corresponding to each dimension are calculated. Among them, the surprise value of the dimension is obtained by summing the surprise values ​​of all dimensional elements, the influence value of the dimension is obtained by summing the influence values ​​of all non-negative dimensional elements, and the comprehensive value of the dimension is obtained by multiplying the surprise value of the dimension by the influence value. The three optimal dimension selection strategies each select a dimension as a preliminary candidate based on the surprise value, influence value, and comprehensive value. On this basis, the expert voting mechanism is adopted to vote for the optimal dimension, and the dimension with the most votes is elected as the optimal dimension corresponding to the first-level branch.

[0101] For the second-level branches corresponding to the dimension elements in each layer after the first-level branches in the root cause location tree, the optimal dimension corresponding to the second-level branches needs to be finally determined through two rounds of expert voting and pre-calculation. First, the surprise value, influence value and comprehensive value corresponding to each dimension are still calculated. A(m) and A'(m) in formula (1) and formula (2) respectively represent the index values ​​of the current cycle (i.e., the first cycle) and the previous cycle (i.e., the second cycle) under the conditions of the parent node, that is, A(m) is the first index value and A'(m) is the second index value. If the parent node is empty, it means that there is no condition limit on the index value. On this basis, the three strategies select a dimension as a preliminary candidate based on their own standards, remove duplicates after expert voting, and obtain a candidate set. Next, the pre-calculation step calculates the potential benefit score of each candidate. The dimension with the highest potential benefit score will be used as the optimal dimension corresponding to the second-level branch. The more the isolation degree from the parent node to the child node increases, or the larger the influence of the selected dimension element, the greater the probability of being selected. The specific steps of pre-calculation are the same as the above steps and will not be repeated here.

[0102] (ii) Generate tree nodes. Based on the optimal dimension selected in step 1 (including the optimal dimension corresponding to the first-level branches and the second-level branches), further select one or more dimensional elements of the dimension to generate tree nodes. First, sort the dimensional elements under the dimension from large to small according to the influence value, and calculate the isolation value of each element in turn starting from the element with the largest influence value. Select the dimensional elements whose isolation is greater than the parent node and whose explanation value is greater than the given minimum threshold (such as the third threshold), generate tree nodes, and add them to the result set. At the same time, accumulate the explanation values ​​until the accumulated explanation reaches the specified upper threshold (such as the fourth threshold). The node ID is generated by a global counter, which is initialized to 0 at the beginning of each round. Each time a tree node is generated, the counter is incremented by 1. All tree nodes are arranged in order from small to large ID, which is convenient for positioning based on node ID. Each tree node saves the ID information of the parent node through the parent_node_id field, which is convenient for comparing its own isolation with the isolation of the parent node, and provides guidance for the output of the diagnostic path. The leaf_node field marks whether the node is a leaf node, 1 indicates a leaf node, and 0 indicates a non-leaf node. The leaf node tag field provides support for path output and contribution calculation.

[0103] (iii) Drill down. Traverse each tree node generated in step 2, taking the first tree node as an example, if the ratio of the difference between the index values ​​of the first tree node in the previous and next cycles and the global index value is greater than the preset threshold, then continue to use the node as the parent node, increase the depth of the tree by 1, and repeat steps 1 and 2. On the contrary, mark the leaf_node identifier of the node as 1, that is, determine that the first tree node is a leaf node, and do not continue to drill down. Here, pruning is performed by preset thresholds to avoid continuous drilling down of dimensional elements with a small proportion, which can speed up the entire tree building process. At the end of this round of the algorithm, all tree nodes form a root cause diagnosis path from top to bottom according to the parent-child relationship, such as [channel = 'advertising'][city level = 'quasi-first-tier city'][gender = 'female'].

[0104] (IV) Start a new round of positioning. Calculate the contribution of the root cause path located in this round to the change in the index value of index m in the two periods before and after. If the contribution is less than the fifth threshold, the entire root cause positioning process ends; otherwise, continue to evaluate the index value size of the data set after removing all root cause paths in the current period and the previous period, expressed as A_(m) and A_'(m), and determine the first difference obtained by A_(m)-A(m), and determine the second difference obtained by A_'(m)-A'(m). If the change directions of the two are inconsistent, for example, the first difference > 0, the second difference < 0, or the first difference < 0, the second difference > 0, then there is no need to proceed to the next round, and the entire process ends; if the change directions of the first difference and the second difference are consistent, for example, the first difference and the second difference are both > 0, or the first difference and the second difference are both < 0, then the data set corresponding to the root cause path of this round is deleted, and the dimension set D = {D1, D2, ..., D n The remaining data set in} is used as the input for a new round of positioning. A root node with a node ID of 0 is initialized, the depth of the tree is initialized to 1, the global counter is initialized to 0, and the next round of positioning is continued.

[0105] (V) Merging multiple rounds of diagnosis results. Add all abnormal root cause paths in the root cause location tree to the target result set, and deduplicate the target result set; or add the first round of root cause diagnosis results to the target result set, and complete the merge with the target result set in sequence from the second round. The merge requires two steps. The first step is to determine whether each root cause diagnosis path has an intersection with the data set in the target result set. If so, delete the path; otherwise, add the path to the target result set. The second step is to find the parent node of each leaf node of the path and determine whether the cumulative explanation value of all leaf nodes under the parent node is still higher than the specified upper limit threshold (such as the sixth threshold). If it is higher, it will be retained; otherwise, the root cause diagnosis path associated with all leaf nodes under the parent node will be deleted from the target result set. Figure 3 For example, for leaf node e g3 , first find its parent node e j2 , judge e j2 All leaf nodes e g3 , e g5 Is the cumulative explanation value of the above still higher than the specified upper threshold (such as the sixth threshold)? If so, it is retained; otherwise, e j2 The root cause diagnostic paths associated with all leaf nodes are deleted.

[0106] Figure 4 is a structural diagram of a device for locating the root cause of an abnormality according to an embodiment of the present application, such as Figure 4 As shown, the device comprises:

[0107] The acquisition module 40 is used to acquire a report data set for root cause location, wherein the report data set includes at least one indicator and multiple dimensions, and each dimension includes multiple dimension elements;

[0108] A construction module 42 is used to construct a root cause location tree according to the report data set;

[0109] The determination module 44 is used to determine the abnormal root cause path corresponding to the report data set according to the root cause location tree.

[0110] In the construction module in the above-mentioned device for locating the root cause of anomaly, the construction module is also used to determine the first-level branches of the root cause location tree based on the report data set, wherein the first-level branches include the first-dimensional report information that satisfies the first condition in multiple dimensions of the report data set, and the first-level branches are all branches directly connected to the root node of the root cause location tree; determine the second-level branches corresponding to the dimensional elements in each layer of the root cause location tree after the first-level branches from the other dimensional report information in multiple dimensions except the first-dimensional report information; determine the tree nodes under the first-level branches and the second-level branches; determine the root cause location tree based on the root node, the first-level branches, the second-level branches and the tree nodes.

[0111] In the construction module in the above-mentioned device for locating the root cause of anomalies, the construction module is also used to determine the surprise value, impact value and comprehensive value of all dimensions from the report data set, wherein the surprise value is used to represent the change in the proportion of indicators of the dimensional elements of the dimension in the first period and the second period, the first period and the second period are adjacent, and the first period is the next period of the second period, the impact value is used to represent the abnormal situation of the indicator of the dimensional elements of the dimension, and the comprehensive value is determined based on the surprise value and the impact value; the dimension corresponding to the maximum value of the surprise value among all the surprise values ​​is determined as the first strategy, the dimension corresponding to the maximum value of the influence value among all the influence values ​​is determined as the second strategy, and the dimension corresponding to the maximum value of the comprehensive value among all the comprehensive values ​​is determined as the third strategy; the dimension corresponding to the strategy that meets the first condition from the first strategy, the second strategy and the third strategy is determined as the first-level branch of the root cause location tree.

[0112] In the construction module in the above-mentioned device for locating the root cause of anomalies, the construction module is also used to determine preliminary candidates from other dimensional report information based on the standards of the first strategy, the second strategy and the third strategy; deduplicate the dimensions in the preliminary candidates to obtain a candidate set; pre-calculate the candidate dimensions in each candidate set to obtain the potential benefit score corresponding to each candidate dimension; and determine the dimension with the highest benefit score as the second-level branch corresponding to the dimensional element in each layer after the first-level branch.

[0113] In the construction module in the above-mentioned device for locating the root cause of anomalies, the construction module is also used to sort the dimensional elements under each candidate dimension from large to small according to the influence value, and determine the isolation value of each dimensional element in turn starting from the dimensional element with the largest influence value, wherein the isolation value is used to represent the difference in the index value of the dimensional element in the previous and subsequent periods; the dimensional elements whose isolation value of each dimensional element under each candidate dimension is greater than the isolation value of the parent node of the corresponding dimensional element, and whose explanation value of each dimensional element under each candidate dimension is greater than the first threshold, are stored in a temporary set in turn until the explanation value of the dimensional element in the temporary set reaches the second threshold, wherein the explanation value is used to represent the proportion of the indicator change of the dimensional element in the first period and the second period, and the parent node is the dimensional element under the branch of the previous layer of the current branch; determine the influence value of the temporary set, and determine the mean of the isolation value of the temporary set; determine the potential benefit score corresponding to each candidate dimension based on the influence value of the temporary set, the mean of the isolation value, the influence value of each candidate dimension and the isolation value of the parent node of the temporary set, wherein the parent node corresponding to each dimensional element under each candidate dimension is the same.

[0114] In the construction module in the above-mentioned device for locating the root cause of anomaly, the construction module is also used to sort the dimensional elements under the target branch in order from large to small according to the influence value, and determine the isolation value of each dimensional element of the target branch in turn starting from the dimensional element with the largest influence value, wherein the isolation value is used to represent the difference in the index value of the dimensional element in the previous and subsequent periods, and the target branch is any one of the first-layer branches and the second-layer branches; the dimensional elements of the target branch whose isolation value is greater than the isolation value of the parent node of the corresponding dimensional element and whose explanation value of the dimensional element of the target branch is greater than the third threshold are added to the result set in turn, and the explanation value of the dimensional element in the result set reaches the fourth threshold, wherein the explanation value is used to represent the proportion of the indicator change of the dimensional element in the first period and the second period; the dimensional elements under the target branch in the result set are determined as tree nodes of the root cause location tree.

[0115] In the construction module in the above-mentioned device for locating the root cause of the abnormality, the construction module is also used to traverse the tree nodes, determine the tree nodes that do not meet the second condition as target tree nodes, and continue to determine the branches under the target tree nodes; determine the tree nodes that meet the second condition as leaf nodes.

[0116] In the construction module in the above-mentioned device for locating the root cause of the abnormality, the construction module is also used to obtain the first indicator value of the first tree node in the first period, the second indicator value of the first tree node in the second period, and the global indicator value of the first tree node in all periods, wherein the first tree node is any tree node in the root cause location tree; determine the difference between the first indicator value and the second indicator value; when the ratio of the difference to the global indicator value is less than or equal to a preset threshold, determine that the first tree node satisfies the second condition; and determine the first tree node as a leaf node.

[0117] In the determination module in the above-mentioned abnormal root cause location device, the determination module is also used to determine the contribution of all leaf nodes in the root cause location tree, wherein the contribution is the ratio of the sum of the changes in the index value of the leaf node in the first period and the second period to the difference between the first index value and the second index value, wherein the first index value is the index value of the leaf node in the first period, and the second index value is the index value of the leaf node in the second period; the path of the leaf node with a contribution less than the fifth threshold in the root cause location tree is determined as the abnormal root cause path; when the contribution is greater than or equal to the fifth threshold, the third index value of other data in the report data set except the data corresponding to the root cause path in the root cause location tree and the fourth index value of other data in the second period are determined; the first difference between the third index value and the first index value is determined, and the second difference between the fourth index value and the second index value is determined; when the change directions of the first difference and the second difference are inconsistent, the root cause location process ends; when the change directions of the first difference and the second difference are consistent, the data used in the root cause location tree is deleted from the report data set to obtain the remaining data; a new root cause location tree is continuously constructed based on the remaining data, and the root node and depth of the new root cause location tree are initialized.

[0118] In the determination module in the above-mentioned abnormal root cause location device, the determination module is also used to add the abnormal root cause paths in all root cause location trees to the target result set, and deduplicate the target result set; determine the parent node of each leaf node corresponding to the abnormal root cause path in the target result set; determine the sum of the explanation values ​​of all leaf nodes under the parent node, wherein the explanation value is used to represent the proportion of the indicator change of the dimensional element in the first period and the second period; when the sum of the explanation values ​​is less than or equal to the sixth threshold, delete the abnormal root cause paths associated with all leaf nodes under the parent node from the target result value.

[0119] It should be noted that Figure 4 The device for locating the root cause of abnormality is used to perform Figure 2 The method for locating the root cause of the abnormality is shown, so the relevant explanations in the above-mentioned method for locating the root cause of the abnormality are also applicable to the device for locating the root cause of the abnormality, and will not be repeated here.

[0120] An embodiment of the present application also provides an electronic device, which includes a memory and a processor, wherein the memory is used to store program instructions; the processor is connected to the memory and is used to execute the method for locating the root cause of the abnormality.

[0121] An embodiment of the present application also provides a non-volatile storage medium, which includes a stored computer program, wherein the device where the non-volatile storage medium is located executes the above-mentioned method for locating the root cause of the abnormality by running the computer program.

[0122] An embodiment of the present application further provides a computer program product, including computer instructions, which, when executed by a processor, implement the steps of the method for locating the root cause of anomaly in each embodiment of the present application.

[0123] The embodiments of the present application also provide a computer program, which, when executed by a processor, implements the steps of the method for locating the root cause of anomaly in each embodiment of the present application.

[0124] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0125] In the above embodiments of the present application, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0126] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0127] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0128] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0129] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, in essence, or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, disk or optical disk and other media that can store program codes.

[0130] The above is only a preferred implementation of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A method for locating the root cause of an abnormality, characterized in that: include: Acquire a report data set for root cause location, wherein the report data set includes at least one indicator and multiple dimensions, and each dimension includes multiple dimension elements; Constructing a root cause location tree according to the report data set; The abnormal root cause path corresponding to the report data set is determined according to the root cause location tree.

2. The method according to claim 1, characterized in that Constructing a root cause location tree based on the report data set includes: Determine a first-level branch of the root cause location tree according to the report data set, wherein the first-level branch includes first-dimensional report information that meets a first condition in multiple dimensions of the report data set, and the first-level branch is all branches directly connected to a root node of the root cause location tree; Determine, from other dimension report information among the multiple dimensions except the first dimension report information, a second-level branch corresponding to a dimensional element in each level of the root cause location tree after the first-level branch; Determine tree nodes under the first-layer branches and the second-layer branches; The root cause location tree is determined according to the root node, the first-layer branches, the second-layer branches and the tree nodes.

3. The method according to claim 2, characterized in that Determining the first-level branch of the root cause location tree according to the report data set includes: Determine the surprise value, impact value and comprehensive value of all dimensions from the report data set, wherein the surprise value is used to indicate the change in the proportion of the index of the dimensional element of the dimension in the first period and the second period, the first period and the second period are adjacent, and the first period is the next period of the second period, the impact value is used to indicate the abnormality of the index of the dimensional element of the dimension, and the comprehensive value is determined according to the surprise value and the impact value; The dimension corresponding to the maximum value of the surprise value among all the surprise values ​​is determined as the first strategy, the dimension corresponding to the maximum value of the influence value among all the influence values ​​is determined as the second strategy, and the dimension corresponding to the maximum value of the comprehensive value among all the comprehensive values ​​is determined as the third strategy; The dimension corresponding to the strategy that meets the first condition among the first strategy, the second strategy, and the third strategy is determined as a first-level branch of the root cause location tree.

4. The method according to claim 3, characterized in that Determining, from other dimension report information among the multiple dimensions except the first dimension report information, a second-level branch corresponding to a dimensional element in each level of the root cause location tree after the first-level branch, includes: determining preliminary candidates from the other dimensional report information based on the criteria of the first strategy, the criteria of the second strategy, and the criteria of the third strategy; De-duplication processing is performed on the dimensions in the preliminary candidates to obtain a candidate set; Pre-calculating each candidate dimension in the candidate set to obtain a potential benefit score corresponding to each candidate dimension; The dimension with the highest benefit score is determined as the second-layer branch corresponding to the dimensional element in each layer after the first-layer branch.

5. The method according to claim 4, characterized in that Pre-calculating each candidate dimension in the candidate set to obtain a potential benefit score corresponding to each candidate dimension, including: Sort the dimension elements under each candidate dimension from large to small according to the influence value, and determine the isolation value of each dimension element in turn starting from the dimension element with the largest influence value, wherein the isolation value is used to represent the difference between the indicator values ​​of the dimension element in the previous and next cycles; The dimensional elements whose isolation value of each dimensional element under each candidate dimension is greater than the isolation value of the parent node of the corresponding dimensional element and whose interpretation value of each dimensional element under each candidate dimension is greater than the first threshold are sequentially stored in a temporary set until the interpretation value of the dimensional element in the temporary set reaches the second threshold, wherein the interpretation value is used to indicate the proportion of the indicator change of the dimensional element in the first period and the second period, and the parent node is the dimensional element under the upper branch of the current branch; Determining an influence value of the temporary set, and determining a mean value of the isolation value of the temporary set; Based on the influence value of the temporary set, the average of the isolation values, the influence value of each candidate dimension and the isolation value of the parent node of the temporary set, the potential benefit score corresponding to each candidate dimension is determined, wherein the parent node corresponding to each dimensional element under each candidate dimension is the same.

6. The method according to claim 4, characterized in that Determining the tree nodes under the first-layer branches and the second-layer branches includes: Sort the dimensional elements under the target branch in descending order according to the influence value, and determine the isolation value of each dimensional element of the target branch in sequence starting from the dimensional element with the largest influence value, wherein the isolation value is used to represent the difference between the indicator values ​​of the dimensional element in the previous and next cycles, and the target branch is any one of the first-layer branches and the second-layer branches; The dimensional elements of the target branch whose isolation value is greater than the isolation value of the parent node of the corresponding dimensional element and whose interpretation value is greater than the third threshold are sequentially added to the result set until the interpretation value of the dimensional element in the result set reaches the fourth threshold, wherein the interpretation value is used to indicate the proportion of the indicator change of the dimensional element in the first period and the second period; The dimension elements in the result set are determined as tree nodes under the target branch in the root cause location tree.

7. The method according to claim 3, characterized in that The method further comprises: Traversing the tree nodes, determining the tree nodes that do not meet the second condition as target tree nodes, and continuing to determine branches under the target tree nodes; A tree node satisfying the second condition is determined as a leaf node.

8. The method according to claim 7, characterized in that Determining a tree node that meets the second condition as a leaf node includes: Obtaining a first index value of a first tree node in the first cycle, a second index value of the first tree node in the second cycle, and obtaining a global index value of the first tree node in all cycles, wherein the first tree node is any tree node in the root cause location tree; Determine a difference between the first index value and the second index value; When the ratio of the difference value to the global index value is less than or equal to a preset threshold, determining that the first tree node satisfies the second condition; The first tree node is determined as the leaf node.

9. The method according to claim 3, characterized in that: Determining the abnormal root cause path corresponding to the report data set according to the root cause location tree includes: Determine the contribution of all leaf nodes in the root cause location tree, wherein the contribution is the ratio of the sum of the index value changes of the leaf node in the first cycle and the second cycle to the difference between the first index value and the second index value, wherein the first index value is the index value of the leaf node in the first cycle, and the second index value is the index value of the leaf node in the second cycle; Determine the path of the leaf node whose contribution is less than the fifth threshold in the root cause location tree as the abnormal root cause path; When the contribution is greater than or equal to the fifth threshold, determining a third index value of other data in the report data set except the data corresponding to the root cause path in the root cause location tree in the first period and a fourth index value of the other data in the second period; Determine a first difference between the third indicator value and the first indicator value, and determine a second difference between the fourth indicator value and the second indicator value; When the change directions of the first difference and the second difference are inconsistent, the root cause location process ends; When the first difference value and the second difference value have the same change direction, deleting the data used in the root cause location tree from the report data set to obtain remaining data; A new root cause location tree is continuously constructed according to the remaining data, and the root node and depth of the new root cause location tree are initialized.

10. The method according to claim 9, characterized in that The method comprises: Adding all abnormal root cause paths in the root cause location tree to the target result set, and performing deduplication processing on the target result set; Determine the parent node of each leaf node corresponding to the abnormal root cause path in the target result set; Determine the sum of the explanation values ​​of all leaf nodes under the parent node, wherein the explanation value is used to represent the proportion of the indicator change of the dimension element in the first period and the second period; When the sum of the explanation values ​​is less than or equal to the sixth threshold, the abnormal root cause paths associated with all leaf nodes under the parent node are deleted from the target result value.

11. A device for locating the root cause of an abnormality, characterized in that: include: An acquisition module, used to acquire a report data set for root cause location, wherein the report data set includes at least one indicator and multiple dimensions, each dimension including multiple dimension elements; A construction module, used to construct a root cause location tree according to the report data set; A determination module is used to determine the abnormal root cause path corresponding to the report data set according to the root cause location tree.

12. An electronic device, characterized in that: include: A memory and a processor, wherein the memory is used to store program instructions; the processor is connected to the memory and is used to execute the method for locating the root cause of anomaly as described in any one of claims 1 to 10.

13. A non-volatile storage medium, characterized in that: The non-volatile storage medium includes a stored computer program, wherein the device where the non-volatile storage medium is located executes the method for locating the root cause of anomaly as described in any one of claims 1 to 10 by running the computer program.

14. A computer program product comprising computer instructions, characterized in that When the computer instructions are executed by a processor, the method for locating the root cause of an abnormality as described in any one of claims 1 to 10 is implemented.

Images