Application monitoring method and device, equipment, storage medium and product

Abstract

The invention discloses an application monitoring method and device, equipment, a storage medium and a product, and relates to the technical field of anomaly detection, and the method comprises the steps: generating a performance index baseline based on historical performance index data of a target business system; monitoring the target business system to obtain real-time performance index data; generating an original alarm information set through a preset general anomaly detection algorithm, the real-time performance index data and the performance index baseline; the original alarm information set is iteratively optimized through a preset alarm enhancement strategy, an alarm enhancement information set is obtained, and by means of the scheme, the fault discovery accuracy is improved in the alarm enhancement mode on the premise that a classification algorithm is not needed.

Description

Technical Field

[0001] The present application relates to the field of anomaly detection technology, and in particular to an application monitoring method, device, equipment, storage medium and product. Background Art

[0002] Through application monitoring, the operation and maintenance team can promptly discover and handle potential problems, ensuring the continuous availability and stability of business applications. At the same time, the number and quality of alarms in the application monitoring link affect the reliability of the actions required after the abnormality is discovered. Therefore, in order to improve the quality and efficiency of emergency response, the accuracy of anomaly detection in application monitoring is particularly important.

[0003] At present, there are two main ways to implement anomaly detection algorithms in IT application monitoring, based on the number of algorithms. The first is to use a single anomaly detection algorithm to complete the monitoring of multiple IT applications. This type of method uses the historical indicators of the IT application system to train the algorithm and output the model. In the actual operation of the IT application, the collected real-time IT application indicator data is input into the model to obtain the anomaly judgment result, and the IT application is monitored and alarmed based on this result. The second is to use multiple anomaly detection algorithms to complete the monitoring of multiple IT applications. This type of method uses artificial prior knowledge, classification algorithms, and clustering algorithms to classify IT application systems, and selects different anomaly detection algorithms for each category. However, whether using a single anomaly detection algorithm or multiple anomaly detection algorithms, the existing methods have certain shortcomings.

[0004] Existing methods that use a single anomaly detection algorithm only have one anomaly detection algorithm, which cannot adapt to multiple data forms. They have poor performance on IT application systems with complex data features or business characteristics, and it is difficult to achieve good monitoring performance globally when there are a large number of monitored IT applications. At the same time, after adjusting the algorithm for the data features of a certain IT application, it is easy to affect its fault detection performance on other IT applications. Most of the existing methods that use multiple anomaly detection algorithms rely on clustering, classification, and artificial prior knowledge to classify IT applications, and the subsequent processes are overly dependent on the classification results. There are many limitations. In addition, when the data form of the IT application changes, it is impossible to automatically identify the changes, resulting in poor fault detection performance.

[0005] The above contents are only used to assist in understanding the technical solution of the present application and do not constitute an admission that the above contents are prior art. Summary of the invention

[0006] The main purpose of this application is to provide an application monitoring method, apparatus, device, storage medium and computer program product, aiming to improve the accuracy of fault detection by alarm enhancement.

[0007] To achieve the above objectives, the present application proposes an application monitoring method, the method comprising:

[0008] Generate performance indicator baselines based on historical performance indicator data of the target business system;

[0009] Monitor the target business system to obtain real-time performance indicator data;

[0010] Generate an original alarm information set through a preset general anomaly detection algorithm and the real-time performance indicator data and the performance indicator baseline;

[0011] The original alarm information set is iteratively optimized through a preset alarm enhancement strategy to obtain an alarm enhancement information set.

[0012] In one embodiment, the real-time performance indicator data includes several performance characteristic indicators of the target business system, and the step of generating an original alarm information set by using a preset general anomaly detection algorithm and the real-time performance indicator data and the performance indicator baseline includes:

[0013] Calculate the index difference between the plurality of performance characteristic indexes and the respective corresponding performance index baselines by using a preset general anomaly detection algorithm;

[0014] Determine whether the difference of the indicator exceeds a preset difference threshold;

[0015] If the indicator difference exceeds the difference threshold, the performance characteristic indicator is determined as the target performance characteristic indicator;

[0016] Corresponding alarm information is generated based on the target performance characteristic indicator to obtain an original alarm information set.

[0017] In one embodiment, the step of iteratively optimizing the original alarm information set by using a preset alarm enhancement strategy to obtain the alarm enhancement information set includes:

[0018] Based on the real-time performance indicator data, generating a supplementary monitoring object set according to a supplementary monitoring strategy;

[0019] Performing anomaly detection on the real-time performance indicator data in the supplementary monitoring object set according to a preset anomaly detection optimization algorithm to obtain an alarm supplementary information set;

[0020] Based on the alarm supplementary information set, generating an enhanced monitoring object set according to the supplementary monitoring strategy;

[0021] According to a preset anomaly detection optimization algorithm, anomaly detection is performed on the real-time performance indicator data in the enhanced monitoring object set to obtain alarm enhancement information.

[0022] In one embodiment, the step of generating a supplementary monitoring object set based on the real-time performance indicator data and the original alarm information set includes:

[0023] Counting the number of false alarms and missed alarms corresponding to each of the several performance characteristic indicators;

[0024] Determine the false alarm rate and the missed alarm rate corresponding to each of the plurality of performance characteristic indicators according to the number of false alarms and the number of missed alarms;

[0025] Determine as a target optimization alarm indicator any performance characteristic indicator of the number of false alarms, the number of missed alarms, the false alarm rate and the number of false alarms that exceeds a preset false alarm threshold;

[0026] A supplementary monitoring object set is generated based on the target optimization alarm indicator.

[0027] In one embodiment, the anomaly detection optimization algorithm includes at least one of an anomaly detection algorithm based on time series, an anomaly detection algorithm based on machine learning, and an anomaly detection algorithm based on deep learning, and the training process of the anomaly detection optimization algorithm includes:

[0028] Based on the type of the anomaly detection optimization algorithm, construct a corresponding anomaly detection optimization basic model;

[0029] Using the historical performance indicator data, offline tuning is performed on the target parameters in the anomaly detection optimization basic model to obtain an anomaly detection optimization intermediate model;

[0030] Based on the anomaly detection optimization intermediate model, the data change trend of the real-time performance indicator data is incrementally learned to obtain an anomaly detection optimization algorithm.

[0031] In one embodiment, before the step of iteratively optimizing the original alarm information set by using a preset alarm enhancement strategy to obtain the alarm enhancement information set, the step further includes:

[0032] Perform a historical alarm simulation test run based on the anomaly detection optimization algorithm and the historical performance indicator data to obtain a test run recall rate and a test run accuracy rate;

[0033] If the trial run recall rate and the trial run accuracy rate meet the preset conditions, the anomaly detection optimization algorithm is introduced.

[0034] In addition, to achieve the above-mentioned purpose, the present application also proposes an application monitoring device, the application monitoring device comprising:

[0035] A generation module is used to generate a performance indicator baseline based on the historical performance indicator data of the target business system;

[0036] A monitoring module, used to monitor the target business system to obtain real-time performance indicator data;

[0037] An alarm module, used to generate an original alarm information set through a preset general anomaly detection algorithm and the real-time performance indicator data and the performance indicator baseline;

[0038] The enhancement module is used to iteratively optimize the original alarm information set through a preset alarm enhancement strategy to obtain an alarm enhancement information set.

[0039] In addition, to achieve the above objectives, the present application also proposes an application monitoring device, which includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the application monitoring method described above.

[0040] In addition, to achieve the above-mentioned purpose, the present application also proposes a storage medium, which is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, the steps of the application monitoring method described above are implemented.

[0041] In addition, to achieve the above-mentioned purpose, the present application also provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, the steps of the application monitoring method described above are implemented.

[0042] One or more technical solutions proposed in the present application generate a performance indicator baseline based on historical performance indicator data of the target business system; monitor the target business system to obtain real-time performance indicator data; generate an original alarm information set through a preset general anomaly detection algorithm and the real-time performance indicator data and the performance indicator baseline; iteratively optimize the original alarm information set through a preset alarm enhancement strategy to obtain an alarm enhancement information set. Through the above solution, the accuracy of fault detection is improved by alarm enhancement without the need for a classification algorithm. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0044] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0045] Figure 1A flowchart of the first embodiment of the monitoring method for the present application is provided;

[0046] Figure 2 A flow chart of the second embodiment of the monitoring method for the present application is provided;

[0047] Figure 3 A flowchart of the alarm enhancement strategy for the monitoring method applied in this application;

[0048] Figure 4 Replace the logic diagram for the application of monitoring method algorithm for this application;

[0049] Figure 5 This is a schematic diagram of the replacement process of the anomaly detection optimization algorithm in the monitoring method used in this application and the algorithm online evaluation process;

[0050] Figure 6 This is a schematic diagram of the business layered decoupling structure of the monitoring method used in this application;

[0051] Figure 7 A schematic diagram of the data flow of the anomaly detection algorithm in the monitoring method used in this application;

[0052] Figure 8 A technical framework and architecture diagram of the anomaly detection algorithm in the monitoring method used in this application;

[0053] Fig. 9 This is a schematic diagram of the module structure of the monitoring device used in the embodiment of the present application;

[0054] Fig.10 A schematic diagram of the device structure of the hardware operating environment involved in the application monitoring method in the embodiment of the present application.

[0055] The purpose, features and advantages of this application will be further described in conjunction with the embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0056] It should be understood that the specific embodiments described herein are only used to explain the technical solutions of the present application and are not used to limit the present application.

[0057] In order to better understand the technical solution of the present application, a detailed description will be given below in conjunction with the accompanying drawings and specific implementation methods.

[0058] The main solution of the embodiment of this application is: to propose a method based on anomaly detection algorithm and alarm enhancement to improve the accuracy and ease of use of operation and maintenance monitoring, and to intelligently select and optimize the anomaly detection algorithm that best suits the current data characteristics by analyzing the multi-dimensional historical indicator data of the application system and combining it with real-time alarm conditions to form an efficient anomaly detection model. In order to adapt to changing business needs, an algorithm library containing multiple algorithms is built in the solution, so that the product can flexibly respond to monitoring tasks in different scenarios. In addition, the solution also proposes a set of algorithm selection and replacement strategies to ensure that the high accuracy of fault detection can be maintained in various business scenarios and data characteristics.

[0059] To further improve ease of use, the solution also designed an anomaly detection algorithm platform that integrates key functions such as alarm annotation, model training, algorithm configuration and replacement, making the use and management of the algorithm more intuitive and convenient. In terms of alarm enhancement, the solution adopts an iterative optimization method to continuously adjust and optimize the algorithm based on the alarm results, similar to the Boosting technology, to improve the accuracy of the alarm. At the same time, in order to support the rapid iteration and update of the algorithm, the solution also proposes a general, pluggable algorithm system framework that allows algorithm components to be flexibly replaced and updated between different monitoring objects.

[0060] Finally, in order to simplify the configuration and replacement operations during the use of the algorithm, the solution also developed a series of tools for algorithm use, which further enhanced the user-friendliness and operational efficiency of the entire monitoring system. Overall, this solution provides a comprehensive, efficient and easy-to-manage monitoring tool for the IT application monitoring field through technological innovation, aiming to help the operation and maintenance team more effectively discover and handle potential system problems and ensure the continuous availability and stability of business applications.

[0061] Due to the existing technology, it is difficult to adapt to the diverse data forms and complex business characteristics when using a single anomaly detection algorithm, resulting in poor performance on specific IT application systems. In addition, adjusting the algorithm to optimize the monitoring performance of a certain application may have a negative impact on other applications, making it difficult to balance the overall monitoring performance. The existing technology also relies too much on artificial prior knowledge and classification algorithms to classify IT applications, which not only increases the complexity of the system, but also limits its flexibility and adaptability. At the same time, the existing monitoring system has insufficient recognition ability for changes in data forms and cannot respond to changes in system status in a timely manner, resulting in a decrease in fault detection performance. In terms of ease of use, the existing technology usually does not consider the relationship between data storage and algorithm adaptability, alarm annotation and algorithm configuration, which makes the operation and maintenance team face high operational difficulties during use. Finally, the existing monitoring system generally lacks an effective dynamic algorithm optimization and update mechanism, making it difficult to dynamically adjust the algorithm based on real-time monitoring data and alarm results, affecting the accuracy and efficiency of monitoring. These problems together lead to the limitations and shortcomings of existing IT application monitoring technology in actual operation and maintenance.

[0062] The present application provides a solution, which generates a performance indicator baseline based on historical performance indicator data of a target business system; monitors the target business system to obtain real-time performance indicator data; generates an original alarm information set through a preset general anomaly detection algorithm and the real-time performance indicator data and the performance indicator baseline; iteratively optimizes the original alarm information set through a preset alarm enhancement strategy to obtain an alarm enhancement information set. Through the above solution, the accuracy of fault detection is improved by alarm enhancement without the need for a classification algorithm.

[0063] It should be noted that the execution subject of this embodiment can be a computing service device with application monitoring, network communication and program running functions, such as a tablet computer, a personal computer, a mobile phone, etc., or an electronic device capable of realizing the above functions, an application monitoring system, etc. The following takes the application monitoring system as an example to illustrate this embodiment and the following embodiments.

[0064] Based on this, the present application embodiment provides an application monitoring method, referring to Figure 1 , Figure 1 This is a flow chart of the first embodiment of the monitoring method used in this application.

[0065] In this embodiment, the application monitoring method includes steps S1000 to S4000:

[0066] Step S1000: Generate a performance indicator baseline based on historical performance indicator data of the target business system;

[0067] In this embodiment, IT application monitoring uses the application request volume, response rate, success rate, average response time, application CPU usage, and application memory usage to monitor and analyze the operating status and performance of the business application system in real time. Through IT application monitoring, the operation and maintenance team can promptly discover and deal with potential problems to ensure the continuous availability and stability of business applications. At the same time, the number and quality of alarms in the IT application monitoring link affect the reliability of the actions required after the abnormality is discovered. Therefore, in order to improve the quality and efficiency of emergency response, the accuracy of abnormality detection in IT application monitoring is particularly important.

[0068] It should be noted that in this embodiment, the significance of IT application monitoring mainly includes: 1. Through automated monitoring means, the time cost of manual inspection and troubleshooting is reduced, and the operation and maintenance efficiency is improved. 2. Timely discovery and handling of potential problems ensure the stable operation of the business application system and the continuity of the business. 3. According to the monitoring data analysis results, reasonable adjustment of resource allocation is made to improve resource utilization and reduce cost expenditure.

[0069] For millions or tens of millions of IT applications to be monitored, a set of intelligent operation and maintenance anomaly detection algorithm systems with high accuracy, simple configuration and strong timeliness are needed to achieve overall effective monitoring, so that limited emergency resources can focus on the anomalies that really need attention and improve emergency efficiency.

[0070] It should be noted that, in this embodiment, generating a performance indicator baseline based on the historical performance indicator data of the target business system is the first step in building an anomaly detection model. The performance indicator baseline generally refers to the statistical characteristics of the performance indicator calculated based on historical data, such as mean, median, mode, variance, etc. The purpose of this step is to establish a "normal" reference standard for performance so that abnormal behaviors that are significantly different from this standard can be identified later.

[0071] In addition, it should be noted that the process of generating a performance indicator baseline can be achieved through a variety of statistical methods, such as moving average, exponential smoothing, etc. The construction of the baseline needs to consider the time span of historical data and the stability of the data to ensure the accuracy and reliability of the baseline.

[0072] For example, in a specific implementation, the system first collects performance indicator data of the business system over a period of time, such as CPU usage, memory usage, transaction response time, etc. Then, the system uses statistical analysis methods to calculate the mean and standard deviation of these indicators to form performance indicator baselines. These baselines will serve as reference standards for subsequent anomaly detection.

[0073] Step S2000: monitoring the target business system to obtain real-time performance indicator data;

[0074] It should be noted that monitoring the target business system to obtain real-time performance indicator data is an indispensable part of the anomaly detection process. Real-time performance indicator data refers to the performance data generated when the system is running at present or in the near future, such as the current CPU load, memory usage, network traffic, etc. The purpose of this step is to capture the latest status of the system and detect possible anomalies in a timely manner.

[0075] In addition, it should be noted that the acquisition of real-time performance indicator data can be achieved through various monitoring tools and probes. These tools can be deployed at various key nodes of the business system to collect and transmit data in real time. The acquired data needs to be highly real-time and accurate so that it can truly reflect the performance status of the system.

[0076] For example, in a specific implementation, the system deploys multiple monitoring probes on key components of the business system, such as database servers, application servers, etc. These probes collect performance indicators such as CPU usage, memory usage, response time, etc. in real time, and send the data to the monitoring center for analysis.

[0077] In a feasible implementation manner, the real-time performance indicator data includes several performance characteristic indicators of the target business system, and step S2000 may include steps S2100 to S2300:

[0078] Step S2100: calculating the index difference between the plurality of performance characteristic indexes and the respective corresponding performance index baselines by using a preset general anomaly detection algorithm;

[0079] Step S2200: determining whether the indicator difference exceeds a preset difference threshold;

[0080] Step S2300: if the indicator difference exceeds the difference threshold, the performance characteristic indicator is determined as the target performance characteristic indicator;

[0081] Step S2400: Generate corresponding alarm information based on the target performance characteristic indicator to obtain an original alarm information set.

[0082] It should be noted that real-time performance indicator data is key information that reflects the current operating status of the target business system, and usually covers the performance of the system in different dimensions, such as CPU usage, memory utilization, network traffic, response time, etc. These indicators are the basis for monitoring system performance and stability. By tracking and analyzing them in real time, potential problems and anomalies can be discovered in a timely manner.

[0083] During the monitoring process, the system uses a preset general anomaly detection algorithm to calculate the difference between these performance characteristic indicators and the pre-established performance indicator baseline. The performance indicator baseline is the normal operating range based on historical data, while the indicator difference reflects the degree of deviation of real-time data from the normal range. By setting a difference threshold, the system can determine when the deviation exceeds the normal fluctuation range and thus identify possible abnormal situations.

[0084] When the indicator difference exceeds the threshold, the corresponding performance characteristic indicators are determined as target performance characteristic indicators, that is, those indicators that show abnormal behavior. Based on these target performance characteristic indicators, the system will generate corresponding alarm information and build an original alarm information set. Each alarm in the alarm information set records in detail the time, location, performance indicators involved and other key information of the abnormality, providing an important basis for subsequent analysis and processing.

[0085] In addition, it should be noted that the introduction of the alarm enhancement strategy is to further improve the accuracy and reliability of alarm information. Through iterative optimization, the system can reduce false positives and missed positives and improve the relevance and accuracy of alarms. This strategy involves further analysis and processing of the original alarm information set, including but not limited to the verification, merging, and priority sorting of alarms.

[0086] For example, in one feasible implementation, the system first collects historical performance data of the target business system and generates a performance indicator baseline based on this data. Then, the system monitors the performance indicators of the business system in real time. Once an indicator is found to be significantly different from the baseline, the difference is calculated and a determination is made as to whether it exceeds the threshold. For indicators that exceed the threshold, the system generates an alarm message and applies an alarm enhancement strategy for further analysis and optimization based on the content and context of the alarm. In this way, the system can not only detect anomalies in a timely manner, but also provide more accurate and useful alarm information, helping the operation and maintenance team to deal with potential problems more effectively.

[0087] Step S3000: Generate an original alarm information set by using a preset general anomaly detection algorithm, the real-time performance indicator data, and the performance indicator baseline;

[0088] It should be noted that the core of the anomaly detection process is to generate the original alarm information set through the preset general anomaly detection algorithm, real-time performance indicator data and performance indicator baseline. General anomaly detection algorithm refers to an algorithm that can be applied to a variety of business systems and scenarios, such as statistical process control algorithms, clustering algorithms, etc. The purpose of this step is to use the algorithm to compare real-time data with the baseline and quickly identify possible anomalies.

[0089] In addition, it should be noted that the algorithm will determine whether the real-time data deviates from the normal range according to the preset rules or thresholds, thereby generating alarm information. These alarm information usually include key information such as the time, location, and type of the abnormality, providing a basis for subsequent analysis and processing.

[0090] Specifically, in the present embodiment, in the absence of prior knowledge, only the a posteriori situation can be relied on for rapid iteration to find a suitable algorithm. Based on the general algorithm, the present method continuously selects a more suitable algorithm according to the actual anomaly detection effect, so as to achieve an ideal alarm effect. Specifically, based on the a posteriori situation (final monitoring effect), the present method adopts a Boosting-like method to continuously enhance the accuracy of the alarm result, and iterates a suitable algorithm to achieve the purpose of "a priori classification". All monitored objects will use a general anomaly detection algorithm to generate an alarm. The algorithm uses the historical data of various application indicators to calculate the statistical characteristics of the mean, variance, maximum and minimum values ​​of the indicators using a statistical method, and forms a baseline value. An alarm is issued when the value of the real-time indicator of the application is lower than the baseline value. The use of this algorithm can quickly realize the monitoring of a large number of applications, but the performance of the algorithm on some monitored objects is not ideal, resulting in false alarms or missed alarms, which in turn leads to a decrease in the monitoring performance of the application.

[0091] For example, in a specific implementation, the system uses a general anomaly detection algorithm based on statistics, which calculates the deviation between the real-time performance indicator data and the baseline and sets a threshold. When the deviation exceeds the threshold, the system considers that an anomaly is detected and generates corresponding alarm information.

[0092] Step S4000: iteratively optimize the original alarm information set through a preset alarm enhancement strategy to obtain an alarm enhancement information set.

[0093] It should be noted that the purpose of iterative optimization of the original alarm information set through the preset alarm enhancement strategy is to improve the accuracy of the alarm and reduce false alarms or missed alarms. The alarm enhancement strategy can include further analysis, filtering and confirmation of the original alarm, as well as pattern recognition based on historical alarm data and real-time performance data.

[0094] In addition, it should be noted that the implementation of the alarm enhancement strategy can be achieved through machine learning, deep learning, etc. These technologies can learn and optimize alarm rules from a large amount of historical data to improve the relevance and accuracy of alarms.

[0095] For example, in a specific implementation, the system first performs a preliminary screening of the original alarm information set to exclude those alarms that are frequently false alarms. Then, the system uses a machine learning model to analyze the remaining alarms, classify and prioritize the alarms based on the historical patterns of the alarms and the characteristics of the real-time data, thereby generating a more accurate and reliable alarm enhanced information set.

[0096] In a feasible implementation manner, step S4000 may include steps S4100 to S4400:

[0097] Step S4100: Based on the real-time performance indicator data, generate a supplementary monitoring object set according to a supplementary monitoring strategy;

[0098] Step S4200: performing anomaly detection on the real-time performance indicator data in the supplementary monitoring object set according to a preset anomaly detection optimization algorithm to obtain an alarm supplementary information set;

[0099] Step S4300: Based on the alarm supplementary information set, generate an enhanced monitoring object set according to the supplementary monitoring strategy;

[0100] Step S4400: Perform anomaly detection on the real-time performance indicator data in the enhanced monitoring object set according to a preset anomaly detection optimization algorithm to obtain alarm enhancement information.

[0101] It should be noted that the alarm enhancement strategy is one of the core links of the present invention, which aims to improve the accuracy and reliability of alarms through an iterative optimization process. The strategy generates a supplementary set of monitoring objects by analyzing real-time performance indicator data and combining it with preset monitoring rules, and performs in-depth anomaly detection on these objects to identify and supplement abnormal situations that may be missed. The anomaly detection optimization algorithm plays a key role in this process. It can select the most appropriate algorithm model for real-time analysis and prediction based on different types of data and scenario requirements.

[0102] In addition, it should be noted that the alarm enhancement process not only includes the analysis of real-time data, but also involves the study and simulation of historical alarm data. Through simulation trials, the system can evaluate the performance of the new algorithm on historical data to ensure its effectiveness in practical applications. This process helps reduce false positives and missed positives and improves the practicality and accuracy of alarms.

[0103] For example, in a feasible implementation, the system first determines the set of monitoring objects that need extra attention based on real-time performance indicator data and preset supplementary monitoring strategies. Then, the system uses anomaly detection optimization algorithms, such as methods based on time series analysis, machine learning, or deep learning, to conduct in-depth analysis of the real-time data of these objects, identify potential abnormal patterns, and generate a set of supplementary alarm information. Next, the system further screens and confirms the enhanced monitoring object set based on the alarm supplementary information set and the supplementary monitoring strategy, and analyzes these objects again to obtain the final alarm enhancement information. In this process, the system can also conduct a historical alarm simulation test run to verify the effectiveness of the new algorithm and ensure that it can meet the preset performance requirements. Through this series of iterative optimization steps, the system can generate a more accurate and information-rich alarm enhancement information set to provide more reliable decision support for the operation and maintenance team.

[0104] Specifically, the anomaly detection optimization algorithm in this embodiment can mainly include three categories, one of which is the anomaly detection algorithm for time series, which is usually used to process data points arranged in chronological order. This type of algorithm model is simple, effective, fast training speed, and strong interpretability. Common algorithms include: Holt-Wintess, ARIMA, Prophet, which take into account the trend, seasonality and other patterns of data changing over time. For example, the autoregressive integrated moving average (ARIMA) model is a commonly used time series prediction method that predicts future data points by fitting historical data and identifies those anomalies that significantly deviate from the predicted values. In addition, the exponential smoothing state space model (ETS) is also an effective method for processing data with trends and seasonality.

[0105] And anomaly detection algorithms based on machine learning, machine learning algorithms identify anomalies by learning patterns from historical data. These algorithms can be supervised or unsupervised. Such algorithms are effective for complex data and have certain interpretability. Common algorithms include: SVM, DBSCN, among which unsupervised learning algorithms such as K-means clustering and principal component analysis (PCA) are often used for anomaly detection because they can identify abnormal patterns in data without clear labels. For example, K-means clustering can divide data points into several clusters, and points far away from the center of any cluster may be outliers. Another popular unsupervised machine learning algorithm is isolation forest, which "isolates" observations by randomly selecting a feature and split point, and anomalies are usually easier to isolate.

[0106] There are also anomaly detection algorithms based on deep learning. Deep learning algorithms, especially neural networks, can learn high-level feature representations from complex data structures. Anomaly detection algorithms based on deep learning Such algorithms are effective and accurate for complex data, but the training cost is large and the interpretability is poor. Common algorithms include: LSTM Long Short-Term Memory Network (LSTM) is a special recurrent neural network (RNN) that can handle and predict sequence dependency problems in time series and is very suitable for anomaly detection. LSTM recognizes normal patterns by learning long-term dependencies and can highlight behaviors that violate these patterns. In addition, autoencoders are a method of learning data compression representations through neural networks, which can be used to identify anomalies in data because anomalies cannot usually be effectively compressed.

[0107] This embodiment provides an application monitoring method, which generates a performance indicator baseline based on historical performance indicator data of a target business system; monitors the target business system to obtain real-time performance indicator data; generates an original alarm information set through a preset general anomaly detection algorithm and the real-time performance indicator data and the performance indicator baseline; iteratively optimizes the original alarm information set through a preset alarm enhancement strategy to obtain an alarm enhancement information set. Through the above scheme, by means of alarm enhancement, the accuracy of fault detection is improved without the need for a classification algorithm.

[0108] Based on the first embodiment of the present application, in the second embodiment of the present application, the same or similar contents as those in the above-mentioned embodiment 1 can be referred to the above introduction, and will not be repeated in the following. Figure 2 , step S4100 of the application monitoring method further includes steps S4110 to S4140:

[0109] Step S4110: Counting the number of false alarms and missed alarms corresponding to each of the plurality of performance characteristic indicators;

[0110] Step S4120: determining the false alarm rate and the missed alarm rate corresponding to each of the plurality of performance characteristic indicators according to the number of false alarms and the number of missed alarms;

[0111] Step S4130: determining the performance characteristic indicator of any one of the number of false alarms, the number of missed alarms, the false alarm rate and the number of false alarms exceeding the preset false alarm threshold as the target optimization alarm indicator;

[0112] Step S4140: Generate a supplementary monitoring object set based on the target optimization alarm indicator.

[0113] It should be noted that counting the number of false positives and false negatives corresponding to several performance characteristic indicators is one of the key steps in the alarm enhancement strategy. False positives refer to the incorrect marking of normal events as abnormal, while false negatives refer to the failure to detect real abnormal events. By accurately counting the number of occurrences of these events, the performance of the monitoring system on specific performance indicators can be quantified and provide a basis for subsequent optimization.

[0114] Reference Figure 3 , Figure 3 This is a flow chart of the alarm enhancement strategy for the monitoring method used in this application. All monitored objects will generate alarms using a common anomaly detection algorithm. The algorithm uses historical data of various application indicators to calculate the mean, variance, maximum and minimum values ​​and other statistical characteristics of the indicators using a statistical method, and forms a baseline value. An alarm is issued when the value of the application's real-time indicator is lower than the baseline value. The use of this algorithm can quickly monitor a large number of applications, but the performance of the algorithm on some monitored objects is not ideal, resulting in false alarms or missed alarms, which in turn leads to a decrease in the monitoring performance of the application.

[0115] Based on the false alarm and missed alarm results of the general anomaly detection algorithm, the number of false alarms and missed alarms is counted, the false alarm rate and missed alarm rate are calculated, and the upper limits of these four indicators are set according to business needs. The upper limits are used to screen out a set of monitoring objects A that have poor monitoring performance on the general anomaly detection algorithm. A new anomaly detection algorithm is used on such objects to obtain alarm results.

[0116] Similarly, the new anomaly detection algorithm cannot be perfectly applied to all monitored objects in the monitoring object set A. Therefore, according to the results of false alarms and missed alarms, the set A is filtered and screened in the same way using the number of false alarms, the number of missed alarms, the false alarm rate and the missed alarm rate to obtain the monitoring object set B, and the new anomaly detection algorithm B is used to obtain the alarm result.

[0117] The above steps are repeated continuously. During this repetitive process, the new anomaly detection algorithm B is more complex than the anomaly detection algorithm A, and can dig out the deep characteristics of the application indicators, with better fitting and anomaly detection effects.

[0118] By integrating all the above alarms, we can get an alarm set that is almost completely accurate. This alarm can accurately prompt when the application status is abnormal, and it also includes alarm information including abnormal indicators, abnormal time, brief description, etc.

[0119] In a feasible implementation, the anomaly detection optimization algorithm includes at least one of an anomaly detection algorithm based on time series, an anomaly detection algorithm based on machine learning, and an anomaly detection algorithm based on deep learning. The training process of the anomaly detection optimization algorithm includes steps A1000 to A3000:

[0120] Step A1000: Based on the type of the anomaly detection optimization algorithm, construct a corresponding anomaly detection optimization basic model;

[0121] Step A2000: Using the historical performance indicator data, offline tuning is performed on the target parameters in the anomaly detection optimization basic model to obtain an anomaly detection optimization intermediate model;

[0122] Step A3000: Incrementally learn the data change trend of the real-time performance indicator data based on the anomaly detection optimization intermediate model to obtain an anomaly detection optimization algorithm.

[0123] It should be noted that the anomaly detection optimization algorithm is the key technology used in the present invention to improve the accuracy of IT application monitoring. The algorithm constructs a multi-level and multi-dimensional anomaly detection system by comprehensively using advanced technologies such as time series analysis, machine learning, and deep learning. Figure 4 , Figure 4 The monitoring method algorithm used in this application replaces the logical schematic diagram. Different from the traditional Boosting algorithm, the implementation idea of ​​this embodiment is not to integrate all algorithms into an enhanced model, but to enhance the final alarm result, thereby achieving the effect of improving the monitoring accuracy.

[0124] All monitored objects are filtered using algorithms at different stages. Since there is a certain tolerance for the algorithm effect, a progressive strategy can be adopted at the algorithm selection level: first, a general default algorithm is used for monitoring; in the second stage, an anomaly detection algorithm based on time series is used. This type of algorithm has a simple model, fast training speed, strong interpretability, and significant effect on more complex data; in the third stage, some machine learning-based algorithms are used for anomaly detection. This type of algorithm works well for complex data and still has a certain degree of interpretability; in the final stage, algorithms based on deep learning are selected. This type of algorithm has excellent performance, but requires a lot of training resources and has poor interpretability.

[0125] The above algorithm mainly consists of three steps in practical application: offline model training, model update training and online real-time anomaly detection.

[0126] The offline training part of the model mainly uses the long-term application historical indicator data to tune the various parameters of the model. In this process, various parameter tuning methods such as gradient descent method and Adam optimizer can be used to search parameters, and finally obtain the algorithm model after parameter tuning. The model has a certain fitting ability for application indicator data and can output anomaly detection results when real-time indicator data is input.

[0127] As time goes by, the form of the application's indicator data will change. Since the model obtained by the above offline training process fits historical data, when the application indicator data changes, the indicator's fitting ability will also decrease, which will lead to a decrease in anomaly detection performance. At this time, it is necessary to incrementally learn the trend changes of new data based on the initialization model to correct the model in order to continuously improve the generalization ability of the model. The specific process is: based on the model parameters obtained by offline training, the model parameters are adjusted using new incremental data. The adjustment process also uses a variety of parameter tuning methods such as gradient descent and Adam optimizer. After tuning, the algorithm model with optimized parameters is output.

[0128] The online anomaly detection process inputs real-time application indicator data into the algorithm model after parameter tuning, and obtains the output result through calculation, which is the anomaly detection result.

[0129] In this embodiment, the training process of the anomaly detection optimization algorithm first starts with building a basic model, and selecting a suitable mathematical model and initial parameters according to the characteristics of the algorithm. For example, for an algorithm based on time series, a suitable statistical model and parameters are selected; for an algorithm based on machine learning or deep learning, a suitable network structure and initialization weights can be selected.

[0130] Next, the system uses historical performance indicator data to perform offline tuning on the basic model. This process reveals the behavior patterns of the business system under normal and abnormal conditions through historical data, allowing the algorithm model to more accurately identify and predict future abnormal events. Offline tuning usually uses supervised learning or unsupervised learning methods to adjust model parameters through optimization algorithms such as gradient descent to minimize prediction errors.

[0131] Subsequently, based on the tuned intermediate model, the system further improves and optimizes the algorithm model through incremental learning of the data change trends of real-time performance indicator data, so that the algorithm can adapt to the changes in business system performance indicators over time and maintain the timeliness and accuracy of anomaly detection.

[0132] Finally, the performance of the algorithm model is evaluated through simulated test runs and actual applications. This includes calculating the recall rate and accuracy rate during the test run phase to verify the effectiveness of the algorithm. Only when the test run results meet the preset conditions will the algorithm be formally introduced into the monitoring system to ensure its effectiveness and reliability in actual applications.

[0133] For example, in one feasible implementation, the system first collects historical performance data of the target business system, including indicators such as CPU usage, memory usage, and transaction response time. Then, based on these data, the system builds an ARIMA model based on time series, a random forest model based on machine learning, and an LSTM model based on deep learning. Through offline tuning, the system determines the optimal parameter configurations for these models. Next, the system uses real-time data to perform incremental learning on these models to adapt to the latest changes in performance indicators. During the simulation trial run, the system evaluated the recall and accuracy of these models, and after confirming that they meet the preset performance standards, they are formally applied to the real-time monitoring of the business system, thereby achieving efficient and accurate detection of business system anomalies.

[0134] In a feasible implementation manner, before step S4000, steps B1000 to B2000 are also included:

[0135] Step B1000: Perform a historical alarm simulation test run based on the anomaly detection optimization algorithm and the historical performance indicator data to obtain a test run recall rate and a test run accuracy rate;

[0136] Step B2000: If the trial run recall rate and the trial run accuracy rate meet the preset conditions, the anomaly detection optimization algorithm is introduced.

[0137] It should be noted that the introduction and evaluation of anomaly detection optimization algorithms are important links in ensuring the reliability of the alarm system. Before actually applying these algorithms, it is very necessary to verify the effectiveness of the algorithms through historical alarm simulation runs. Figure 5 , Figure 5 This is a schematic diagram of the replacement process of the anomaly detection optimization algorithm in the monitoring method used in this application and the algorithm online evaluation process. During the trial run, the system will use historical performance indicator data to simulate the operation of the algorithm, so as to evaluate the performance of the algorithm on historical data. This step is an indispensable part of the algorithm optimization process.

[0138] In addition, it should be noted that the recall rate and accuracy rate of the test run are key indicators for measuring the performance of the algorithm. The recall rate refers to the ratio of abnormal events successfully identified by the algorithm to all actual abnormal events, while the accuracy rate refers to the ratio of abnormal events correctly predicted by the algorithm to all abnormal events predicted by the algorithm. Only when both indicators meet the preset conditions, the algorithm will be considered robust enough and can be introduced into the real-time monitoring system.

[0139] For example, in one feasible implementation, the system first performs a simulated test run based on historical performance indicator data and anomaly detection optimization algorithms. During this process, the system builds one or more basic models and tunes the model parameters through historical data to form an anomaly detection optimization intermediate model. Subsequently, the system will use these intermediate models to simulate and test the historical alarm data and calculate the test recall rate and test accuracy. If these indicators meet the preset performance standards, indicating that the algorithm has high accuracy and reliability on historical data, the system will use these algorithms to monitor the real-time performance indicator data to generate an alarm enhancement information set. This overall process ensures that the algorithm has been fully tested and verified before actual application, which improves the credibility of the alarm system and the confidence of the operation and maintenance team in the alarm information.

[0140] In this embodiment, the process of implementing the alarm enhancement method involves multiple algorithm replacements, and algorithm replacement will directly affect the monitoring strategy. Therefore, this method formulates strict replacement standards and processes. Before the new algorithm is launched, it is necessary to conduct a historical alarm simulation test run on the new algorithm to accurately measure the algorithm performance based on the existing historical alarm labels; after the new algorithm is launched, the performance of the new algorithm is dynamically tested, and the algorithm is replaced according to the actual production and operation effect of the new algorithm, so as to ensure the effectiveness of monitoring as a whole.

[0141] In particular, the trial run should include a sufficient number of valid and invalid alarms, and the entire process should simulate production operation scenarios in order to accurately evaluate the performance of the new algorithm on historical data. For monitoring objects that do not have a sufficient number of real alarms, artificial alarms are generated using methods such as alarm migration and generative adversarial networks. During the trial run, the alarm recall rate and accuracy of the new algorithm must not be lower than those of the old algorithm, otherwise it means that the algorithm is not effective enough and cannot replace the existing algorithm, and a new algorithm needs to be tried.

[0142] In addition, according to the above method, a large number of algorithms need to be frequently replaced and updated. Therefore, this embodiment considers extracting the algorithm part to achieve the stratification and decoupling of the overall business. Figure 6 , Figure 6This is a schematic diagram of the business layered decoupling structure of the monitoring method used in this application. From bottom to top, it can be divided into: data layer, algorithm layer and business layer. The data layer mainly performs data-related processing and operations to meet the input requirements of the algorithm layer. The algorithm layer focuses on the development and practice of multiple types of algorithms, and supports the update of algorithms in a standard plug-in manner, which makes the online process of new algorithms simpler and allows users to focus more on the development and iteration of algorithm models. Specifically, this method defines the standard structure of input and output of the three links of model offline training, model online update and online anomaly detection from the software level, and realizes hot loading of new algorithm files through the software framework. Therefore, it is only necessary to complete the structural adaptation of the input and output of the three links according to the logic of the algorithm itself. After uploading the algorithm file, the algorithm can be applied in the remaining links. The business layer relies on the data results of the algorithm layer and combines relevant business needs to complete the final result output.

[0143] Reference Figure 7 as well as Figure 8 , Figure 7 This is a schematic diagram of the data flow of the anomaly detection algorithm in the monitoring method used in this application. Figure 8 This is a technical framework and architecture diagram of the anomaly detection algorithm in the application monitoring method of this application. In the data layer, the data source is the minute-level application indicator data in Kafka. In order to meet the scenario where large-scale long-term historical data is required for offline model training, a batch of data will be written to HDFS and synchronized to Hive to facilitate fast loading of the full data. In the model update training phase, since the initial model and most of the historical data already exist, and not all models need to be updated at the same time, it is only necessary to obtain the incremental data of some monitored objects. Therefore, the minute-level application indicator data in Kafka is also written to ClickHouse at the same time, so that it can be quickly queried according to fixed objects. In addition to persisting the data for long-term storage, the online detection part will also consume minute-level data in real time to complete the judgment of anomalies.

[0144] It should be noted that the above examples are only used to understand the present application and do not constitute a limitation on the monitoring method applied in the present application. More simple transformations based on this technical concept are all within the scope of protection of the present application.

[0145] Please refer to Fig. 9 The present application also provides an application monitoring device 90, the application monitoring device comprising:

[0146] A generating module 91, used to generate a performance indicator baseline based on historical performance indicator data of a target business system;

[0147] A monitoring module 92, used to monitor the target business system to obtain real-time performance indicator data;

[0148] An alarm module 93, configured to generate an original alarm information set by using a preset general anomaly detection algorithm and the real-time performance indicator data and the performance indicator baseline;

[0149] The enhancement module 94 is used to iteratively optimize the original alarm information set through a preset alarm enhancement strategy to obtain an alarm enhancement information set.

[0150] The application monitoring device provided by the present application adopts the application monitoring method in the above embodiment to solve the technical problem of application monitoring. Compared with the prior art, the beneficial effects of the application monitoring device provided by the present application are the same as the beneficial effects of the application monitoring method provided by the above embodiment, and other technical features in the application monitoring device are the same as the features disclosed in the above embodiment method, which will not be repeated here.

[0151] The present application provides an application monitoring device, which includes: at least one processor; and a memory that is communicatively connected to the at least one processor; wherein the memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the application monitoring method in the above-mentioned embodiment one.

[0152] Reference below Fig.10 , which shows a schematic diagram of the structure of an application monitoring device suitable for implementing the embodiment of the present application. The application monitoring device in the embodiment of the present application may include but is not limited to mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Descriptions), PMPs (Portable Media Players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Fig.10 The application monitoring device shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0153] like Fig.10As shown, the application monitoring device may include a processing device 1001 (e.g., a central processing unit, a graphics processor, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM: Read Only Memory) 1002 or a program loaded from a storage device 1003 to a random access memory (RAM: Random Access Memory) 1004. In RAM1004, various programs and data required for the operation of the application monitoring device are also stored. The processing device 1001, ROM1002, and RAM1004 are connected to each other through a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Generally, the following systems can be connected to the I / O interface 1006: an input device 1007 including, for example, a touch screen, a touch pad, a keyboard, a mouse, an image sensor, a microphone, an accelerometer, a gyroscope, etc.; an output device 1008 including, for example, a liquid crystal display (LCD: Liquid Crystal Display), a speaker, a vibrator, etc.; a storage device 1003 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 1009. The communication device 1009 can allow the application monitoring device to communicate with other devices wirelessly or by wire to exchange data. Although the figure shows an application monitoring device with various systems, it should be understood that it is not required to implement or have all the systems shown. More or fewer systems can be implemented or have alternatively.

[0154] In particular, according to the embodiments disclosed in the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present application include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device, or installed from a storage device 1003, or installed from a ROM 1002. When the computer program is executed by the processing device 1001, the above-mentioned functions defined in the method of the embodiment disclosed in the present application are executed.

[0155] The application monitoring device provided in the present application adopts the application monitoring method in the above-mentioned embodiment. Compared with the prior art, the beneficial effects of the application monitoring device provided in the present application are the same as the beneficial effects of the application monitoring method provided in the above-mentioned embodiment, and other technical features in the application monitoring device are the same as the features disclosed in the method of the previous embodiment, which will not be repeated here.

[0156] It should be understood that the various parts disclosed in this application can be implemented by hardware, software, firmware or a combination thereof. In the description of the above embodiments, specific features, structures, materials or characteristics can be combined in any one or more embodiments or examples in a suitable manner.

[0157] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0158] The present application provides a computer-readable storage medium having computer-readable program instructions (ie, computer programs) stored thereon, wherein the computer-readable program instructions are used to execute the application monitoring method in the above-mentioned embodiment.

[0159] The computer-readable storage medium provided in the present application may be, for example, a USB flash drive, but is not limited to electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, systems or devices, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, system or device. The program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination of the above.

[0160] The computer-readable storage medium may be included in the application monitoring device; or may exist independently without being assembled into the application monitoring device.

[0161] Computer program code for performing the operations of the present application may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0162] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present application. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0163] The modules involved in the embodiments described in this application may be implemented by software or hardware, wherein the name of the module does not constitute a limitation on the unit itself in some cases.

[0164] The readable storage medium provided in this application is a computer-readable storage medium, which stores computer-readable program instructions (i.e., computer programs) for executing the above-mentioned application monitoring method, and can solve the technical problems of application monitoring. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided in this application are the same as the beneficial effects of the application monitoring method provided in the above-mentioned embodiment, and will not be repeated here.

[0165] The present application also provides a computer program product, including a computer program, which implements the steps of the above-mentioned application monitoring method when executed by a processor.

[0166] The computer program product provided by this application can solve the technical problem of application monitoring. Compared with the prior art, the beneficial effects of the computer program product provided by this application are the same as the beneficial effects of the application monitoring method provided by the above embodiment, which will not be repeated here.

[0167] The above descriptions are only some embodiments of the present application, and are not intended to limit the patent scope of the present application. All equivalent structural changes made using the contents of the present application specification and drawings under the technical concept of the present application, or direct / indirect applications in other related technical fields are included in the patent protection scope of the present application.

Claims

1. An application monitoring method, characterized in that: The method comprises: Generate performance indicator baselines based on historical performance indicator data of the target business system; Monitor the target business system to obtain real-time performance indicator data; Generate an original alarm information set through a preset general anomaly detection algorithm and the real-time performance indicator data and the performance indicator baseline; The original alarm information set is iteratively optimized through a preset alarm enhancement strategy to obtain an alarm enhancement information set.

2. The method according to claim 1, characterized in that The real-time performance indicator data includes several performance characteristic indicators of the target business system, and the step of generating an original alarm information set by using a preset general anomaly detection algorithm and the real-time performance indicator data and the performance indicator baseline includes: Calculate the index difference between the plurality of performance characteristic indexes and the respective corresponding performance index baselines by using a preset general anomaly detection algorithm; Determine whether the difference of the indicator exceeds a preset difference threshold; If the indicator difference exceeds the difference threshold, the performance characteristic indicator is determined as the target performance characteristic indicator; Corresponding alarm information is generated based on the target performance characteristic indicator to obtain an original alarm information set.

3. The method according to claim 2, characterized in that The step of iteratively optimizing the original alarm information set by using a preset alarm enhancement strategy to obtain the alarm enhancement information set comprises: Based on the real-time performance indicator data, generating a supplementary monitoring object set according to a supplementary monitoring strategy; Performing anomaly detection on the real-time performance indicator data in the supplementary monitoring object set according to a preset anomaly detection optimization algorithm to obtain an alarm supplementary information set; Based on the alarm supplementary information set, generating an enhanced monitoring object set according to the supplementary monitoring strategy; According to a preset anomaly detection optimization algorithm, anomaly detection is performed on the real-time performance indicator data in the enhanced monitoring object set to obtain alarm enhancement information.

4. The method according to claim 3, characterized in that The step of generating a supplementary monitoring object set based on the real-time performance indicator data and the original alarm information set comprises: Counting the number of false alarms and missed alarms corresponding to each of the several performance characteristic indicators; Determine the false alarm rate and the missed alarm rate corresponding to each of the plurality of performance characteristic indicators according to the number of false alarms and the number of missed alarms; Determine as a target optimization alarm indicator any performance characteristic indicator of the number of false alarms, the number of missed alarms, the false alarm rate and the number of false alarms that exceeds a preset false alarm threshold; A supplementary monitoring object set is generated based on the target optimization alarm indicator.

5. The method according to claim 3, characterized in that The anomaly detection optimization algorithm includes at least one of an anomaly detection algorithm based on time series, an anomaly detection algorithm based on machine learning, and an anomaly detection algorithm based on deep learning. The training process of the anomaly detection optimization algorithm includes: Based on the type of the anomaly detection optimization algorithm, construct a corresponding anomaly detection optimization basic model; Using the historical performance indicator data, offline tuning is performed on the target parameters in the anomaly detection optimization basic model to obtain an anomaly detection optimization intermediate model; Based on the anomaly detection optimization intermediate model, the data change trend of the real-time performance indicator data is incrementally learned to obtain an anomaly detection optimization algorithm.

6. The method according to claim 5, characterized in that Before the step of iteratively optimizing the original alarm information set by using a preset alarm enhancement strategy to obtain the alarm enhancement information set, the step further includes: Perform a historical alarm simulation test run based on the anomaly detection optimization algorithm and the historical performance indicator data to obtain a test run recall rate and a test run accuracy rate; If the trial run recall rate and the trial run accuracy rate meet the preset conditions, the anomaly detection optimization algorithm is introduced.

7. An application monitoring device, characterized in that: The device comprises: A generation module is used to generate a performance indicator baseline based on the historical performance indicator data of the target business system; A monitoring module, used to monitor the target business system to obtain real-time performance indicator data; An alarm module, used to generate an original alarm information set through a preset general anomaly detection algorithm and the real-time performance indicator data and the performance indicator baseline; The enhancement module is used to iteratively optimize the original alarm information set through a preset alarm enhancement strategy to obtain an alarm enhancement information set.

8. An application monitoring device, characterized in that: The device comprises: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the application monitoring method according to any one of claims 1 to 6.

9. A storage medium, characterized in that: The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, the steps of the application monitoring method according to any one of claims 1 to 6 are implemented.

10. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the steps of the application monitoring method according to any one of claims 1 to 6 are implemented.

Images