Abnormality detection method and device, equipment and storage medium

Abstract

The invention relates to an anomaly detection method and device, equipment and a storage medium. The anomaly detection method comprises the steps of obtaining effective anomaly time of a system; wherein the effective abnormal time is the sum of the continuous abnormal time and all the interval abnormal time; the continuous abnormal time is the time when the system is in an abnormal state; the interval abnormal time is the interval time between two adjacent abnormal states of the system, and the interval time is less than first preset time; and when the effective abnormal time is greater than the second preset time, generating alarm information. In the above steps, the situations of false alarm and missing alarm can be reduced, and the accuracy of anomaly detection is improved.

Description

Technical Field

[0001] The present application relates to the technical field of anomaly detection, and in particular to an anomaly detection method, device, equipment and storage medium. Background Art

[0002] With the deployment and application of various complex systems, the dependencies between services have become closer. In this context, system performance monitoring and anomaly detection have become particularly important.

[0003] In traditional technology, an abnormal alarm is usually generated by detecting system performance data and judging that the system performance data exceeds the performance threshold. However, due to the detection accuracy or the existence of short-term fluctuations in system performance, the above method is prone to false alarms. In order to reduce false alarms, it is usually based on the 5-minute filtering principle, that is, when the system performance data exceeds the performance threshold for 5 consecutive minutes, an abnormal alarm is generated. However, this method is prone to missed alarms and cannot identify abnormalities of frequent performance fluctuations. Summary of the invention

[0004] Based on this, it is necessary to provide an anomaly detection method, device, equipment and storage medium that can improve the accuracy of anomaly monitoring in response to the above technical problems.

[0005] In a first aspect, the present application provides an anomaly detection method, comprising:

[0006] Obtaining the effective abnormal time of the system; wherein the effective abnormal time is the sum of the continuous abnormal time and all the interval abnormal time; the continuous abnormal time is the time when the system is in an abnormal state; the interval abnormal time is the interval time between two consecutive abnormal states of the system, and the interval time is less than the first preset time;

[0007] When the effective abnormal time is greater than the second preset time, an alarm message is generated.

[0008] In one embodiment, determining that a system is in an abnormal state includes: acquiring system performance data of the system; determining that the system is in an abnormal state when the system performance data is greater than a set threshold and the system performance data is greater than a current prediction upper limit; or determining that the system is in an abnormal state when the system performance data is less than a current prediction lower limit; wherein the current prediction upper limit and / or the current prediction lower limit are predicted based on the historical performance data of the system.

[0009] In one of the embodiments, after generating the alarm information, the method also includes: obtaining a topological multi-branch tree corresponding to the system; wherein the topological multi-branch tree is constructed based on the calling order between the system interfaces corresponding to the target task processing performed by the system; for each system interface, according to the system interfaces that have a connection relationship with the system interface in the topological multi-branch tree, the local processing response time and the full processing response time in different status time periods, calculate the abnormality degree data of the system interface; wherein the status time period includes an abnormal status time period and a non-abnormal status time period; according to the abnormality degree data of each system interface, determine the abnormal system interface in the system.

[0010] In one of the embodiments, the abnormality degree data of the system interface is calculated according to the local processing response time and the full processing response time of the system interface in the topological multi-branch tree that is connected to the system interface in different state time periods; including: taking the node where the system interface is located in the topological multi-branch tree as the parent node, and determining the first similarity of the parent node according to the full processing response time of the parent node in the task processing time period, the local processing response time of the parent node in the task processing time period, and the local processing response time of the parent node in different state time periods; determining the second similarity of the parent node to the child node according to the full processing response time of the parent node in the task processing time period, the full processing response time of the child node of the parent node in the task processing time period, and the full processing response time of the child node corresponding to the parent node in different state time periods; determining the weight ratio of the parent node according to the first similarity and the second similarity; determining the abnormality degree data of the parent node according to the weight ratio and the comprehensive weight corresponding to the subtree where the parent node is located.

[0011] In one of the embodiments, the first similarity of the parent node is determined based on the full processing response time of the parent node in the task processing period, the local processing response time of the parent node in the task processing period, and the local processing response time of the parent node in different state periods, including: determining the first horizontal similarity between the subtree corresponding to the parent node in the topological multi-branch tree and the parent node based on the full processing response time of the parent node in the task processing period and the local processing response time of the parent node in the task processing period; determining the first vertical similarity of the parent node between different state periods based on the local processing response time of the parent node in different state periods; determining the first similarity of the parent node based on the first horizontal similarity and the first vertical similarity.

[0012] In one of the embodiments, a second similarity between a parent node and a child node is determined based on a full processing response time of the parent node during a task processing period, a full processing response time of a child node of the parent node during the task processing period, and a full processing response time of a child node corresponding to the parent node during different state periods, including: determining a second horizontal similarity between a subtree corresponding to the parent node in a topological multi-branch tree and a child node of the parent node during the task processing period based on the full processing response time of the parent node during the task processing period and the full processing response time of the child node of the parent node during the task processing period; determining a second vertical similarity between the child nodes corresponding to the parent node in different state periods based on the full processing response time of the child nodes corresponding to the parent node in different state periods; and determining a second similarity between the child nodes corresponding to the parent node based on the second horizontal similarity and the second vertical similarity.

[0013] In one of the embodiments, after determining the abnormal system interface in the system based on the abnormality degree data of each system interface, it also includes: obtaining the host processing response time of each interface host corresponding to the abnormal system interface in different status time periods; determining the third similarity between each interface host and the abnormal system interface based on the host processing response time of each interface host in different status time periods and the full processing response time of the abnormal system interface in different status time periods; performing cluster analysis on the third similarity between each interface host and the abnormal system interface to determine the abnormal interface host corresponding to the abnormal system interface.

[0014] In a second aspect, the present application also provides an abnormality detection device, comprising:

[0015] The first acquisition module is used to acquire the effective abnormal time of the system; wherein the effective abnormal time is the sum of the continuous abnormal time and all the interval abnormal time; the continuous abnormal time is the time when the system is in an abnormal state; the interval abnormal time is the interval time between two consecutive abnormal states of the system, and the interval time is less than the first preset time;

[0016] The first generating module is used to generate alarm information when the effective abnormal time is greater than the second preset time.

[0017] In a third aspect, the present application further provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are implemented:

[0018] Obtaining the effective abnormal time of the system; wherein the effective abnormal time is the sum of the continuous abnormal time and all the interval abnormal time; the continuous abnormal time is the time when the system is in an abnormal state; the interval abnormal time is the interval time between two consecutive abnormal states of the system, and the interval time is less than the first preset time;

[0019] When the effective abnormal time is greater than the second preset time, an alarm message is generated.

[0020] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the following steps are implemented:

[0021] Obtaining the effective abnormal time of the system; wherein the effective abnormal time is the sum of the continuous abnormal time and all the interval abnormal time; the continuous abnormal time is the time when the system is in an abnormal state; the interval abnormal time is the interval time between two consecutive abnormal states of the system, and the interval time is less than the first preset time;

[0022] When the effective abnormal time is greater than the second preset time, an alarm message is generated.

[0023] In a fifth aspect, the present application further provides a computer program product, including a computer program, which implements the following steps when executed by a processor:

[0024] Obtaining the effective abnormal time of the system; wherein the effective abnormal time is the sum of the continuous abnormal time and all the interval abnormal time; the continuous abnormal time is the time when the system is in an abnormal state; the interval abnormal time is the interval time between two consecutive abnormal states of the system, and the interval time is less than the first preset time;

[0025] When the effective abnormal time is greater than the second preset time, an alarm message is generated.

[0026] In the above-mentioned abnormality detection method, device, equipment and storage medium, the interval time between two adjacent abnormal states of the system is less than the interval abnormal time of the first preset time, and all the interval abnormal time and the continuous abnormal time are counted into the effective abnormal time. When facing the abnormality of the type of frequent fluctuation in performance, since the interval time between two adjacent abnormal states is less than the first preset time, the interval abnormal time and the continuous abnormal time of the abnormality of the frequent fluctuation type can be counted into the effective abnormal time, and when the effective abnormal time is greater than the second preset time, an alarm message is generated to reduce the occurrence of missed reports. At the same time, when facing short-term fluctuations in system performance, since the duration of short-term fluctuations in performance is short, and the interval time between two adjacent short-term fluctuations in performance is usually greater than the first preset time, the interval time will not be counted into the interval abnormal time, reducing the occurrence of false alarms and improving the accuracy of abnormality detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0028] Figure 1 1 is a flow chart of an abnormality detection method in one embodiment;

[0029] Figure 2 It is a flowchart of the steps of determining an abnormal system interface in one embodiment;

[0030] Figure 3 It is a flowchart of the steps of determining an abnormal interface host in one embodiment;

[0031] Figure 4 is a flow chart of an abnormality detection method in another embodiment;

[0032] Figure 5 is a structural block diagram of an abnormality detection device in one embodiment;

[0033] Figure 6 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0034] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0035] In one embodiment, Figure 1 As shown, an anomaly detection method is provided. This embodiment uses the method applied to a terminal as an example for illustration. It can be understood that the method can also be applied to a server, and can also be applied to a system including a terminal and a server, and is implemented through the interaction between the terminal and the server. In this embodiment, the method includes the following steps:

[0036] S110, obtaining the effective abnormal time of the system; wherein the effective abnormal time is the sum of the continuous abnormal time and all interval abnormal times; the continuous abnormal time is the time when the system is in an abnormal state; the interval abnormal time is the interval time between two consecutive abnormal states of the system, and the interval time is less than the first preset time.

[0037] The duration of abnormality can be understood as the length of time that the system continues to exhibit an abnormal state over a period of time. The first preset time can be set by a technician according to needs or experience, or determined through a large number of experiments, and this application does not impose any limitation on this. For example, the first preset time can be any time between 3 minutes and 7 minutes, and in particular, the first preset time is 5 minutes.

[0038] For ease of understanding, the first preset time is 5 minutes. For example, a certain abnormality is manifested as: system abnormality occurs from 8:00 to 8:05, and system abnormality occurs from 8:06 to 8:11. Since the interval between the two abnormalities is 1 minute, 1 minute is less than 5 minutes, the interval abnormality time is 1 minute. Since the two abnormalities lasted for 9 minutes in total, the effective abnormality time is 9 minutes. Finally, it can be obtained that the effective abnormality time is from 1 minute to 11 minutes, a total of 10 minutes.

[0039] In an optional embodiment, the abnormal state of the system can be determined by the following steps: obtaining the current system performance data; determining that the system is in an abnormal state when the system performance data is greater than a set threshold and the system performance data is greater than the current prediction upper limit; or determining that the system is in an abnormal state when the system performance data is less than the current prediction lower limit.

[0040] The system performance data may be at least one of TPS (Transactions Per Second), RT (Response Time) and success rate. The success rate may be understood as the probability of the system successfully processing a request under load. The threshold may be set by a technician based on needs or experience, or determined through a large number of experiments, and this application does not impose any limitation on this.

[0041] Optionally, the prophet algorithm (time series prediction algorithm) can be used to predict the upper threshold trend and the lower threshold trend based on historical performance data, so as to obtain the current predicted upper limit value through the upper threshold trend and the current predicted lower limit value through the lower threshold trend. The upper threshold trend represents the business upper limit trend of the system; the lower threshold trend represents the business lower limit trend of the system.

[0042] It is not difficult to understand that when the system performance data is greater than the set threshold, but at the same time the system performance data is not greater than the current forecast upper limit, it means that although the system performance data exceeds the set threshold, it does not exceed the temporary bearing pressure of the current system predicted based on historical performance data. By introducing a set threshold and a forecast upper limit, and when the system performance data is greater than the set threshold and the system performance data is greater than the current forecast upper limit, it is judged that the system is in an abnormal state, which helps to reduce false alarms. In addition, when the system performance data is less than the current forecast lower limit, it means that the business volume has suddenly dropped off a cliff or the business is discontinuous. By introducing a forecast lower limit, when the system performance data is less than the current forecast lower limit, it is judged that the system is in an abnormal state, which helps to reduce missed reports.

[0043] S120: When the effective abnormal time is greater than the second preset time, generate an alarm message.

[0044] Among them, the first preset time can be set by technical personnel according to needs or experience, or determined through a large number of experiments, and this application does not impose any restrictions on this. For example, the second preset time can be any time between 3 minutes and 7 minutes. In particular, the second preset time is 5 minutes.

[0045] The alarm information may include the effective abnormal time or the time period corresponding to the effective abnormal time, and may also include the system performance data corresponding to the effective abnormal time.

[0046] In an optional embodiment, generating alarm information may further include: generating alarm recovery information when the system is in a non-abnormal state for a third preset time. The third preset time may be set by a technician according to needs or experience, or determined through a large number of experiments, and this application does not impose any limitation on this. For example, the second preset time may be 3 minutes.

[0047] By introducing the interval time between two adjacent abnormal states of the system that is less than the first preset time, and counting all the interval time and the duration time of the abnormal state into the effective abnormal time. When facing the abnormality of frequent performance fluctuations, since the interval time between two adjacent abnormal states is less than the first preset time, the interval time and the duration time of the abnormality of the frequent fluctuation type can be counted into the effective abnormal time, and when the effective abnormal time is greater than the second preset time, an alarm message is generated to reduce the occurrence of missed reports. At the same time, when facing short-term fluctuations in system performance, since the duration of short-term performance fluctuations is short, and the interval time between two adjacent short-term performance fluctuations is usually greater than the first preset time, the interval time will not be counted into the interval time, reducing the occurrence of false alarms and improving the accuracy of abnormality detection.

[0048] Based on the technical solutions of the above embodiments, the present application also provides an optional embodiment, in which a step of determining an abnormal system interface is added.

[0049] See also Figure 2 The steps for determining the abnormal system interface include:

[0050] S210, obtaining a topological multi-branch tree corresponding to the system; wherein the topological multi-branch tree is constructed based on the calling sequence between the system interfaces corresponding to the target task processing performed by the system.

[0051] Among them, the topological multitree is a data structure that combines the topological structure and the multitree characteristics. Each node of the topological multitree represents a system interface, and the connection between nodes represents the calling relationship between system interfaces, so as to intuitively reflect the hierarchical structure between various system interfaces. Among them, the system interface is also the system service.

[0052] In an optional embodiment, a topological multi-branch tree is constructed by the following steps: determining the troubleshooting time range corresponding to the target task processing, the troubleshooting time range includes an abnormal state period and a non-abnormal state period; dividing the troubleshooting time range into several time periods on average; for each time period, constructing an initial topological multi-branch tree based on the calling sequence between the system interfaces in the time period; merging the constructed several initial topological multi-branch trees to obtain a merged topological multi-branch tree; and pruning the merged topological multi-branch tree to obtain a topological multi-branch tree.

[0053] Exemplarily, pruning the merged topology multitree may include at least one of the following methods:

[0054] Method 1: Determine the asynchronous interface in the merged topology multitree, and prune and remove the asynchronous interface in the merged topology multitree and the downstream interface corresponding to the asynchronous interface.

[0055] Method 2: Filter out target system interfaces whose full response time within the troubleshooting time range is less than the first response time threshold from the system interfaces, and prune and remove the target system interfaces and the downstream interfaces corresponding to the target system interfaces.

[0056] Method three: Determine several parallel interfaces in the merged topology multitree; select a target parallel interface from the several parallel interfaces; if the full response time per minute of the target parallel interface within the troubleshooting time range is less than that of any other parallel interface, prune and remove the target parallel interface and the downstream interface corresponding to the target parallel interface.

[0057] S220. For each system interface, calculate the abnormality degree data of the system interface according to the local processing response time and the full processing response time of the system interfaces that are connected to the system interface in the topology multi-branch tree in different status periods; wherein the status period includes the abnormal status period and the non-abnormal status period.

[0058] The abnormality degree data of the system interface is used to reflect the magnitude of the abnormality degree of the system interface. By calculating the abnormality degree data, it is convenient to troubleshoot abnormal interfaces.

[0059] It should be noted that, for a system interface, within any time period, the full processing response time of the system interface is equal to the sum of the local processing response time of the system interface and the full processing response time of all downstream interfaces of the system interface. From the perspective of the topological multi-branch tree, the node where the system interface is located in the topological multi-branch tree can also be regarded as the parent node, then the full processing response time of the subtree corresponding to the parent node in the topological multi-branch tree is equal to the sum of the local processing response time of the parent node and the full processing response time of the child nodes of the parent node.

[0060] In an optional embodiment, the abnormality degree data of the system interface is calculated; including: taking the node where the system interface is located in the topological multi-branch tree as the parent node, determining the first similarity S1 of the parent node according to the full processing response time of the parent node in the task processing period, the local processing response time of the parent node in the task processing period, and the local processing response time of the parent node in different state periods; determining the second similarity S2 between the parent node and the child node according to the full processing response time of the parent node in the task processing period, the full processing response time of the child node of the parent node in the task processing period, and the full processing response time of the child node corresponding to the parent node in different state periods; determining the weight ratio w1 of the parent node according to the first similarity S1 and the second similarity S2; determining the abnormality degree data of the parent node according to the weight ratio w1 and the comprehensive weight corresponding to the subtree where the parent node is located.

[0061] Optionally, the product of the weight proportion w1 of the parent node and the comprehensive weight corresponding to the subtree where the parent node is located is used as the abnormality degree data of the parent node. The weight proportion w1 of the parent node can be calculated by the following formula:

[0062] .

[0063] Optionally, the product of the weight proportion w2 of the subtree where the child node of the parent node is located and the comprehensive weight corresponding to the subtree where the child node of the parent node is located is used as the comprehensive weight corresponding to the subtree where the child node of the parent node is located. The weight proportion w2 of the subtree where the child node of the parent node is located can be calculated by the following formula:

[0064] .

[0065] It is understandable that the comprehensive weight can be set for the topological multi-branch tree, and the comprehensive weight value can be transmitted from top to bottom to assign weights to each node of the topological multi-branch tree in turn. In order to facilitate the understanding of those skilled in the art, the comprehensive weight of the topological multi-branch tree is 1, and the nodes of the topological multi-branch tree are A1-a1-a1 from top to bottom. 11 For example, first, the weight w1 of node A1 is calculated to be 0.4, and the weight w2 of the subtree where the child node a1 of node A1 is located is 0.6. Then the abnormality data of node A1 is 0.4*1=0.4. The comprehensive weight of the subtree where the child node a1 is located is 0.6*1=0.6. Secondly, the weight w1 of node a1 is calculated to be 0.5, and the weight w2 of the subtree where the child node a1 of node A1 is located is 0.6*1=0.6. 11 The weight w2 of the subtree is, for example, 0.5. Then the abnormality degree data of node a1 is 0.5*0.6=0.3. 11 The comprehensive weight of the subtree is 0.5*0.6=0.3. Finally, calculate the node a 11 For example, if the weight w1 is 1, then the child node a 11 The abnormality degree data is 0.3. That is, nodes A1, a1 and a 11 The abnormality degree data are "0.4, 0.3, 0.3" respectively.

[0066] Further, the first similarity S1 can be calculated by the following steps: according to the full processing response time of the parent node in the task processing period, and the local processing response time of the parent node in the task processing period, determine the first horizontal similarity S between the subtree corresponding to the parent node in the topological multi-branch tree and the parent node a1 ; According to the local processing response time of the parent node in different state periods, determine the first longitudinal similarity S between the parent nodes in different state periods b1 ; According to the first horizontal similarity S a1 and the first longitudinal similarity S b1 , determine the first similarity S1 of the parent node.

[0067] Optionally, the first horizontal similarity S a1 It can be calculated by the following steps: calculate the first Pearson correlation and the first DTW (Dynamic Time Warping) correlation between the full processing response time of the parent node in the task processing period and the local processing response time of the parent node in the task processing period; select the maximum value of the first Pearson correlation and the first DTW correlation as the first horizontal similarity S a1Among them, Pearson correlation and DTW correlation are existing technologies and will not be described in detail here.

[0068] Optionally, the first longitudinal similarity S b1 It can be calculated by the following steps: Based on the local processing response time of the parent node during the abnormal state period and the number of calls c of the parent node during the abnormal state period 11 , calculate the average local processing response time of the parent node during the abnormal state period ; According to the local processing response time of the parent node in the non-abnormal state period and the number of calls of the parent node in the non-abnormal state period c 12 , calculate the average local processing response time of the parent node during the non-abnormal state period ; Calculate the first longitudinal similarity S according to the following formula b1 :

[0069] .

[0070] Optionally, the first similarity S1 can be calculated using the following formula:

[0071] .

[0072] Further, the second similarity S2 can be calculated by the following steps: according to the full processing response time of the parent node in the task processing period, and the full processing response time of the child node of the parent node in the task processing period, determine the second horizontal similarity S between the child node of the parent node and the child node of the parent node in the topological multi-branch tree corresponding to the parent node in the task processing period. a2 ; According to the full processing response time of the child node corresponding to the parent node in different state periods, determine the second longitudinal similarity S between the child nodes corresponding to the parent node in different state periods b2 ; According to the second horizontal similarity S a2 and the second longitudinal similarity S b2 , determine the second similarity S2 between the parent node and the child node.

[0073] Optionally, the second horizontal similarity S a2 It can be calculated by the following steps: calculating the second Pearson correlation and the second DTW (Dynamic Time Warping) correlation between the full processing response time of the parent node in the task processing period and the full processing response time of the child node of the parent node in the task processing period; selecting the maximum value of the second Pearson correlation and the second DTW correlation as the second horizontal similarity S a2 .

[0074] Optionally, the second longitudinal similarity Sb2 It can be calculated by the following steps: According to the full processing response time of the child node corresponding to the parent node in the abnormal state period and the number of calls c of the child node corresponding to the parent node in the abnormal state period 21 , calculate the average response time of the parent node corresponding to the child node during the abnormal state period ; According to the full processing response time of the child node corresponding to the parent node in the non-abnormal state period and the number of calls c of the child node corresponding to the parent node in the non-abnormal state period 22 , calculate the average response time of the full amount of processing of the child node corresponding to the parent node in the non-abnormal state period ; Calculate the second longitudinal similarity S according to the following formula b2 :

[0075] .

[0076] Optionally, the second similarity S2 can be calculated using the following formula:

[0077] .

[0078] S230. Determine the abnormal system interface in the system according to the abnormality degree data of each system interface.

[0079] In an optional embodiment, the abnormality degree data may be sorted in order of magnitude, and the first m system interfaces in the sorting may be checked in turn to determine the most abnormal system interfaces of the system, wherein the value of m may be set according to actual needs, for example, may be set to 5.

[0080] The step of determining the abnormal system interface in this embodiment introduces a topological multi-branch tree based on the calling sequence between the system interfaces, so that the calling relationship between the system interfaces can be clarified, which is conducive to reducing the complexity of calculation and improving the calculation efficiency. For each system interface, according to the system interface that has a connection relationship with the system interface in the topological multi-branch tree, the local processing response time and the full processing response time in different state periods, the abnormality degree data of the system interface is calculated, so that the abnormality degree of each system interface can be determined, providing a basis for the troubleshooting of the system interface, which is conducive to improving the efficiency of the abnormal troubleshooting of each system interface.

[0081] Based on the technical solutions of the above embodiments, the present application also provides an optional embodiment, in which a step of determining an abnormal interface host is added.

[0082] See also Figure 3 The steps for determining the abnormal interface host include:

[0083] S310, obtaining the host processing response duration of each interface host corresponding to the abnormal system interface in different status time periods.

[0084] Among them, the interface host refers to the host device that runs the abnormal system interface service or provides the abnormal system interface function. Generally speaking, each abnormal system interface corresponds to multiple interface hosts. Among them, different state time periods include abnormal state periods and non-abnormal state periods. It can be understood that the sum of the host processing response time of each interface host corresponding to the abnormal system interface during the task processing period is equal to the full processing response time of the abnormal system interface during the task processing period.

[0085] S320. Determine a third similarity S3 between each interface host and the abnormal system interface according to the host processing response time of each interface host in different state time periods and the full processing response time of the abnormal system interface in different state time periods.

[0086] In an optional embodiment, for a target interface host, the third similarity S3 between the target interface host and the abnormal system interface is calculated by the following steps: according to the host processing response time of the target interface host in the task processing period, and the full processing response time of the abnormal system interface in the task processing period, the third horizontal similarity S3 between the target interface host and the abnormal system interface is calculated. a3 According to the host processing response time of the target interface host in the abnormal state period and the non-abnormal state period, calculate the third longitudinal similarity S between the target interface host abnormal state period and the non-abnormal state period b3 ; The third horizontal similarity S a3 Similarity S with the third longitudinal b3 The product of is taken as the third similarity S3.

[0087] Optionally, the third horizontal similarity S a3 It can be calculated by the following steps: calculating the third Pearson correlation and the third DTW (Dynamic Time Warping) correlation between the host processing response time of the target interface host in the task processing period and the full processing response time of the abnormal system interface in the task processing period; selecting the maximum value of the third Pearson correlation and the third DTW correlation as the third horizontal similarity S a3 .

[0088] Optionally, the third longitudinal similarity S b3 It can be calculated by the following steps: According to the host processing response time of the target interface host in the abnormal state period and the number of interface calls c of the target interface host in the abnormal state period 31, calculate the average host processing response time of the target interface host during the abnormal state period ; According to the host processing response time of the target interface host in the non-abnormal state period and the number of interface calls c of the target interface host in the non-abnormal state period 32 , calculate the average host processing response time of the target interface host in the non-abnormal state period ; Calculate the third longitudinal similarity S according to the following formula b3 :

[0089] .

[0090] S330 , performing cluster analysis on the third similarities S3 between each interface host and the abnormal system interface, and determining the abnormal interface host corresponding to the abnormal system interface.

[0091] It can be understood that by performing cluster analysis on the third similarities S3 between each interface host and the abnormal system interface, each third similarity S3 can be divided into a normal category and an abnormal category, and the abnormal interface host can be determined by checking the interface hosts in the abnormal category.

[0092] The abnormal category is determined by cluster analysis. The interface host in the abnormal category does not necessarily have a real abnormality. Therefore, in an optional embodiment, by performing a similarity comparison on the above two categories, if the difference is large, it means that the interface host in the abnormal category does have an abnormality.

[0093] Optionally, after clustering the third similarities S3 between each interface host and the abnormal system interface, the method further includes: calculating a first weighted average value corresponding to each third similarity S3 in the abnormal category. ; Calculate the second weighted average value corresponding to each third similarity S3 in the normal category ; Calculate the first weighted average With the second weighted average The absolute value of the difference S C ; Calculate the comparison coefficient m according to the following formula:

[0094] ;

[0095] When the comparison coefficient m is greater than a preset value, a first weighted average value is determined. and the second weighted average The category corresponding to the larger value is the abnormal category, that is, the interface host in the abnormal category needs to be checked; when the comparison coefficient m is not greater than the preset value, it is determined that both categories are normal categories, that is, there is no need to check the interface hosts in the two categories. Among them, the preset value can be set by the technician according to needs or experience, or determined through a large number of experiments, and this application does not make any restrictions on this. For example, the preset value can be set to 20%.

[0096] In the step of determining the abnormal interface host in this embodiment, by determining the third similarity S3 between each interface host and the abnormal system interface, a cluster analysis is performed on the third similarity S3 between each interface host and the abnormal system interface to determine the abnormal interface host corresponding to the abnormal system interface, which provides a basis for troubleshooting the abnormal interface host and is conducive to improving the efficiency of troubleshooting the abnormalities of each interface host.

[0097] Based on the technical solutions of the above embodiments, the present application also provides an optional embodiment, in which another specific implementation of the anomaly detection method is provided.

[0098] See also Figure 4 The anomaly detection method shown includes:

[0099] S401. Obtain system performance data of the system.

[0100] S402. When the system performance data is greater than the set threshold and the system performance data is greater than the current prediction upper limit, determine that the system is in an abnormal state; or, when the system performance data is less than the current prediction lower limit, determine that the system is in an abnormal state; wherein the current prediction upper limit and / or the current prediction lower limit are predicted based on the system's historical performance data.

[0101] S403, obtaining the effective abnormal time of the system; wherein the effective abnormal time is the sum of the continuous abnormal time and all interval abnormal times; the continuous abnormal time is the time when the system is in an abnormal state; the interval abnormal time is the interval time between two consecutive abnormal states of the system, and the interval time is less than the first preset time.

[0102] S404: When the effective abnormal time is greater than the second preset time, generate an alarm message.

[0103] S405, obtaining a topological multi-branch tree corresponding to the system; wherein the topological multi-branch tree is constructed based on the calling sequence between the system interfaces corresponding to the target task processing performed by the system.

[0104] S406. For each system interface, calculate the abnormality degree data of the system interface according to the local processing response time and the full processing response time in different status periods based on the system interfaces that have a connection relationship with the system interface in the topology multi-branch tree; wherein the status period includes an abnormal status period and a non-abnormal status period.

[0105] S407: Determine the abnormal system interface in the system according to the abnormality degree data of each system interface.

[0106] S408: Obtain the host processing response duration of each interface host corresponding to the abnormal system interface in different status time periods.

[0107] S409: Determine a third similarity between each interface host and the abnormal system interface according to the host processing response time of each interface host in different state time periods and the full processing response time of the abnormal system interface in different state time periods.

[0108] S410: Perform cluster analysis on the third similarities between each interface host and the abnormal system interface to determine the abnormal interface host corresponding to the abnormal system interface.

[0109] The detailed technical contents of the above steps S401 - S410 have been recorded in the above embodiments and will not be repeated here.

[0110] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0111] Based on the same inventive concept, the embodiment of the present application also provides an anomaly detection device for implementing the anomaly detection method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more anomaly detection device embodiments provided below can refer to the limitations on the anomaly detection method above, and will not be repeated here.

[0112] In an exemplary embodiment, Figure 5As shown, an abnormality detection device is provided, including: a first acquisition module 510 and a first generation module 520, wherein:

[0113] The first acquisition module 510 is used to obtain the effective abnormal time of the system; wherein the effective abnormal time is the sum of the continuous abnormal time and all interval abnormal times; the continuous abnormal time is the time when the system is in an abnormal state; the interval abnormal time is the interval time between two adjacent abnormal states of the system, and the interval time is less than the first preset time.

[0114] The first generating module 520 is configured to generate an alarm message when the effective abnormal time is greater than a second preset time.

[0115] In one embodiment, the first acquisition module 510 includes: a first acquisition unit, used to acquire system performance data of the system; a determination unit, used to determine that the system is in an abnormal state when the system performance data is greater than a set threshold and the system performance data is greater than a current prediction upper limit value; or, when the system performance data is less than a current prediction lower limit value, determine that the system is in an abnormal state; wherein the current prediction upper limit value and / or the current prediction lower limit value are predicted based on the historical performance data of the system.

[0116] In one embodiment, the anomaly detection device also includes: a second acquisition module, used to acquire a topological multi-branch tree corresponding to the system; wherein the topological multi-branch tree is constructed based on the calling order between the system interfaces corresponding to the target task processing performed by the system; a first calculation module, used to calculate the abnormality degree data of the system interface for each system interface, according to the local processing response time and the full processing response time of the system interface that has a connection relationship with the system interface in the topological multi-branch tree in different state time periods; wherein the state time period includes an abnormal state time period and a non-abnormal state time period; a first determination module, used to determine the abnormal system interface in the system according to the abnormality degree data of each system interface.

[0117] In one embodiment, the first calculation module includes: a first determination unit, which takes the node where the system interface is located in the topological multi-branch tree as the parent node, and determines the first similarity of the parent node according to the full processing response time of the parent node in the task processing period, the local processing response time of the parent node in the task processing period, and the local processing response time of the parent node in different state periods; a second determination unit, which is used to determine the second similarity of the parent node corresponding to the child node according to the full processing response time of the parent node in the task processing period, the full processing response time of the child node of the parent node in the task processing period, and the full processing response time of the child node corresponding to the parent node in different state periods; a third determination unit, which is used to determine the weight ratio of the parent node according to the first similarity and the second similarity; a fourth determination unit, which is used to determine the abnormality degree data of the parent node according to the weight ratio and the comprehensive weight corresponding to the subtree where the parent node is located.

[0118] In one embodiment, the first determination unit includes: a first determination sub-unit, used to determine the first horizontal similarity between the subtree corresponding to the parent node in the topological multi-branch tree and the parent node based on the full processing response time of the parent node in the task processing period and the local processing response time of the parent node in the task processing period; a second determination sub-unit, used to determine the first vertical similarity of the parent node between different state time periods based on the local processing response time of the parent node in different state time periods; and a third determination sub-unit, used to determine the first similarity of the parent node based on the first horizontal similarity and the first vertical similarity.

[0119] In one embodiment, the second determination unit is specifically used for: a fourth determination sub-unit, for determining the second horizontal similarity between the subtree corresponding to the parent node in the topological multi-branch tree within the task processing period and the child node of the parent node according to the full processing response time of the parent node within the task processing period and the full processing response time of the child node of the parent node within the task processing period; a fifth determination sub-unit, for determining the second vertical similarity between the child node corresponding to the parent node in different state time periods according to the full processing response time of the child node corresponding to the parent node in different state time periods; a sixth determination sub-unit, for determining the second similarity between the child node corresponding to the parent node based on the second horizontal similarity and the second vertical similarity.

[0120] In one embodiment, the anomaly detection device also includes: a third acquisition module, used to obtain the host processing response time of each interface host corresponding to the abnormal system interface in different state time periods; a second calculation module, used to determine the third similarity between each interface host and the abnormal system interface according to the host processing response time of each interface host in different state time periods and the full processing response time of the abnormal system interface in different state time periods; a second determination module, used to perform cluster analysis on the third similarity between each interface host and the abnormal system interface to determine the abnormal interface host corresponding to the abnormal system interface.

[0121] Each module in the above-mentioned abnormality detection device can be implemented in whole or in part by software, hardware and a combination thereof. Each of the above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the operations corresponding to each of the above modules.

[0122] In an exemplary embodiment, a computer device is provided. The computer device may be a terminal, and its internal structure diagram may be as shown in FIG. Figure 6 As shown. The computer device includes a processor, a memory, an input / output interface, a communication interface, a display unit and an input device. The processor, the memory and the input / output interface are connected through a system bus, and the communication interface, the display unit and the input device are connected to the system bus through the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be implemented through WIFI, a mobile cellular network, near field communication (NFC) or other technologies. When the computer program is executed by the processor, an abnormality detection method is implemented. The display unit of the computer device is used to form a visually visible picture, which can be a display screen, a projection device or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covering the display screen, or a button, trackball or touchpad set on the computer device shell, or an external keyboard, touchpad or mouse.

[0123] Those skilled in the art will understand that Figure 6The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0124] In an exemplary embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the computer program, the following steps are implemented:

[0125] Obtaining the effective abnormal time of the system; wherein the effective abnormal time is the sum of the continuous abnormal time and all the interval abnormal time; the continuous abnormal time is the time when the system is in an abnormal state; the interval abnormal time is the interval time between two consecutive abnormal states of the system, and the interval time is less than the first preset time;

[0126] When the effective abnormal time is greater than the second preset time, an alarm message is generated.

[0127] In one embodiment, when the processor executes the computer program, it also implements the following steps: obtaining system performance data of the system; determining that the system is in an abnormal state when the system performance data is greater than a set threshold and the system performance data is greater than a current prediction upper limit; or determining that the system is in an abnormal state when the system performance data is less than a current prediction lower limit; wherein the current prediction upper limit and / or the current prediction lower limit are predicted based on the historical performance data of the system.

[0128] In one embodiment, when the processor executes the computer program, the following steps are also implemented: obtaining a topological multi-branch tree corresponding to the system; wherein the topological multi-branch tree is constructed based on the calling order between the system interfaces corresponding to the target task processing performed by the system; for each system interface, according to the system interfaces that have a connection relationship with the system interface in the topological multi-branch tree, the local processing response time and the full processing response time in different status time periods, calculate the abnormality degree data of the system interface; wherein the status time period includes an abnormal status time period and a non-abnormal status time period; according to the abnormality degree data of each system interface, determine the abnormal system interface in the system.

[0129] In one embodiment, when the processor executes the computer program, the following steps are also implemented: taking the node where the system interface is located in the topological multi-branch tree as the parent node, determining the first similarity of the parent node according to the full processing response time of the parent node in the task processing period, the local processing response time of the parent node in the task processing period, and the local processing response time of the parent node in different state periods; determining the second similarity between the parent node and the child node according to the full processing response time of the parent node in the task processing period, the full processing response time of the child node of the parent node in the task processing period, and the full processing response time of the child node corresponding to the parent node in different state periods; determining the weight ratio of the parent node according to the first similarity and the second similarity; determining the abnormality degree data of the parent node according to the weight ratio and the comprehensive weight corresponding to the subtree where the parent node is located.

[0130] In one embodiment, when the processor executes the computer program, the following steps are also implemented: based on the full processing response time of the parent node during the task processing period and the local processing response time of the parent node during the task processing period, the first horizontal similarity between the subtree corresponding to the parent node in the topological multi-branch tree and the parent node is determined; based on the local processing response time of the parent node in different state periods, the first vertical similarity of the parent node between different state periods is determined; based on the first horizontal similarity and the first vertical similarity, the first similarity of the parent node is determined.

[0131] In one embodiment, when the processor executes the computer program, the following steps are also implemented: based on the full processing response time of the parent node during the task processing period, and the full processing response time of the child node of the parent node during the task processing period, determine the second horizontal similarity between the subtree corresponding to the parent node in the topological multi-branch tree during the task processing period and the child node of the parent node; based on the full processing response time of the child node corresponding to the parent node in different state periods, determine the second vertical similarity between the child node corresponding to the parent node in different state periods; based on the second horizontal similarity and the second vertical similarity, determine the second similarity between the child node corresponding to the parent node.

[0132] In one embodiment, the processor also implements the following steps when executing the computer program: obtaining the host processing response time of each interface host corresponding to the abnormal system interface in different state time periods; determining the third similarity between each interface host and the abnormal system interface based on the host processing response time of each interface host in different state time periods and the full processing response time of the abnormal system interface in different state time periods; performing cluster analysis on the third similarity between each interface host and the abnormal system interface to determine the abnormal interface host corresponding to the abnormal system interface.

[0133] In one embodiment, a computer readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the following steps are implemented:

[0134] Obtaining the effective abnormal time of the system; wherein the effective abnormal time is the sum of the continuous abnormal time and all the interval abnormal time; the continuous abnormal time is the time when the system is in an abnormal state; the interval abnormal time is the interval time between two consecutive abnormal states of the system, and the interval time is less than the first preset time;

[0135] When the effective abnormal time is greater than the second preset time, an alarm message is generated.

[0136] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: obtaining system performance data of the system; determining that the system is in an abnormal state when the system performance data is greater than a set threshold and the system performance data is greater than a current prediction upper limit; or determining that the system is in an abnormal state when the system performance data is less than a current prediction lower limit; wherein the current prediction upper limit and / or the current prediction lower limit are predicted based on the historical performance data of the system.

[0137] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: obtaining a topological multi-branch tree corresponding to the system; wherein the topological multi-branch tree is constructed based on the calling order between the system interfaces corresponding to the target task processing performed by the system; for each system interface, according to the system interfaces that have a connection relationship with the system interface in the topological multi-branch tree, the local processing response time and the full processing response time in different status time periods, calculate the abnormality degree data of the system interface; wherein the status time period includes an abnormal status time period and a non-abnormal status time period; according to the abnormality degree data of each system interface, determine the abnormal system interface in the system.

[0138] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: taking the node where the system interface is located in the topological multi-branch tree as the parent node, determining the first similarity of the parent node according to the full processing response time of the parent node in the task processing period, the local processing response time of the parent node in the task processing period, and the local processing response time of the parent node in different state periods; determining the second similarity between the parent node and the child node according to the full processing response time of the parent node in the task processing period, the full processing response time of the child node of the parent node in the task processing period, and the full processing response time of the child node corresponding to the parent node in different state periods; determining the weight ratio of the parent node according to the first similarity and the second similarity; determining the abnormality degree data of the parent node according to the weight ratio and the comprehensive weight corresponding to the subtree where the parent node is located.

[0139] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: based on the full processing response time of the parent node during the task processing period and the local processing response time of the parent node during the task processing period, the first horizontal similarity between the subtree corresponding to the parent node in the topological multi-branch tree and the parent node is determined; based on the local processing response time of the parent node in different state periods, the first vertical similarity of the parent node between different state periods is determined; based on the first horizontal similarity and the first vertical similarity, the first similarity of the parent node is determined.

[0140] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: based on the full processing response time of the parent node during the task processing period, and the full processing response time of the child node of the parent node during the task processing period, determine the second horizontal similarity between the subtree corresponding to the parent node in the topological multi-branch tree during the task processing period and the child node of the parent node; based on the full processing response time of the child node corresponding to the parent node in different state periods, determine the second vertical similarity between the child node corresponding to the parent node in different state periods; based on the second horizontal similarity and the second vertical similarity, determine the second similarity between the child node corresponding to the parent node.

[0141] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: obtaining the host processing response time of each interface host corresponding to the abnormal system interface in different state time periods; determining the third similarity between each interface host and the abnormal system interface based on the host processing response time of each interface host in different state time periods and the full processing response time of the abnormal system interface in different state time periods; performing cluster analysis on the third similarity between each interface host and the abnormal system interface to determine the abnormal interface host corresponding to the abnormal system interface.

[0142] In one embodiment, a computer program product is provided, comprising a computer program, which, when executed by a processor, implements the following steps:

[0143] Obtaining the effective abnormal time of the system; wherein the effective abnormal time is the sum of the continuous abnormal time and all the interval abnormal time; the continuous abnormal time is the time when the system is in an abnormal state; the interval abnormal time is the interval time between two consecutive abnormal states of the system, and the interval time is less than the first preset time;

[0144] When the effective abnormal time is greater than the second preset time, an alarm message is generated.

[0145] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: obtaining system performance data of the system; determining that the system is in an abnormal state when the system performance data is greater than a set threshold and the system performance data is greater than a current prediction upper limit; or determining that the system is in an abnormal state when the system performance data is less than a current prediction lower limit; wherein the current prediction upper limit and / or the current prediction lower limit are predicted based on the historical performance data of the system.

[0146] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: obtaining a topological multi-branch tree corresponding to the system; wherein the topological multi-branch tree is constructed based on the calling order between the system interfaces corresponding to the target task processing performed by the system; for each system interface, according to the system interfaces that have a connection relationship with the system interface in the topological multi-branch tree, the local processing response time and the full processing response time in different status time periods, calculate the abnormality degree data of the system interface; wherein the status time period includes an abnormal status time period and a non-abnormal status time period; according to the abnormality degree data of each system interface, determine the abnormal system interface in the system.

[0147] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: taking the node where the system interface is located in the topological multi-branch tree as the parent node, determining the first similarity of the parent node according to the full processing response time of the parent node in the task processing period, the local processing response time of the parent node in the task processing period, and the local processing response time of the parent node in different state periods; determining the second similarity between the parent node and the child node according to the full processing response time of the parent node in the task processing period, the full processing response time of the child node of the parent node in the task processing period, and the full processing response time of the child node corresponding to the parent node in different state periods; determining the weight ratio of the parent node according to the first similarity and the second similarity; determining the abnormality degree data of the parent node according to the weight ratio and the comprehensive weight corresponding to the subtree where the parent node is located.

[0148] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: based on the full processing response time of the parent node during the task processing period and the local processing response time of the parent node during the task processing period, the first horizontal similarity between the subtree corresponding to the parent node in the topological multi-branch tree and the parent node is determined; based on the local processing response time of the parent node in different state periods, the first vertical similarity of the parent node between different state periods is determined; based on the first horizontal similarity and the first vertical similarity, the first similarity of the parent node is determined.

[0149] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: based on the full processing response time of the parent node during the task processing period, and the full processing response time of the child node of the parent node during the task processing period, determine the second horizontal similarity between the subtree corresponding to the parent node in the topological multi-branch tree during the task processing period and the child node of the parent node; based on the full processing response time of the child node corresponding to the parent node in different state periods, determine the second vertical similarity between the child node corresponding to the parent node in different state periods; based on the second horizontal similarity and the second vertical similarity, determine the second similarity between the child node corresponding to the parent node.

[0150] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: obtaining the host processing response time of each interface host corresponding to the abnormal system interface in different state time periods; determining the third similarity between each interface host and the abnormal system interface based on the host processing response time of each interface host in different state time periods and the full processing response time of the abnormal system interface in different state time periods; performing cluster analysis on the third similarity between each interface host and the abnormal system interface to determine the abnormal interface host corresponding to the abnormal system interface.

[0151] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0152] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0153] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. An anomaly detection method, characterized in that: The method comprises: Obtaining the effective abnormal time of the system; wherein the effective abnormal time is the sum of the continuous abnormal time and all the interval abnormal time; the continuous abnormal time is the time when the system is in an abnormal state; the interval abnormal time is the interval time between two adjacent abnormal states of the system, and the interval time is less than the first preset time; When the effective abnormal time is greater than the second preset time, an alarm message is generated.

2. The anomaly detection method according to claim 1, characterized in that: Determining that the system is in an abnormal state includes: Obtaining system performance data of the system; When the system performance data is greater than a set threshold and the system performance data is greater than a current prediction upper limit, the system is determined to be in an abnormal state; or, when the system performance data is less than a current prediction lower limit, the system is determined to be in an abnormal state; The current prediction upper limit value and / or the current prediction lower limit value are predicted based on historical performance data of the system.

3. The anomaly detection method according to any one of claims 1 to 2, characterized in that: After generating the warning information, the method further includes: Obtaining a topological multi-branch tree corresponding to the system; wherein the topological multi-branch tree is constructed based on the calling sequence between the system interfaces corresponding to the target task processing performed by the system; For each system interface, according to the system interfaces in the topology multi-branch tree that are connected to the system interface, the local processing response time and the full processing response time in different state periods are used to calculate the abnormality degree data of the system interface; wherein the state period includes an abnormal state period and a non-abnormal state period; According to the abnormality degree data of each of the system interfaces, an abnormal system interface in the system is determined.

4. The anomaly detection method according to claim 3, characterized in that: The calculation of abnormality degree data of the system interface according to the local processing response time and the full processing response time of the system interface in the topology multi-branch tree that has a connection relationship with the system interface in different state periods includes: Taking the node where the system interface is located in the topological multi-branch tree as the parent node, determining the first similarity of the parent node according to the full processing response time of the parent node in the task processing period, the local processing response time of the parent node in the task processing period, and the local processing response time of the parent node in different state periods; Determine a second similarity between the parent node and the child node according to the full processing response time of the parent node in the task processing period, the full processing response time of the child node of the parent node in the task processing period, and the full processing response time of the child node corresponding to the parent node in different state periods; Determining a weight ratio of the parent node according to the first similarity and the second similarity; The abnormality degree data of the parent node is determined according to the weight proportion and the comprehensive weight corresponding to the subtree where the parent node is located.

5. The anomaly detection method according to claim 4, characterized in that: The determining the first similarity of the parent node according to the full processing response time of the parent node in the task processing period, the local processing response time of the parent node in the task processing period, and the local processing response time of the parent node in different state periods includes: Determine a first horizontal similarity between a subtree corresponding to the parent node in the topological multi-branch tree and the parent node according to a full processing response time of the parent node in the task processing period and a local processing response time of the parent node in the task processing period; Determining a first longitudinal similarity between different state time periods of the parent node according to the local processing response duration of the parent node in different state time periods; A first similarity of the parent node is determined according to the first horizontal similarity and the first vertical similarity.

6. The anomaly detection method according to claim 4, characterized in that: The determining, according to the full processing response time of the parent node in the task processing period, the full processing response time of the child node of the parent node in the task processing period, and the full processing response time of the child node corresponding to the parent node in different state periods, a second similarity of the parent node corresponding to the child node includes: Determine, according to the full processing response time of the parent node in the task processing period, and the full processing response time of the child node of the parent node in the task processing period, a second horizontal similarity between the child node of the parent node and the subtree corresponding to the parent node in the topological multi-branch tree in the task processing period; Determine, according to the full processing response time of the child node corresponding to the parent node in different state time periods, the second longitudinal similarity between the child nodes corresponding to the parent node in different state time periods; A second similarity between the parent node and the child node is determined according to the second horizontal similarity and the second vertical similarity.

7. The abnormality detection method according to claim 3, characterized in that: After determining the abnormal system interface in the system according to the abnormality degree data of each of the system interfaces, the method further includes: Obtaining the host processing response time of each interface host corresponding to the abnormal system interface in different state time periods; Determine a third similarity between each interface host and the abnormal system interface according to the host processing response duration of each interface host in the different state time periods and the full processing response duration of the abnormal system interface in the different state time periods; A cluster analysis is performed on the third similarities between each interface host and the abnormal system interface to determine the abnormal interface host corresponding to the abnormal system interface.

8. An abnormality detection device, characterized in that: The device comprises: A first acquisition module is used to acquire the effective abnormal time of the system; wherein the effective abnormal time is the sum of the continuous abnormal time and all the interval abnormal time; the continuous abnormal time is the time when the system is in an abnormal state; the interval abnormal time is the interval time between two adjacent abnormal states of the system, and the interval time is less than a first preset time; The first generating module is used to generate alarm information when the effective abnormal time is greater than the second preset time.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images