Abnormity attribution method and device based on multi-dimensional data set, electronic equipment and medium

Abstract

The invention discloses an exception attribution method and device based on a multi-dimensional data set, electronic equipment and a medium, and relates to the technical field of IT system operation and maintenance management. The method comprises the following steps: firstly, determining a critical time point of abnormity; calculating the statistical value of each dimension in the abnormal interval and the normal interval according to the statistical mode of the abnormal indexes; dimensionalities which do not contribute to the anomaly are filtered, residual errors of the remaining dimensionalities are calculated, and the dimensionalities with the residual errors larger than a threshold value are judged to be abnormal dimensionalities which contribute to the anomaly; and counting and outputting the proportion of the abnormal interval statistical value of each abnormal dimension in the statistical values of all the dimensions. According to the method, millisecond-level abnormal attribution analysis is realized, and the analysis efficiency is greatly improved.

Description

Technical Field

[0001] The present invention belongs to the technical field of IT system operation and maintenance management, and in particular, relates to an abnormality attribution method, device, electronic equipment and medium based on a multidimensional data set. Background Art

[0002] In the current IT operation and maintenance field, user experience monitoring is an important part of ensuring service stability. However, traditional user experience monitoring methods mainly rely on monitoring overall business indicators. When overall indicators are abnormal, operation and maintenance personnel need to determine the distribution of abnormalities through tedious manual analysis. This process is time-consuming and inefficient, and it is difficult to meet the requirements of rapid service recovery.

[0003] The defects in the prior art mainly include: 1. Different monitoring indicators have different definitions of abnormalities and different statistical methods, which makes the analysis complicated; 2. As the analysis dimension increases, the amount of calculation increases exponentially, making it difficult to achieve efficient analysis; 3. Traditional analysis methods rely on manual judgment, which is inefficient and prone to errors. Summary of the invention

[0004] In view of the problems existing in the prior art, the present invention provides an anomaly attribution method, device, electronic device and medium based on a multidimensional data set, which can quickly perform anomaly attribution analysis and processing on anomaly indicators of multidimensional data.

[0005] In a first aspect, the present invention discloses an anomaly attribution method based on a multidimensional data set, comprising the following steps: Step S11, determining a critical time point at which an abnormality occurs, wherein a period of time before the critical time point is a normal interval, and a period of time after the critical time point is an abnormal interval; Step S12, determine the statistical method of abnormal indicators and the dimensions to be analyzed, and calculate the statistical values ​​of each dimension in the abnormal interval and the normal interval according to the statistical method of abnormal indicators; Step S13, compare the statistical values ​​of the abnormal interval with the statistical values ​​of the normal interval, and filter out the dimensions that do not contribute to the abnormality; for the remaining dimensions, calculate the difference between the abnormal interval and the normal interval, record it as the residual, set a threshold, and determine the dimension with a residual greater than the threshold as the abnormal dimension that contributes to the abnormality; Step S14: Count and output the proportion of the abnormal interval statistical value of each abnormal dimension in the statistical value of all dimensions to complete the abnormal attribution analysis.

[0006] Furthermore, in step S11, the critical time point is a time point before the alarm time.

[0007] Furthermore, in step S11, the critical time point is 3 minutes before the alarm time, and the normal interval and the abnormal interval are 3 minutes before and after the critical time point respectively.

[0008] Furthermore, in step S12, if a dimension has not been accessed after the critical time point, the abnormal interval statistics value does not exist, and is filled with the normal interval statistics value; Furthermore, in step S13, the dimension that does not contribute to the anomaly is judged as follows: for the case where the anomaly is caused by the increase of the indicator, if the statistical value of the abnormal interval is not greater than the statistical value of the normal interval, then it is a dimension that does not contribute to the anomaly.

[0009] In step S13, the threshold is the larger one of the mean and the standard deviation of the residual.

[0010] In a second aspect, the present invention discloses an abnormality attribution device based on a multidimensional data set, comprising: A critical time point determination module determines a critical time point at which an abnormality occurs, wherein a period of time before the critical time point is a normal interval, and a period of time after the critical time point is an abnormal interval; The group calculation module determines the statistical method of abnormal indicators and the dimensions that need to be analyzed. According to the statistical method of abnormal indicators, the statistical value of each dimension in the abnormal interval and the normal interval is calculated; The abnormal dimension judgment module compares the statistical values ​​of the abnormal interval with the statistical values ​​of the normal interval, and filters out the dimensions that do not contribute to the abnormality; for the remaining dimensions, the difference between the abnormal interval and the normal interval is calculated, recorded as the residual, and a threshold is set. The dimension with a residual greater than the threshold is determined as an abnormal dimension that contributes to the abnormality; The statistical output module counts and outputs the proportion of the abnormal interval statistical value of each abnormal dimension in the statistical values ​​of all dimensions to complete the abnormal attribution analysis.

[0011] In a third aspect, the present invention discloses an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, an anomaly attribution method based on a multidimensional data set as described above is implemented.

[0012] In a fourth aspect, the present invention discloses a non-transitory computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the computer program implements any of the above-described anomaly attribution methods based on a multidimensional data set.

[0013] The present invention first determines the critical time point when the anomaly occurs; calculates the statistical value of each dimension in the abnormal interval and the normal interval according to the statistical method of the anomaly indicator; filters the dimensions that do not contribute to the anomaly, calculates the residuals of the remaining dimensions, and determines the dimensions whose residuals are greater than the threshold as abnormal dimensions that contribute to the anomaly; through the above-mentioned optimization algorithm design, millisecond-level anomaly attribution analysis is achieved, which greatly improves the analysis efficiency.

[0014] In addition, the residual analysis and threshold setting method of the present invention based on statistical principles ensure the accuracy of abnormal attribution.

[0015] The present invention supports a variety of monitoring indicators and dimension combinations to meet the needs of abnormal attribution in different scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 This is a schematic diagram of IT system monitoring; Figure 2 It is a schematic diagram of multi-dimensional analysis; Figure 3 It is the relationship diagram between the general trend anomaly and the multi-dimensional anomaly; Figure 4 A schematic diagram of a flow chart of an abnormality attribution method based on a multidimensional data set provided in Example 1 of the present invention; Figure 5 This is a schematic diagram of determining a critical time point in Example 1 of the present invention; Figure 6 This is an example of multi-dimensional statistical values ​​of data grouping according to Embodiment 1 of the present invention; Figure 7 It is one of the application displays of embodiment 1 of the present invention; Figure 8 This is the second application display of the first embodiment of the present invention; Fig. 9 A schematic diagram of the structure of an abnormality attribution device based on a multidimensional data set provided in Example 2 of the present invention. DETAILED DESCRIPTION

[0017] The present invention will be described in detail below with reference to the accompanying drawings and in combination with embodiments. The principles and features of the present invention are described below in combination with the accompanying drawings. It should be noted that the embodiments in this application and the features in the embodiments can be combined with each other without conflict. The embodiments are only used to explain the present invention and are not used to limit the scope of the present invention.

[0018] like Figure 1As shown in the figure, in order to ensure the stability of the service, software service providers need to monitor their own systems in an all-round way. One of the most important aspects is user experience monitoring. When the user experience deteriorates, it needs to be paid attention to and handled in a timely manner. The most direct way to monitor the user experience is to collect the response time of user requests at the service entrance. Its deterioration generally directly reflects the decline of user experience.

[0019] It is necessary to determine whether the distribution of anomalies is concentrated in a certain dimension, such as whether they are all in city D, all from tenant 4, or all accessing function A. This will directly determine the direction of the expert's subsequent investigation in order to buy time to stop the loss. Figure 2 .

[0020] The difficulties are: 1) Different indicators such as response time, success rate, error volume, and access volume have different definitions of abnormality, which is related to the meaning and trend of the indicator. When the total indicator rises abnormally, the corresponding dimension combination that needs to be analyzed only needs to consider the increase.

[0021] 2) All dimensional combinations need to be exhausted during calculation. As the number of dimensions increases, the amount of calculation increases exponentially.

[0022] 3) Different indicators have different statistical methods and different definitions of anomalies. Each indicator needs to be classified and analyzed.

[0023] Monitoring indicators are statistically derived from logs and monitor the overall business indicators of an application. When an overall indicator is abnormal, drill-down analysis is required. The indicators of each detailed dimension (such as monitoring the response time of each user, the number of visits in each region, the success rate of each function, etc.) are not directly monitored. This is because long-term practice in the operation and maintenance industry has shown that monitoring specific dimensions is not feasible, because there are too many dimensions that need to be monitored. The number of dimensions alone from the user dimension is an order of magnitude. Full monitoring means an increase in resource overhead and a doubling of labor costs. Moreover, the finer the monitoring granularity, the more sensitive it is to glitches, resulting in many false alarms, which in turn reduces the efficiency of operation and maintenance.

[0024] To address the above issues, monitoring some core dimensional indicators and performing drill-down analysis through core indicators is a better solution. The traditional approach is: In order to analyze the distribution of this anomaly, the operation and maintenance personnel need to open the analysis dashboard, enter the corresponding parameters, and then observe the chart with the naked eye to draw conclusions. This process takes at least 2 minutes for senior experts, while the general enterprise requires 5-10 minutes for fault recovery, which makes the subsequent investigation and disposal time even tighter.

[0025] like Figure 3As shown in the figure, if there are x tenants, y cities, and z functions accessed, we need to draw x+y+z such curves to find anomalies similar to the general trend. In actual production, we find that the amount of data is very large and the calculation process often exceeds 2 minutes, which makes this meaningless. However, this is only a one-dimensional case. When multi-dimensional combinations need to be considered, the amount of calculation will increase exponentially.

[0026] How to enable operation and maintenance personnel to receive push messages without having to turn on their computers and speed up the analysis process is a problem that needs to be solved.

[0027] The technical solution of the present invention to solve the problem is described in detail below in conjunction with embodiments.

[0028] Example 1 like Figure 4 As shown, the present invention provides an abnormality attribution method based on a multidimensional data set, which specifically includes the following steps: S11, determine the critical time point when the abnormality occurs like Figure 5 As shown, the analysis needs to take the data of a period of time before and after the critical time for calculation. Taking the monitoring scenario as an example, if the alarm occurs at T, TM can be taken as the critical time point, where M is a period of time. Preferably, M is 3 minutes, and the data of 3 minutes before and after the critical time point represent the abnormal interval and the normal interval respectively. This is because monitoring alarms are generally calculated based on the data of the last 3 minutes, that is, when an alarm occurs, it means that the system has an abnormality since the beginning of the last 3 minutes. The selection of the critical time point needs to be based on the specific scenario. The principle is that this time point must be the watershed of the abnormality (the time when the mutation occurs).

[0029] S12, data group calculation It should be made clear that drill-down analysis and overall indicator monitoring are aggregated from the same detailed data. When an overall indicator is abnormal, several factors need to be clarified first: 1) Statistical methods for abnormal indicators (such as response time, generally taking the average of all response times per minute, access volume, and calculating the total number of records, etc.); 2) What dimensions need to be analyzed (such as city, function, tenants, etc.)

[0030] After these factors are identified, the statistical values ​​of the green and red zones of each dimension need to be calculated according to the statistical method of abnormal indicators. In this way, because the critical time point is the time when the abnormality occurs, it means that the red zone must contain abnormalities that need attention, while the green zone is considered normal. It can be understood that if no abnormality occurs, the green zone data can be used to approximately predict the situation in the next period. In other words, if no abnormality occurs, the data in the green zone is what the data in the red zone originally looks like.

[0031] In this step, two sets of data are obtained (red real and green forecast), each of which contains the statistical values ​​of the dimension to be analyzed. Figure 6 .

[0032] The data is grouped, but it is not certain that all dimensions will be visited before and after the critical point. In fact, the dimension combination in the red zone is used as the standard, and its statistical value in the green zone is added. If this value does not exist (it means that the combination has never been visited before), it is filled with the mean value of the green zone, so as to ensure that all dimension combinations can get normal values.

[0033] S13, abnormal dimension judgment At this time, we need to check the abnormal judgment rules. Taking response time as an example, the overall indicator will alarm when the response time increases, which means that the contributor to the abnormality must be the increase in response time. This means that most dimensions can be filtered out before calculation, that is, the dimensions with red zone values ​​≤ green zone values.

[0034] After filtering out these dimensions, the remaining dimensions are not necessarily contributors to the anomaly. The next thing to do is to find the truly abnormal dimensions from the combination of dimensions that increase the response time.

[0035] The difference between real and forecast can be calculated and recorded as residuals. The larger the residual, the greater the contribution of the anomaly. Given a threshold, the dimension with a residual greater than the threshold is judged as an abnormal dimension that contributes to the anomaly.

[0036] After filtering out all the abnormal contribution dimensions, we can easily calculate the visit volume share of the largest contributor in each dimension through the column formula. If the contributors have too large a share, it is considered that the abnormality is concentrated in one dimension value. For example, the increase in response time comes from the value of the "Beijing" city dimension.

[0037] S14, Summary of Results At this point, the algorithm's analysis process has ended, and all combinations of contributing dimensions of the anomaly have been filtered out. Next, the results can be summarized in terms of business direction. Taking the monitoring and analysis scenario as an example, the highest proportion of all dimensions is counted one by one. If its proportion exceeds 50%, it is generally believed that the anomaly is more concentrated in this dimension. Finally, all the anomaly dimensions are output and the analysis results are obtained. The overall calculation time is at the millisecond level. It is a very lightweight algorithm with an accuracy of 100%.

[0038] The above-mentioned method of evaluating the size of residuals means that it is necessary to base it on different indicators and different abnormal forms, or even different business scenarios. Many sets of thresholds are maintained, and these thresholds are relatively abstract, and business personnel often find it difficult to maintain them. Therefore, the present invention also provides a preferred calculation method, which is to calculate the mean and standard deviation of the residuals of all dimensions, and regard the larger of the two as the threshold. As long as it is greater than this value, it is considered to be a contributor to the anomaly. This solution takes into account two situations: 1) The residual fluctuation is very small, that is, the residuals in each dimension are very similar. In this case, the standard deviation is very small and the mean is large, so the mean is used as the threshold.

[0039] 2) The residual fluctuates greatly and the residual value itself is small. In this case, the standard deviation is large and the mean is small, so the standard deviation is used as the threshold.

[0040] Example 2 The following is a description of an abnormality attribution device based on a multidimensional data set provided by the present invention. The abnormality attribution device based on a multidimensional data set described below and the abnormality attribution method based on a multidimensional data set described above can be referred to in correspondence with each other. Fig. 9 As shown, the abnormal attribution device based on the multi-dimensional data set includes: A critical time point determination module 21 determines a critical time point at which an abnormality occurs, wherein a period of time before the critical time point is a normal interval, and a period of time after the critical time point is an abnormal interval; The group calculation module 22 determines the statistical method of the abnormal index and the dimensions to be analyzed, and calculates the statistical value of each dimension in the abnormal interval and the normal interval according to the statistical method of the abnormal index; The abnormal dimension judgment module 23 compares the statistical value of the abnormal interval with the statistical value of the normal interval, and filters out the dimensions that do not contribute to the abnormality; for the remaining dimensions, the difference between the abnormal interval and the normal interval is calculated, recorded as the residual, and a threshold is set, and the dimension whose residual is greater than the threshold is determined as the abnormal dimension that contributes to the abnormality; The statistical output module 24 counts and outputs the proportion of the abnormal interval statistical value of each abnormal dimension in the statistical values ​​of all dimensions to complete the abnormal attribution analysis.

[0041] On the other hand, the present invention discloses an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, any of the above-mentioned anomaly attribution methods based on a multidimensional data set is implemented.

[0042] On the other hand, the present invention discloses a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements any of the above-mentioned anomaly attribution methods based on a multidimensional data set.

[0043] At present, the anomaly attribution system based on the multidimensional data set of the present invention has been put into use in production. Figure 7 , Figure 8 This is a display example of a specific application of the present invention, from which it can be seen that the present invention can quickly find the root cause of the abnormality and provide an analysis process and a solution based on it.

[0044] The present invention is not limited to operation and maintenance analysis scenarios, but can be used for all scenarios of abnormal attribution of multidimensional data. For example, when the cost of cloud products increases, analysis can be used to quickly determine which billing item or instance caused the increase, and measures can be taken quickly.

[0045] Obviously, the above embodiments are merely examples for the purpose of clear explanation, and are not intended to limit the implementation methods. For those skilled in the art, other different forms of changes or modifications can be made based on the above description. It is not necessary and impossible to list all the implementation methods here. The obvious changes or modifications derived therefrom are still within the scope of protection of the invention.

Claims

1. An anomaly attribution method based on a multidimensional data set, characterized in that: The steps include: Step S11, determining a critical time point at which an abnormality occurs, wherein a period of time before the critical time point is a normal interval, and a period of time after the critical time point is an abnormal interval; Step S12, determine the statistical method of abnormal indicators and the dimensions to be analyzed, and calculate the statistical values ​​of each dimension in the abnormal interval and the normal interval according to the statistical method of abnormal indicators; Step S13, compare the statistical values ​​of the abnormal interval with the statistical values ​​of the normal interval, and filter out the dimensions that do not contribute to the abnormality; for the remaining dimensions, calculate the difference between the abnormal interval and the normal interval, record it as the residual, set a threshold, and determine the dimension with a residual greater than the threshold as the abnormal dimension that contributes to the abnormality; Step S14: Count and output the proportion of the abnormal interval statistical value of each abnormal dimension in the statistical value of all dimensions to complete the abnormal attribution analysis.

2. The abnormality attribution method according to claim 1, characterized in that: In step S11, the critical time point is a time point before the alarm time.

3. The abnormality attribution method according to claim 1, characterized in that: In step S11, the critical time point is 3 minutes before the alarm time, and the normal interval and the abnormal interval are 3 minutes before and after the critical time point respectively.

4. The abnormality attribution method according to claim 2, characterized in that: In step S12, if a dimension has not been accessed after the critical time point, the abnormal interval statistical value does not exist, and is then filled with the normal interval statistical value.

5. The abnormality attribution method according to claim 4, characterized in that: In step S13, the dimension that does not contribute to the anomaly is determined as follows: for a situation where an abnormality is caused by an increase in an indicator, if the statistical value of the abnormal interval is not greater than the statistical value of the normal interval, then it is a dimension that does not contribute to the anomaly.

6. The abnormality attribution method according to claim 5, characterized in that: In step S13, the threshold is the larger one of the mean and the standard deviation of the residual.

7. An abnormality attribution device based on a multidimensional data set, characterized in that: include: A critical time point determination module determines a critical time point at which an abnormality occurs, wherein a period of time before the critical time point is a normal interval, and a period of time after the critical time point is an abnormal interval; The group calculation module determines the statistical method of abnormal indicators and the dimensions that need to be analyzed. According to the statistical method of abnormal indicators, the statistical value of each dimension in the abnormal interval and the normal interval is calculated; The abnormal dimension judgment module compares the statistical values ​​of the abnormal interval with the statistical values ​​of the normal interval, and filters out the dimensions that do not contribute to the abnormality; for the remaining dimensions, the difference between the abnormal interval and the normal interval is calculated, recorded as the residual, and a threshold is set. The dimension with a residual greater than the threshold is determined as an abnormal dimension that contributes to the abnormality; The statistical output module counts and outputs the proportion of the abnormal interval statistical value of each abnormal dimension in the statistical values ​​of all dimensions to complete the abnormal attribution analysis.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the anomaly attribution method based on a multidimensional data set as described in any one of claims 1 to 6 is implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the anomaly attribution method based on a multidimensional dataset as described in any one of claims 1 to 6 is implemented.

Images