Abnormal root cause positioning method and device based on attention mechanism and medium

Abstract

The invention provides an abnormal root cause positioning method and device based on an attention mechanism and a medium, and relates to the technical field of databases. According to the method, a time sequence of a database monitoring curve is obtained, the time sequence is input into an abnormal root cause positioning model based on an attention mechanism, and the abnormal root cause positioning model is obtained based on training of a time convolutional network and a long-short-term memory neural network; performing feature extraction, attention weighting and anomaly analysis on the time sequence according to the anomaly root cause positioning model to obtain an anomaly analysis result; and determining whether the database is abnormal according to the abnormal analysis result, and determining an abnormal type and a root cause positioning result when the database is abnormal. According to the method, the accuracy of database anomaly detection and root cause positioning is improved.

Description

Technical Field

[0001] The present application relates to the field of database technology, and in particular to an abnormality root cause location method, device and medium based on an attention mechanism. Background Art

[0002] A database is a computer software system that stores and manages data according to data structures. With the development of cloud computing and the advent of the big data era, how to accurately monitor and locate anomalies in the database has become increasingly important.

[0003] In related technologies, the operation and maintenance monitoring system can visualize the monitoring curves of all indicators of the database, and use algorithms such as deep learning to perform anomaly detection and analysis on the time series of the monitoring curves, thereby identifying abnormal indicators in the database.

[0004] However, the accuracy of anomaly detection and root cause location in databases using deep learning is low. Summary of the invention

[0005] The embodiments of the present application provide a method, device and medium for locating the root cause of anomalies based on an attention mechanism, which can improve the accuracy of database anomaly detection and root cause location.

[0006] In a first aspect, an embodiment of the present application provides a method for locating an abnormal root cause based on an attention mechanism, comprising:

[0007] Obtain a time series of a database monitoring curve, and input the time series into an abnormal root cause location model based on an attention mechanism, wherein the abnormal root cause location model is obtained by training a temporal convolutional network (TCN) and a long short-term memory (LSTM) neural network;

[0008] Performing feature extraction, attention weighting and anomaly analysis on the time series according to the anomaly root cause location model to obtain an anomaly analysis result;

[0009] Determine whether an abnormality occurs in the database according to the abnormality analysis result, and the abnormality type and root cause location result when an abnormality occurs in the database.

[0010] In a possible implementation, performing feature extraction, attention weighting, and anomaly analysis on the time series according to the anomaly root cause location model to obtain an anomaly analysis result includes:

[0011] Input the time series into the TCN feature extraction module of the abnormal root cause location model, perform ordinary convolution and dilated causal convolution on the time series, and obtain a high-dimensional time series feature vector;

[0012] Determine a feature attention weight of the high-dimensional time series feature vector, and perform attention weighted processing on the high-dimensional time series feature vector according to the feature attention weight to obtain a time series feature vector;

[0013] Inputting the time series feature vector into the LSTM anomaly analysis module of the anomaly root cause location model to obtain the hidden state vector at each moment;

[0014] Determine a temporal attention weight corresponding to the hidden state vector, and perform attention weighted processing on the hidden state vector according to the temporal attention weight to obtain a temporal state vector;

[0015] An abnormality analysis is performed according to the time series state vector to obtain an abnormality analysis result.

[0016] In a possible implementation, the abnormal root cause location model based on the attention mechanism is trained in the following manner:

[0017] According to the preset sliding window, the preset monitoring indicators in the database monitoring curve are resampled with overlapping samples in time to obtain the initial sequence samples;

[0018] Performing data preprocessing on the initial sequence samples to obtain sequence samples after multi-dimensional index fusion, wherein the sequence samples include sample labels, and the sample labels include whether an abnormality occurs in the database, and the type of abnormality and location of the abnormal root cause when an abnormality occurs in the database;

[0019] Inputting the sequence samples after the fusion of the multi-dimensional indicators into the initial neural network model to obtain the model output result, wherein the initial neural network model includes a time convolution network TCN based on the attention mechanism and a long short-term memory neural network LSTM based on the attention mechanism;

[0020] Iterative training is performed according to the output results of the model and a preset loss function to obtain an abnormal root cause location model based on the attention mechanism.

[0021] In a possible implementation, resampling the preset monitoring indicators in the database monitoring curve according to the preset sliding window to obtain the initial sequence samples includes:

[0022] Determine the time series data corresponding to each preset monitoring indicator in the preset sampling period of the database monitoring curve;

[0023] For each monitoring indicator, resample the time series data corresponding to the monitoring indicator with time overlap according to a preset sliding window to obtain a sequence sample of the monitoring indicator, and generate a sample label corresponding to each sequence sample;

[0024] According to the sequence samples corresponding to each monitoring indicator, an initial sequence sample is generated.

[0025] In a possible implementation manner, performing data preprocessing on the initial sequence samples to obtain sequence samples after multi-dimensional index fusion includes:

[0026] Performing standardization processing on the initial sequence sample to obtain a standardized sequence sample;

[0027] Based on the Bayesian information criterion, the sequence samples corresponding to each monitoring indicator are fused to obtain the sequence samples after the fusion of multi-dimensional indicators of different monitoring indicator dimensions.

[0028] In a possible implementation, the inputting of the sequence samples after the fusion of the multi-dimensional indicators into the initial neural network model to obtain the model output result includes:

[0029] Inputting the sequence samples after the fusion of the multi-dimensional indicators into a time convolution network based on an attention mechanism, wherein the time convolution network based on the attention mechanism includes a common convolution layer, a TCN convolution layer and an attention layer;

[0030] Using a common convolutional layer to perform preliminary feature extraction on the sequence samples after the fusion of the multi-dimensional indicators to obtain an initial feature vector;

[0031] The initial feature vector is extracted using a TCN convolutional layer and batch normalization to obtain a multi-step high-dimensional time series feature vector;

[0032] Determine the feature attention weight of the high-dimensional time series feature vector by using the attention layer, and perform attention weighted processing on the high-dimensional time series feature vector according to the feature attention weight to obtain a time series feature vector;

[0033] Inputting the time series feature vector into a long short-term memory neural network based on an attention mechanism, wherein the long short-term memory neural network based on the attention mechanism includes an LSTM layer, an attention layer, and a fully connected layer;

[0034] Iteratively train the time series feature vector using the LSTM layer to obtain a hidden state vector at each moment;

[0035] Determine the time attention weight corresponding to the hidden state vector by using the attention layer, and perform attention weighted processing on the hidden state vector according to the time attention weight to obtain a temporal state vector;

[0036] The time series state vector is input into the fully connected layer to obtain the model output result.

[0037] In a possible implementation, the abnormality types include: excessive pressure on the main database, deadlock of the proxy server, abnormality of the database management service, and abnormality of the Chitu management platform;

[0038] The monitoring indicator is a database indicator related to the abnormal type.

[0039] In a second aspect, an embodiment of the present application provides a computing device, including:

[0040] An acquisition module is used to acquire a time series of a database monitoring curve and input the time series into an abnormal root cause location model based on an attention mechanism, wherein the abnormal root cause location model is obtained by training a temporal convolutional network (TCN) and a long short-term memory (LSTM) neural network;

[0041] A processing module is used to perform feature extraction, attention weighting and anomaly analysis on the time series according to the anomaly root cause location model to obtain an anomaly analysis result; and determine whether an anomaly occurs in the database according to the anomaly analysis result, as well as the anomaly type and root cause location result when an anomaly occurs in the database.

[0042] In a third aspect, an embodiment of the present application provides another computing device, including:

[0043] A processor, and a memory communicatively connected to the processor;

[0044] Memory is used to store computer executable instructions;

[0045] The processor is used to execute the computer-executable instructions stored in the memory, so that the processor executes the above-mentioned first aspect and / or various possible implementations of the first aspect.

[0046] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to implement the above-mentioned first aspect and / or various possible implementation methods of the first aspect.

[0047] In a fifth aspect, an embodiment of the present application provides a computer program product, including a computer program, which, when executed by a processor, is used to implement the above-mentioned first aspect and / or various possible implementation methods of the first aspect.

[0048] The embodiments of the present application provide a method, device and medium for locating the root cause of anomalies based on an attention mechanism, which can use the root cause location model of anomalies obtained by training based on a time convolution network TCN and a long short-term memory neural network LSTM to perform anomaly detection and root cause location on the time series of the database monitoring curve. The root cause location model of anomalies based on the attention mechanism can use the TCN dilated causal convolution to extract high-dimensional features of the time series, extract richer and more important features and historical key time point information, and introduce the attention mechanism to allocate feature weights while fully extracting deep features to reflect the importance of different features. Afterwards, LSTM and the attention mechanism can also be used to perform anomaly analysis on the features extracted by TCN, and the connection between time series can be mined to consider the influence of the time series information of historical moments on the anomaly detection at the current moment, thereby improving the accuracy of database anomaly detection and root cause location. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0050] Figure 1 This is a flow chart of an abnormal root cause location method based on an attention mechanism according to an embodiment of the present application;

[0051] Figure 2 This is a schematic diagram of the structure of an abnormal root cause location model based on an attention mechanism according to an embodiment of the present application;

[0052] Figure 3 A schematic diagram of a model training process according to an embodiment of the present application;

[0053] Figure 4 A schematic diagram of a calculation process of a time series feature vector according to an embodiment of the present application;

[0054] Figure 5 A schematic diagram of a calculation process of a timing state vector according to an embodiment of the present application;

[0055] Figure 6 A schematic diagram of the structure of a computing device according to an embodiment of the present application;

[0056] Figure 7 A schematic diagram of the structure of a computing device according to another embodiment of the present application.

[0057] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0058] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0059] The terms "first", "second", "third", "fourth", etc. (if any) in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0060] In the technical solution of this application, the collection, storage, use, processing, transmission, provision and disclosure of information such as financial data or user data involved shall comply with the provisions of relevant laws and regulations and shall not violate public order and good morals.

[0061] It should be noted that in the embodiments of the present application, certain software, components, models and other existing solutions in the industry may be mentioned, and they should be regarded as exemplary. Their purpose is only to illustrate the feasibility of implementing the technical solution of the present application, but it does not mean that the applicant has or will necessarily use the solution.

[0062] It should also be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0063] The anomaly root cause localization method, device and medium based on the attention mechanism of the present application can be used in the field of database technology, and can also be used in any field other than the field of database technology, such as the field of anomaly root cause localization, etc. The application field of the anomaly root cause localization method, device and medium based on the attention mechanism of the present application is not limited.

[0064] The anomaly root cause location method, device and medium based on the attention mechanism of the present application can be applied to the scenario of database anomaly detection, especially the related scenario of anomaly detection of TDSQL database. Any scenario involving database anomaly detection can apply the anomaly root cause location method, device and medium based on the attention mechanism of the present application.

[0065] First, the terms involved in this application are explained:

[0066] Temporal Convolutional Networks (TCN) are a new type of network structure that improves on traditional convolutional neural networks and can solve time series problems. They mainly include causal convolution, dilated convolution, and residual connection. Convolutional networks introduce causal convolution to make the network layers have causal relationships and realize time series modeling. Dilated convolution can expand the receptive field without increasing the number of deeper network layers to solve the problem of long-distance data dependency in time series models.

[0067] Long short-term memory (LSTM) is a special variant designed to solve the problem of gradient disappearance or explosion in recurrent neural network (RNN) training, and is suitable for solving time series problems. LSTM introduces the design of gate structure, namely forget gate, input gate and output gate. The forget gate can forget a certain proportion of past time series feature information; the input gate records part of the current input information into the cell state; the output gate selectively encodes the hidden state vector and the cell state as the input of the LSTM unit at the next moment.

[0068] The basic idea of ​​the attention mechanism is to assign different weights to the information nodes of the input vector, giving high weights to important information and low weights to unimportant information, so as to obtain key clues that are more effective for the task.

[0069] The Bayesian Information Criterion (BIC) is a statistical criterion based on model selection. It is mainly used to solve model selection problems. Its purpose is to find a balance between model complexity and the model's ability to describe the data set. When the dimension of the training sample data is too large, it can effectively avoid the dimensionality disaster.

[0070] A database is a computer software system that stores and manages data according to data structures. With the development of cloud computing and the advent of the big data era, how to accurately monitor and locate anomalies in the database has become increasingly important.

[0071] In the related art, the operation and maintenance monitoring system can visualize the monitoring curves of all indicators of the database, and use deep learning and other algorithms to detect and analyze anomalies in the time series of the monitoring curves, thereby identifying abnormal indicators in the database. Exemplarily, a deep learning model is used to detect anomalies in database performance indicators, such as using models based on sparse autoencoders, variational autoencoders, etc. to identify abnormal data points in the database.

[0072] However, the accuracy of anomaly detection and root cause location in databases using deep learning is low, and this method can usually only detect whether a certain indicator of the database is abnormal, and cannot analyze and detect anomalies caused by multiple related indicators.

[0073] Based on the above technical problems, the inventive concept of the present application is to provide an anomaly root cause location solution that can improve the accuracy of database anomaly detection and root cause location.

[0074] The embodiments of the present application provide a method, device and medium for locating the root cause of anomalies based on an attention mechanism, which can perform anomaly detection and root cause location using an anomaly root cause location model constructed based on a time convolution network TCN, a long short-term memory neural network LSTM and an attention mechanism. The TCN feature extraction side can extract high-dimensional features of past time series data, and the LSTM anomaly analysis side can fully consider the impact of memory information of important time points on the current. At the same time, the attention mechanisms introduced on the TCN feature extraction side and the LSTM anomaly analysis side can extract richer and more important features and historical key time point information, thereby improving the accuracy of anomaly detection and root cause location using an anomaly root cause location model based on an attention mechanism.

[0075] The technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems are described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0076] Figure 1 This is a flow chart of an abnormal root cause location method based on an attention mechanism according to an embodiment of the present application. This embodiment uses a computing device as an execution subject to illustrate the abnormal root cause location method based on the attention mechanism. Figure 1 As shown, the abnormal root cause location method based on the attention mechanism may include the following steps:

[0077] S101: Obtain a time series of a database monitoring curve, and input the time series into an abnormal root cause location model based on an attention mechanism.

[0078] In this embodiment, the abnormal root cause location model is obtained based on the training of the temporal convolutional network TCN and the long short-term memory neural network LSTM, and is a sequence-to-sequence model.

[0079] In this embodiment, the computing device may be a terminal device such as a computer, or a server device such as a cloud server or a physical server, or a terminal-server integrated device, without any limitation.

[0080] In this embodiment, the time series of the database monitoring curve may be a time series including all monitoring indicators of the database.

[0081] In this embodiment, the database may be a TDSQL database.

[0082] S102: Perform feature extraction, attention weighting, and anomaly analysis on the time series according to the anomaly root cause location model to obtain an anomaly analysis result.

[0083] In this embodiment, the abnormal root cause location model may include a TCN feature extraction module and an LSTM abnormality analysis module, and an attention mechanism is introduced into both the TCN feature extraction module and the LSTM abnormality analysis module.

[0084] In this embodiment, the TCN feature extraction module in the abnormal root cause location model can be used to extract features of the time series, and an attention mechanism is introduced in the TCN feature extraction module to perform attention weighting on the extracted feature vectors, thereby improving the accuracy of the feature vectors.

[0085] In this embodiment, the LSTM anomaly analysis module in the anomaly root cause location model can also be used to perform anomaly analysis on the extracted feature vector, and an attention mechanism is introduced in the LSTM anomaly analysis module to mine the connection between time series to consider the influence of the time series information of historical moments on the anomaly detection at the current moment, thereby improving the accuracy of the anomaly analysis results.

[0086] S103: Determine whether an abnormality occurs in the database according to the abnormality analysis result, and the abnormality type and root cause location result when an abnormality occurs in the database.

[0087] In this embodiment, the abnormality analysis result may include whether an abnormality occurs in the database, as well as the abnormality type and monitoring indicators when the database abnormality occurs. The root cause of the abnormality can be located according to the hardware / software type to which the monitoring indicators belong.

[0088] In this embodiment, the exception types may include excessive pressure on the main database, deadlock of the proxy server, DMC database management service exception, and Chitu management platform exception; the monitoring indicators may be relevant database indicators of each exception type.

[0089] In this embodiment, the abnormal root cause location model obtained by training the time convolution network TCN and the long short-term memory neural network LSTM can be used to perform abnormal detection and root cause location on the time series of the database monitoring curve. The abnormal root cause location model based on the attention mechanism can use the TCN expansion causal convolution to extract high-dimensional features of the time series, extract richer and more important features and historical key time point information, and introduce the attention mechanism to allocate feature weights while fully extracting deep features to reflect the importance of different features. Afterwards, LSTM and the attention mechanism can also be used to perform abnormal analysis on the features extracted by TCN, and the connection between time series can be explored to consider the influence of the time series information of historical moments on the abnormal detection of the current moment, thereby improving the accuracy of database abnormality detection and root cause location.

[0090] In a possible implementation, the above step S102 performs feature extraction, attention weighting, and anomaly analysis on the time series according to the anomaly root cause location model to obtain an anomaly analysis result, which may include:

[0091] S11: Input the time series into the TCN feature extraction module of the anomaly root cause location model, perform ordinary convolution and dilated causal convolution on the time series, and obtain a high-dimensional time series feature vector.

[0092] S12: Determine the feature attention weight of the high-dimensional time series feature vector, and perform attention weighted processing on the high-dimensional time series feature vector according to the feature attention weight to obtain the time series feature vector.

[0093] S13: Input the time series feature vector into the LSTM anomaly analysis module of the anomaly root cause location model to obtain the hidden state vector at each moment.

[0094] S14: Determine the temporal attention weight corresponding to the hidden state vector, and perform attention weighted processing on the hidden state vector according to the temporal attention weight to obtain a temporal state vector.

[0095] S15: Perform an abnormality analysis according to the time series state vector to obtain an abnormality analysis result.

[0096] For example, Figure 2 Schematic diagram of the structure of an abnormal root cause location model based on the attention mechanism according to an embodiment of the present application. Figure 2As shown in the figure, the abnormal root cause location model based on the attention mechanism includes: an input layer, a TCN feature extraction module composed of a temporal convolutional network based on the attention mechanism, an LSTM abnormal analysis module composed of a long short-term memory neural network based on the attention mechanism, and an output layer. The TCN feature extraction module includes a common convolution layer, a TCN convolution layer, and an attention layer; the LSTM abnormal analysis module includes an LSTM layer, an attention layer, and a fully connected layer.

[0097] In this embodiment, when performing attention weighted processing on a high-dimensional time series feature vector according to the feature attention weight, the feature attention weight can be multiplied by the corresponding high-dimensional time series feature vector to obtain the time series feature vector.

[0098] In this embodiment, the hidden state vector is subjected to attention weighting processing according to the temporal attention weight. When the temporal state vector is obtained, the temporal attention weight can be multiplied by the corresponding hidden state vector and the summed up to obtain the temporal state vector.

[0099] In this implementation, the time series state vector may be input into the fully connected layer of the anomaly analysis module to complete anomaly detection and root cause location of the database.

[0100] In this embodiment, the TCN feature extraction module of the abnormal root cause location model can extract features from the input time series, and introduce the attention mechanism to allocate feature weights to reflect the importance of different features while fully extracting deep features. The LSTM abnormal analysis module of the abnormal root cause location model can analyze the input time series feature vector, which can capture the evolution pattern of the sequence more completely, and introduce the attention mechanism to fully consider the impact of the memory information of important time points on the current, thereby improving the accuracy of the abnormal analysis results.

[0101] In a possible implementation, the abnormal root cause location model based on the attention mechanism in the above step S101 can be trained in the following manner:

[0102] S21: resampling the preset monitoring indicators in the database monitoring curve according to the preset sliding window, with time overlapping samples, to obtain initial sequence samples.

[0103] S22: Perform data preprocessing on the initial sequence samples to obtain sequence samples after multi-dimensional index fusion, where the sequence samples include sample labels, and the sample labels include whether an abnormality occurs in the database, and the type of abnormality and location of the root cause of the abnormality when an abnormality occurs in the database.

[0104] S23: Input the sequence samples after the fusion of multi-dimensional indicators into the initial neural network model to obtain the model output result. The initial neural network model includes a temporal convolutional network TCN based on the attention mechanism and a long short-term memory neural network LSTM based on the attention mechanism.

[0105] S24: Perform iterative training according to the model output results and the preset loss function to obtain an abnormal root cause location model based on the attention mechanism.

[0106] In this implementation, the size of the sliding window can be flexibly set by those skilled in the art. For example, the sliding window can be 8 seconds or 10 seconds, and no limitation is made here.

[0107] In this embodiment, the training batch in the training process can be set to 128, and the Adam optimizer can be used to optimize the network parameters of the model. The Adam optimizer has high computational efficiency and low memory requirements, is suitable for optimization problems of large-scale data, and updates network weights more effectively than the stochastic gradient descent method. The loss function can use the mean square error MSE function, which can reflect the accuracy of the model. The lower its value, the higher the accuracy and the better the model effect.

[0108] In this embodiment, after the abnormality root cause location model is trained, the abnormality root cause location model can be loaded into the computing device. When it is necessary to perform abnormality detection and root cause location on the database, the computing device can directly call the trained abnormality root cause location model to perform abnormality detection and location. The call results can be displayed to the administrator in the form of charts and reports. The analysis results can help the system administrator to discover problems in a timely manner so that corresponding measures can be taken.

[0109] In this embodiment, in order to better improve the accuracy of anomaly detection and root cause location, several important database monitoring indicators that can be collected can be selected as the sampling basis. On this basis, the sample is resampled according to the data sampling period set by the database monitoring curve to obtain the initial sequence sample. After that, the initial sequence sample can be preprocessed to obtain the sequence sample after the fusion of multi-dimensional indicators. The sequence sample after the fusion of multi-dimensional indicators can comprehensively characterize the information of the fusion of monitoring indicators of different dimensions, so that the model trained thereafter can learn the ability to analyze monitoring indicators of different dimensions, and can analyze and detect anomalies caused by multiple related indicators, thereby improving the performance of the anomaly root cause location model, and further improving the accuracy of anomaly detection and root cause location using the anomaly root cause location model based on the attention mechanism.

[0110] In a possible implementation, the above step S21 resamples the preset monitoring indicators in the database monitoring curve according to the preset sliding window to obtain the initial sequence samples, which may include:

[0111] S31: Determine the time series data corresponding to each preset monitoring indicator in the preset sampling period of the database monitoring curve.

[0112] S32: For each monitoring indicator, resample the time-overlapping samples of the time series data corresponding to the monitoring indicator according to a preset sliding window to obtain sequence samples of the monitoring indicator, and generate a sample label corresponding to each sequence sample.

[0113] S33: Generate an initial sequence sample according to the sequence sample corresponding to each monitoring indicator.

[0114] In this embodiment, the preset sampling period of the database monitoring curve can be flexibly set by those skilled in the art according to actual conditions, and no limitation is made here.

[0115] In this implementation, when resampling the time-overlapping samples of the time series data corresponding to the monitoring indicator according to the preset sliding window, the sliding step size of the sliding window can be set to 1.

[0116] For example, in the preset sampling period of the database monitoring curve, the time series data of monitoring indicator A is a 30-second time series data, and the sliding window is 8 seconds. In the sampling process, the sliding window is first used to obtain the sequence samples of monitoring indicator A in 0-8 seconds, and then the sliding window is controlled to slide 1 second at a time to obtain the sequence samples of monitoring indicator A in 1-9 seconds, 2-10 seconds, and so on, and obtain multiple sequence samples of monitoring indicator A in a time-overlapping sample resampling manner.

[0117] In this embodiment, if the sequence sample of the monitoring indicator obtained by sampling is a normal sample, the label of the sequence sample is that no abnormality occurs in the database; if the sequence sample of the monitoring indicator obtained by sampling is an abnormal sample, the label of the sequence sample is that an abnormality occurs in the database, as well as the type of abnormality and the location of the root cause of the abnormality when the database abnormality occurs.

[0118] In this embodiment, after determining the time series data corresponding to each monitoring indicator, the time series data corresponding to the monitoring indicator can be resampled with time overlapping samples according to the sliding window, and the samples of the monitoring indicators can be amplified using the time overlapping sample resampling method, thereby expanding the number of sequence samples of each monitoring indicator.

[0119] In a possible implementation, the above step S22 performs data preprocessing on the initial sequence samples to obtain sequence samples after multi-dimensional index fusion, which may include:

[0120] S41: Standardize the initial sequence sample to obtain a standardized sequence sample.

[0121] S42: Based on the Bayesian information criterion, the sequence samples corresponding to each monitoring indicator are fused to obtain the sequence samples after the multi-dimensional indicators of different monitoring indicator dimensions are fused.

[0122] In this embodiment, the sequence samples and their corresponding labels may be standardized to obtain standardized sequence samples.

[0123] In this embodiment, when fusing the sequence samples corresponding to each monitoring indicator, the fusion methods of different monitoring indicators in different dimensions can be fully considered, for example, various possible methods of fusing two-dimensional monitoring indicators, various possible methods of fusing three-dimensional monitoring indicators, etc., until the method of fusing monitoring indicators of the highest dimension.

[0124] In this embodiment, the specific implementation method of fusing the sequence samples corresponding to each monitoring indicator based on the Bayesian information criterion can refer to the relevant existing technology and will not be described in detail here.

[0125] In this embodiment, the initial sequence samples can be standardized first, so that the standardized sequence samples can be used by the model. Afterwards, the sequence samples corresponding to each monitoring indicator can be fused based on the Bayesian information criterion. The fused sequence samples of the multi-dimensional indicators can comprehensively represent the information of the fusion of monitoring indicators of different dimensions, so that the model trained thereafter can learn the ability to analyze monitoring indicators of different dimensions, and can analyze and detect anomalies caused by multiple related indicators, thereby improving the performance of the anomaly root cause location model, and further improving the accuracy of anomaly detection and root cause location using the anomaly root cause location model based on the attention mechanism.

[0126] Figure 3 This is a schematic diagram of a model training process according to an embodiment of the present application. In a possible implementation, as Figure 3 As shown, in the above step S23, the sequence samples after the fusion of multi-dimensional indicators are input into the initial neural network model to obtain the model output result, which may include:

[0127] S51: Input the sequence samples after the fusion of multi-dimensional indicators into the temporal convolutional network based on the attention mechanism. The temporal convolutional network based on the attention mechanism includes a normal convolutional layer, a TCN convolutional layer and an attention layer.

[0128] S52: Use the common convolutional layer to perform preliminary feature extraction on the sequence samples after the fusion of multi-dimensional indicators to obtain the initial feature vector.

[0129] S53: Use TCN convolutional layer and batch normalization to extract features from the initial feature vector to obtain a multi-step high-dimensional time series feature vector.

[0130] S54: Use the attention layer to determine the feature attention weight of the high-dimensional time series feature vector, and perform attention weighted processing on the high-dimensional time series feature vector according to the feature attention weight to obtain the time series feature vector.

[0131] S55: Input the time series feature vector into the long short-term memory neural network based on the attention mechanism, which includes an LSTM layer, an attention layer, and a fully connected layer;

[0132] S56: Use the LSTM layer to iteratively train the time series feature vector to obtain the hidden state vector at each moment.

[0133] S57: Use the attention layer to determine the time attention weight corresponding to the hidden state vector, and perform attention weighted processing on the hidden state vector according to the time attention weight to obtain a temporal state vector.

[0134] S58: Input the time series state vector into the fully connected layer to obtain the model output result.

[0135] In this embodiment, the ordinary convolution layer of the temporal convolutional network (TCN feature extraction module) based on the attention mechanism can perform preliminary feature extraction on the sequence samples (time series) after the fusion of multi-dimensional indicators to obtain the initial feature vector, which is convenient for subsequent model training. The activation function of the ordinary convolution layer is the Relu function.

[0136] The TCN convolutional layer can use batch normalization to extract features from the initial feature vector and obtain a multi-step high-dimensional time series feature vector, giving full play to its structural advantages. Batch normalization is used instead of weight normalization because the latter has higher requirements for initialization, while the former is based on the data itself each time it is scaled, and has strong robustness during optimization.

[0137] Specifically, the TCN convolution layer (TCN dilated causal convolution layer) can be sent to the Dropout layer after the Relu activation function, and finally the residual connection is introduced to perform feature fusion and output a high-dimensional time series feature vector. The dilation factors are set to 1, 2, and 4 respectively.

[0138] In order to calculate the importance of the high-dimensional time series feature vector output by the TCN convolutional layer to the current anomaly detection, the attention layer can quantize the weight of the high-dimensional time series feature vector. Specifically, the attention layer can use a single-layer perceptron to calculate the feature attention correlation coefficient of the high-dimensional time series feature vector, and use the Softmax function to normalize the feature attention correlation coefficient to obtain the corresponding feature attention weight.

[0139] For example, Figure 4 FIG. 1 is a schematic diagram of a calculation process of a time series feature vector according to an embodiment of the present application. Figure 4 As shown, the attention layer calculates each high-dimensional time series feature vector f n The feature attention weight v n After that, each high-dimensional time series feature vector f n And the corresponding feature attention weight v n Multiply them together to obtain time series feature vectors S of different importance n , and the time series feature vector S n Input to the LSTM layer of the attention-based long short-term memory neural network (LSTM anomaly analysis module).

[0140] In this embodiment, the LSTM layer receives the temporal feature vector S input by the time convolution network (TCN feature extraction module) based on the attention mechanism. n After that, it will be iteratively calculated to obtain the hidden state vector at time t, and the hidden state vector at time t will be sent to the attention layer. The activation function of the LSTM layer is the tanh function.

[0141] As the length of the time series increases, the LSTM network is prone to information loss, which leads to a decrease in prediction accuracy. To avoid this phenomenon, an attention mechanism can be added to the LSTM anomaly analysis side, and the connection between time series can be used to consider the impact of the time series information at the historical moment on the anomaly detection at the current moment, obtain key time information, and then complete anomaly detection.

[0142] Specifically, after the attention layer receives the hidden state vector at time t, it calculates the temporal attention coefficient corresponding to each hidden state vector at this time, and then normalizes it using the Softmax function to obtain the temporal attention weight.

[0143] For example, Figure 5 FIG. 1 is a schematic diagram of a calculation process of a timing state vector according to an embodiment of the present application. Figure 5 As shown, the attention layer calculates each hidden state vector h m Corresponding temporal attention weights Afterwards, the hidden state h m With temporal attention weight Perform point multiplication and weighted summation to obtain the time series state vector y.

[0144] In this embodiment, the attention layer can input the time series state vector into the fully connected layer to complete database anomaly detection and root cause location, and output the anomaly detection result through the output layer. The activation function of the fully connected layer is the tanh function, and the activation function of the output layer is the linear function.

[0145] In this embodiment, the time convolution network based on the attention mechanism can extract features from the sequence samples after the fusion of the input multi-dimensional indicators in a batch normalized manner. While fully extracting the deep features, the attention mechanism is introduced to assign feature weights to reflect the importance of different features, and different weight coefficients are assigned to the extracted feature variables to weaken the factors with less correlation, thereby strengthening the contribution of important features to anomaly detection and improving the robustness of the model. The long short-term memory neural network based on the attention mechanism can analyze the input time series feature vector, and can capture the evolution pattern of the sequence more completely. At the same time, the attention mechanism is introduced to fully consider the impact of the memory information of important time points on the current, which improves the accuracy of the anomaly analysis results and further improves the model performance.

[0146] In a possible implementation, the exception types may include: excessive pressure on the main database, deadlock of the proxy server, database management service exception, and Chitu management platform exception; the monitoring indicators may be related database indicators of the exception types.

[0147] In this embodiment, the abnormality of excessive pressure on the main database DB may be caused by slow queries and large transaction accumulation, which is reflected in the increase in business traffic, the pressure on the main DB exceeding the load, and the main CPU usage rate and connection number usage rate being too high, resulting in the main DB being unable to be used normally.

[0148] The deadlock anomaly of the proxy server is reflected in TDSQL misjudging the distributed transaction, causing the proxy deadlock. When a database connection has a distributed transaction, due to a DB kernel defect, the connection state is not reset at the end of the distributed transaction, then the single-shard transaction on the polluted connection will also be mistaken for a distributed transaction. When a transaction has a lock wait, because the proxy has enabled distributed transaction deadlock detection, the lock wait will be misjudged as a deadlock, resulting in a transaction error.

[0149] DMC (database management center) service is abnormal. DMC is a SAAS tool that manages the database through a WEB interface and HTTP API. It is currently deployed in a single node and is installed on a standalone server by default. When a server fails or the network is abnormal, the DMC service will be unavailable.

[0150] The Chitu Management Platform is abnormal. TDSQL's Chitu Management Platform is deployed on two servers, which is a high-availability deployment. If one of the Chitu Management Platforms fails, the console page cannot be accessed for operation and maintenance.

[0151] For example, the following Table 1 is a correspondence table of the monitoring indicators of the above abnormal types of the TDSQL database and their corresponding types:

[0152] Table 1

[0153]

[0154] In this embodiment, after the abnormal root cause location model based on the attention mechanism performs abnormal analysis on the time series of the database monitoring curve, if the abnormal analysis result is that an abnormality occurs in the database, and the abnormality type and the monitoring indicators that cause the abnormality are determined according to the abnormal analysis result, the root cause of the abnormality can be located according to Table 1 above.

[0155] In this embodiment, the monitoring indicators in Table 1 above are important monitoring indicators for determining whether the main database is overloaded, the proxy server is deadlocked, the database management service is abnormal, the Chitu management platform is abnormal, etc. By selecting samples based on the above indicators, the trained model can fully learn the ability to perform abnormal analysis and root cause location on the above monitoring indicators.

[0156] The following is an explanation of the abnormal root cause location method based on the attention mechanism of the present application with a specific embodiment.

[0157] In a specific embodiment, an enterprise needs to perform anomaly detection and anomaly root cause location on a TDSQL database that manages data. The specific anomaly root cause location process is as follows:

[0158] In the first step, the computing device determines the time series data corresponding to each preset monitoring indicator in the preset sampling period of the database monitoring curve; resamples the time series data corresponding to the monitoring indicator according to the preset sliding window, and generates a sample label corresponding to each sequence sample to obtain the initial sequence sample.

[0159] In the second step, the computing device standardizes the initial sequence samples to obtain standardized sequence samples; based on the Bayesian information criterion, the sequence samples corresponding to each monitoring indicator are fused to obtain sequence samples after multi-dimensional indicator fusion of different monitoring indicator dimensions.

[0160] In the third step, the computing device inputs the sequence samples after the fusion of multi-dimensional indicators into the initial neural network model to obtain the model output results. The initial neural network model includes the temporal convolutional network TCN based on the attention mechanism and the long short-term memory neural network LSTM based on the attention mechanism.

[0161] In the fourth step, the computing device performs iterative training based on the model output results and the preset loss function to obtain an abnormal root cause location model based on the attention mechanism.

[0162] In the fifth step, the computing device obtains the time series of the database monitoring curve and inputs the time series into the abnormal root cause location model based on the attention mechanism.

[0163] In the sixth step, the computing device inputs the time series into the TCN feature extraction module of the anomaly root cause location model, performs ordinary convolution and dilated causal convolution on the time series to obtain a high-dimensional time series feature vector; determines the feature attention weight of the high-dimensional time series feature vector, and performs attention weighted processing on the high-dimensional time series feature vector according to the feature attention weight to obtain a time series feature vector.

[0164] In the seventh step, the computing device inputs the time series feature vector into the LSTM anomaly analysis module of the anomaly root cause location model to obtain the hidden state vector at each moment; determines the time attention weight corresponding to the hidden state vector, and performs attention weighted processing on the hidden state vector according to the time attention weight to obtain the time series state vector; performs anomaly analysis based on the time series state vector to obtain the anomaly analysis result.

[0165] In the eighth step, the computing device determines whether an abnormality occurs in the database based on the abnormality analysis results, as well as the abnormality type and root cause location results when an abnormality occurs in the database.

[0166] Figure 6 This is a schematic diagram of the structure of a computing device according to an embodiment of the present application. Figure 6 As shown, the computing device includes: an acquisition module 61, which is used to acquire the time series of the database monitoring curve, and input the time series into an abnormal root cause location model based on the attention mechanism, and the abnormal root cause location model is obtained based on the training of the time convolution network and the long short-term memory neural network; a processing module 62, which is used to perform feature extraction, attention weighting and abnormality analysis on the time series according to the abnormal root cause location model to obtain an abnormality analysis result; and determine whether an abnormality occurs in the database according to the abnormality analysis result, as well as the abnormality type and root cause location result when an abnormality occurs in the database.

[0167] The computing device provided in the embodiment of the present application can execute the technical solution shown in the above method embodiment, and its implementation principle and beneficial effects are similar, which will not be repeated here.

[0168] Figure 7 This is a schematic diagram of the structure of a computing device according to an embodiment of the present application. Figure 7 As shown, the computing device includes: a processor 701, and a memory 702 communicatively connected to the processor 701; the memory 702 stores computer execution instructions; the processor 701 executes the computer execution instructions stored in the memory 702 to implement the steps of the abnormal root cause location method based on the attention mechanism in the above-mentioned method embodiments.

[0169] In the above computing device, the memory 702 and the processor 701 are electrically connected directly or indirectly to realize data transmission or interaction. For example, these elements can be electrically connected to each other through one or more communication buses or signal lines, such as through a bus connection. The memory 702 stores computer-executable instructions for implementing the data access control method, including at least one software function module that can be stored in the memory 702 in the form of software or firmware. The processor 701 executes various functional applications and data processing by running the software programs and modules stored in the memory 702.

[0170] The memory 702 may be, but is not limited to, a random access memory (RAM), a read only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electric erasable programmable read-only memory (EEPROM), etc. The memory 702 is used to store programs, and the processor 701 executes the programs after receiving the execution instruction. Furthermore, the software programs and modules in the above-mentioned memory 702 may also include an operating system, which may include various software components and / or drivers for managing system tasks (such as memory management, storage device control, power management, etc.), and may communicate with various hardware or software components to provide an operating environment for other software components.

[0171] The processor 701 may be an integrated circuit chip having the ability to process signals. The processor 701 may be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc. The methods, steps, and logic diagrams disclosed in the embodiments of the present application may be implemented or executed. The general-purpose processor may be a microprocessor or the processor may be any conventional processor, etc.

[0172] An embodiment of the present application further provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to implement the steps of each method embodiment of the present application.

[0173] An embodiment of the present application further provides a computer program product, including a computer program, which implements the steps of each method embodiment of the present application when executed by a processor.

[0174] It should be noted that, for the aforementioned method embodiments, for the sake of simplicity, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the present application is not limited by the described order of actions, because according to the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all optional embodiments, and the actions and modules involved are not necessarily required by the present application.

[0175] It should be further noted that, although the various steps in the flowchart are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless there is a clear description in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a portion of the steps in the flowchart may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these sub-steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a portion of the sub-steps or stages of other steps.

[0176] It should be understood that the above-mentioned device embodiments are only illustrative, and the device of the present application can also be implemented in other ways. For example, the division of units / modules in the above-mentioned embodiments is only a logical function division, and there may be other division methods in actual implementation. For example, multiple units, modules or components can be combined, or can be integrated into another system, or some features can be ignored or not executed.

[0177] In addition, unless otherwise specified, each functional unit / module in each embodiment of the present application may be integrated into one unit / module, each unit / module may exist physically separately, or two or more units / modules may be integrated together. The above-mentioned integrated unit / module may be implemented in the form of hardware or in the form of a software program module.

[0178] In the above embodiments, the description of each embodiment has its own emphasis. For the part not described in detail in a certain embodiment, please refer to the relevant description of other embodiments. The technical features of the above embodiments can be combined arbitrarily. In order to make the description concise, all possible combinations of the technical features in the above embodiments are not described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0179] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the invention disclosed herein. The present application is intended to cover any modification, use or adaptation of the present application, which follows the general principles of the present application and includes common knowledge or customary techniques in the art that are not disclosed in the present application. The specification and examples are intended to be exemplary only, and the true scope and spirit of the present application are indicated by the appended claims.

[0180] It should be understood that the present application is not limited to the precise structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present application is limited only by the appended claims.

Claims

1. A method for locating the root cause of anomalies based on an attention mechanism, characterized in that: include: Obtain a time series of a database monitoring curve, and input the time series into an abnormal root cause location model based on an attention mechanism, wherein the abnormal root cause location model is obtained by training a temporal convolutional network (TCN) and a long short-term memory (LSTM) neural network; Performing feature extraction, attention weighting and anomaly analysis on the time series according to the anomaly root cause location model to obtain an anomaly analysis result; Determine whether an abnormality occurs in the database according to the abnormality analysis result, and the abnormality type and root cause location result when an abnormality occurs in the database.

2. The abnormal root cause location method based on the attention mechanism according to claim 1 is characterized in that: The performing feature extraction, attention weighting and anomaly analysis on the time series according to the anomaly root cause location model to obtain an anomaly analysis result includes: Input the time series into the TCN feature extraction module of the abnormal root cause location model, perform ordinary convolution and dilated causal convolution on the time series, and obtain a high-dimensional time series feature vector; Determine a feature attention weight of the high-dimensional time series feature vector, and perform attention weighted processing on the high-dimensional time series feature vector according to the feature attention weight to obtain a time series feature vector; Inputting the time series feature vector into the LSTM anomaly analysis module of the anomaly root cause location model to obtain the hidden state vector at each moment; Determine a temporal attention weight corresponding to the hidden state vector, and perform attention weighted processing on the hidden state vector according to the temporal attention weight to obtain a temporal state vector; An abnormality analysis is performed according to the time series state vector to obtain an abnormality analysis result.

3. The abnormal root cause location method based on the attention mechanism according to claim 1 is characterized in that: The abnormal root cause location model based on the attention mechanism is trained in the following way: According to the preset sliding window, the preset monitoring indicators in the database monitoring curve are resampled with overlapping samples in time to obtain the initial sequence samples; Performing data preprocessing on the initial sequence samples to obtain sequence samples after multi-dimensional index fusion, wherein the sequence samples include sample labels, and the sample labels include whether an abnormality occurs in the database, and the type of abnormality and location of the abnormal root cause when an abnormality occurs in the database; Inputting the sequence samples after the fusion of the multi-dimensional indicators into the initial neural network model to obtain the model output result, wherein the initial neural network model includes a time convolution network TCN based on the attention mechanism and a long short-term memory neural network LSTM based on the attention mechanism; Iterative training is performed according to the output results of the model and a preset loss function to obtain an abnormal root cause location model based on the attention mechanism.

4. The abnormal root cause location method based on the attention mechanism according to claim 3 is characterized in that: The method of resampling the preset monitoring indicators in the database monitoring curve according to the preset sliding window to obtain the initial sequence samples includes: Determine the time series data corresponding to each preset monitoring indicator in the preset sampling period of the database monitoring curve; For each monitoring indicator, resample the time series data corresponding to the monitoring indicator with time overlap according to a preset sliding window to obtain a sequence sample of the monitoring indicator, and generate a sample label corresponding to each sequence sample; According to the sequence samples corresponding to each monitoring indicator, an initial sequence sample is generated.

5. The abnormal root cause location method based on the attention mechanism according to claim 4 is characterized in that: The data preprocessing of the initial sequence samples to obtain the sequence samples after multi-dimensional index fusion includes: Performing standardization processing on the initial sequence sample to obtain a standardized sequence sample; Based on the Bayesian information criterion, the sequence samples corresponding to each monitoring indicator are fused to obtain the sequence samples after the fusion of multi-dimensional indicators of different monitoring indicator dimensions.

6. The abnormal root cause location method based on the attention mechanism according to claim 5 is characterized in that: The step of inputting the sequence samples after the fusion of the multi-dimensional indicators into the initial neural network model to obtain the model output result includes: Inputting the sequence samples after the fusion of the multi-dimensional indicators into a time convolution network based on an attention mechanism, wherein the time convolution network based on the attention mechanism includes a common convolution layer, a TCN convolution layer and an attention layer; Using a common convolutional layer to perform preliminary feature extraction on the sequence samples after the fusion of the multi-dimensional indicators to obtain an initial feature vector; The initial feature vector is extracted using a TCN convolutional layer and batch normalization to obtain a multi-step high-dimensional time series feature vector; Determine the feature attention weight of the high-dimensional time series feature vector by using the attention layer, and perform attention weighted processing on the high-dimensional time series feature vector according to the feature attention weight to obtain a time series feature vector; Inputting the time series feature vector into a long short-term memory neural network based on an attention mechanism, wherein the long short-term memory neural network based on the attention mechanism includes an LSTM layer, an attention layer, and a fully connected layer; Iteratively train the time series feature vector using the LSTM layer to obtain a hidden state vector at each moment; Determine the time attention weight corresponding to the hidden state vector by using the attention layer, and perform attention weighted processing on the hidden state vector according to the time attention weight to obtain a temporal state vector; The time series state vector is input into the fully connected layer to obtain the model output result.

7. The abnormal root cause location method based on the attention mechanism according to any one of claims 3 to 6, characterized in that: The types of abnormalities include: excessive pressure on the main database, deadlock of the proxy server, abnormality of the database management service and abnormality of the Chitu management platform; The monitoring indicator is a database indicator related to the abnormal type.

8. A computing device, characterized in that include: An acquisition module is used to acquire a time series of a database monitoring curve and input the time series into an abnormal root cause location model based on an attention mechanism, wherein the abnormal root cause location model is obtained by training a temporal convolutional network (TCN) and a long short-term memory (LSTM) neural network; A processing module is used to perform feature extraction, attention weighting and anomaly analysis on the time series according to the anomaly root cause location model to obtain an anomaly analysis result; and determine whether an anomaly occurs in the database according to the anomaly analysis result, as well as the anomaly type and root cause location result when an anomaly occurs in the database.

9. A computing device, characterized in that include: A processor, and a memory communicatively connected to the processor; The memory is used to store computer-executable instructions; The processor is used to execute the computer-executable instructions stored in the memory, so that the processor executes the abnormal root cause location method based on the attention mechanism as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the abnormality root cause location method based on the attention mechanism as described in any one of claims 1 to 7.

Images