API (Application Program Interface) time sequence data anomaly detection method and device

Abstract

The invention relates to an API time series data anomaly detection method and device, and relates to the technical field of computers, and the method comprises the steps: obtaining time series data of a target API, and generating a time series data first prediction value of a first target time period through a machine learning model and the time series data; when the difference between the first actual value and the first predicted value corresponding to the same unit time meets a preset difference range, acquiring abnormal reason data corresponding to the first actual value; decomposing the specified abnormal reason sub-data in the first target time period by using a time sequence decomposition method, and calculating a second predicted value of the specified abnormal reason sub-data in a second target time period; and collecting a second actual value of the specified abnormal reason subdata in a second target time period, calculating a difference value between the second actual value and the second predicted value corresponding to the same unit time, and determining target abnormal reason data of the target API according to the difference value. According to the method, the data processing pressure about the model can be reduced, and the problem checking time is shortened.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a method and device for detecting anomalies in API time series data. Background Art

[0002] This section is intended to provide a background or context to the embodiments of the invention recited in the claims. No admission is made that the description herein is prior art by its inclusion in this section.

[0003] With the development of computer technology, in the field of cloud computing technology, the number of APIs opened by cloud service providers is increasing. For example, a cloud service provider has opened more than 14,500 OpenAPIs, with an average daily API call count of about 20 billion, involving more than 1.1 million users. Some head APIs have billions of daily calls, involving hundreds of thousands of users. For example, the average daily call volume of a certain OpenAPI reaches 2 billion, involving more than 3,000 users. Another OpenAPI of the cloud server has an average daily call count of about 20,000,000+, involving more than 400,000 users. Another OpenAPI has an average daily call count of about 40,000,000+, involving more than 30,000 users. Once one of the APIs fails, it will affect a large number of users. For similar large-scale industrial scenarios, there are many APIs and the causes of failures are complex. Each API may involve dozens of error codes. If machine learning or deep learning algorithm models are used to determine the error codes that cause API call failures, tens of thousands or even hundreds of thousands of models are required. This computational cost is very high, and the iteration and maintenance of the model is even more stressful. Summary of the invention

[0004] The API time series data anomaly detection method and device provided by the embodiments of the present invention can at least reduce the amount of data calculation for troubleshooting the causes of API time series data anomalies and shorten the time for anomaly troubleshooting.

[0005] According to one aspect of the present application, a method for detecting anomalies in API time series data is also provided, including: obtaining time series data of a target API, generating a first predicted value of time series data for a first target time period using a machine learning model and the time series data; collecting a first actual value of the time series data of the target API within the first target time period, and determining that an abnormality exists in the target API when the difference between the first actual value and the first predicted value corresponding to the same unit time satisfies a preset difference range, and obtaining abnormal cause data corresponding to the first actual value; wherein the abnormal cause data includes a plurality of abnormal cause sub-data; decomposing the specified abnormal cause sub-data within the first target time period using a time series decomposition method, and calculating a second predicted value of the specified abnormal cause sub-data within a second target time period based on the decomposition result; wherein the second target time period is after the first target time period; collecting a second actual value of the specified abnormal cause sub-data within the second target time period, calculating the difference between the second actual value and the second predicted value corresponding to the same unit time, and determining the target abnormal cause data of the target API from the plurality of the specified abnormal cause sub-data according to the difference.

[0006] According to another aspect of the present application, there is also provided an API time series data anomaly detection device, comprising: a prediction module, used to obtain the time series data of the target API, and generate a first predicted value of the time series data of the first target time period by using a machine learning model and the time series data; an API anomaly determination module, used to collect the first actual value of the time series data of the target API in the first target time period, and when the difference between the first actual value and the first predicted value corresponding to the same unit time satisfies a preset difference range, determine that the target API has an abnormality, and obtain abnormal cause data corresponding to the first actual value; wherein the abnormal cause data includes a plurality of abnormal cause sub-data; a decomposition module, used to decompose the specified abnormal cause sub-data in the first target time period by using a time series decomposition method, and calculate a second predicted value of the specified abnormal cause sub-data in a second target time period based on the decomposition result; wherein the second target time period is after the first target time period; an abnormal cause locating module, used to collect the second actual value of the specified abnormal cause sub-data in the second target time period, calculate the difference between the second actual value and the second predicted value corresponding to the same unit time, and determine the target abnormal cause data of the target API from the plurality of the specified abnormal cause sub-data according to the difference.

[0007] According to another aspect of the present application, an electronic device is provided, comprising: a processor; and a memory storing a program, wherein the program comprises instructions, and when the instructions are executed by the processor, the processor executes the above method.

[0008] According to another aspect of the present application, a non-transitory computer-readable storage medium storing computer instructions is also provided, wherein the computer instructions are used to enable the computer to execute the steps of the above method.

[0009] According to another aspect of the present application, a computer program product is also provided. The computer program product includes a computer program. When the computer program is executed by a processor, the above method steps are implemented.

[0010] Beneficial effects of the embodiments of the present invention:

[0011] In an embodiment of the present invention, time series data of a target API is acquired, and a first prediction value of the time series data for a first target time period is generated using a machine learning model and the time series data; a first actual value of the time series data of the target API within the first target time period is collected, and when the difference between the first actual value and the first prediction value corresponding to the same unit time satisfies a preset difference range, it is determined that the target API has an abnormality, and then the abnormality cause data corresponding to the first actual value is acquired; wherein the abnormality cause data includes a plurality of abnormality cause sub-data; the specified abnormality cause sub-data within the first target time period is decomposed using a time series decomposition method, and a second prediction value of the specified abnormality cause sub-data within a second target time period is calculated based on the decomposition result; wherein the second target time period is after the first target time period; a second actual value of the specified abnormality cause sub-data within the second target time period is collected, and the difference between the second actual value and the first prediction value corresponding to the same unit time is calculated, and according to the difference, the target abnormality cause data of the target API is determined in the specified abnormality cause sub-data. The embodiment of the present invention uses a machine learning model to predict and determine whether there is an anomaly in the time series data of the target API, thereby avoiding training and maintaining the machine learning model according to each abnormal cause, and reducing the data processing pressure on the model; after obtaining the abnormal cause data, the specified abnormal cause sub-data is decomposed based on the time series decomposition method, and a second prediction value is calculated based on the decomposition result, and then the difference value is calculated based on the second prediction value and the second actual value. According to the difference value, the target abnormal cause data of the target API can be located, thereby shortening the problem troubleshooting time.

[0012] The details of one or more embodiments of the invention are set forth in the following drawings and description so that other features, objects, and advantages of the invention are more readily apparent. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the prior art descriptions. Obviously, the drawings described below are only some embodiments of the present invention, and for ordinary technicians in this field, other embodiments can be obtained based on these drawings without creative work.

[0014] Figure 1 is a flow chart of an API time series data anomaly detection method according to an embodiment of the present invention;

[0015] Figure 2 It is a schematic diagram of the implementation architecture of the API time series data anomaly detection method according to an embodiment of the present invention;

[0016] Figure 3 is a schematic diagram of the STL time series decomposition result of an embodiment of the present invention;

[0017] Figure 4 is a schematic structural diagram of an electronic device of this embodiment;

[0018] Figure 5 is a schematic diagram of call success rate time series data of an embodiment of the present invention;

[0019] Figure 6 This is the first error code error trend chart of the embodiment of the present invention;

[0020] Figure 7 This is a second error code error trend chart of an embodiment of the present invention;

[0021] Figure 8 This is a third error code error trend chart of an embodiment of the present invention;

[0022] Fig. 9 This is a diagram of the LightGBM time series data prediction results of an embodiment of the present invention. DETAILED DESCRIPTION

[0023] Embodiments of the present embodiment will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present embodiment are shown in the accompanying drawings, it should be understood that the present embodiment can be implemented in various forms and should not be construed as being limited to the embodiments set forth herein, which are instead provided for a more thorough and complete understanding of the present embodiment. It should be understood that the drawings and embodiments of the present embodiment are only for exemplary purposes and are not intended to limit the scope of protection of the present embodiment.

[0024] In order to detect anomalies in time series data, the existing technology adopts a variety of solutions, which are introduced below.

[0025] First, the statistical method.

[0026] Anomalies are objects that do not fit the model better. For example, a data distribution model can be created by estimating the parameters of a probability distribution. If an object does not fit the model well, that is, if it is very likely not to obey the distribution, then it is an anomaly. If the model is a collection of clusters, then anomalies are objects that do not significantly belong to any cluster. When using a regression model, anomalies are objects that are relatively far from the predicted value. Since abnormal and normal objects can be considered two different classes, classification methods can be used to build models for these two classes.

[0027] The statistical method is also called the model-based method, which mainly judges the probability of the point by fitting a single model or multiple models. Common methods:

[0028] 3σ-rule: The probability of being within the interval (μ-3σ, μ+3σ) is 99.74. Therefore, it can be considered that when the data distribution interval exceeds this interval, it can be considered as abnormal data.

[0029] The box plot IQR (Interquartile Range, a statistic in the box plot) is the third quartile minus the first quartile. Numbers greater than Q3+1.5*IQR and values ​​less than Q1-1.5*IQR are considered outliers.

[0030] Grubbs test: The Grubbs test is a statistical method for detecting outliers (abnormal values) in data. It is based on the principle of hypothesis testing and determines whether there are outliers by calculating the difference between the outliers and the sample mean. The following are the steps of the Grubbs test: Determine the significance level: The significance level is usually selected as 0.05 or 0.01, indicating that at this level, we can accept a certain degree of false rejection. Calculate the sample mean and standard deviation: For a given data sample, calculate the sample mean and standard deviation. Calculate the Grubbs statistic: Calculate the difference between each data point and the sample mean, and divide it by the sample standard deviation to obtain the Grubbs statistic. The calculation formula for the Grubbs statistic is: Where X is the data point, is the sample mean, and S is the sample standard deviation. Calculate the critical value: Based on the sample size and significance level, look up the Grubbs critical value table or use the formula to calculate the critical value. The critical value represents the critical value of the Grubbs statistic at a given significance level. Determine outliers: Compare the calculated Grubbs statistic with the critical value. If the Grubbs statistic is greater than the critical value, reject the null hypothesis, that is, the data point is considered to be an outlier. Remove outliers (optional): If needed, you can choose to remove the data points determined to be outliers from the data set and then re-analyze.

[0031] Second, distance-based methods / proximity-based methods.

[0032] Often a proximity measure can be defined between objects, and many anomaly detection methods are based on proximity. Anomalous objects are those that are far away from most other objects. Many methods in this area are based on distance, called distance-based outlier detection methods. When the data can be displayed in a 2D or 3D scatter plot, distance-based outliers can be detected visually by looking for points that are separated from most other points.

[0033] Such methods include:

[0034] Angle-based outlier detection: The smaller the angle, the farther the distance.

[0035] k-nearest neighbor to k-nearest neighbor distance: The score is the sum of the distances between the data object and the nearest k points. Obviously, the smaller the sum of the distances to the k nearest points, the lower the anomaly score; the larger the sum of the distances to the k nearest points, the larger the anomaly score. Set a distance threshold. If the anomaly score is higher than this threshold, the corresponding data object is an anomaly.

[0036] Local Outlier Factor (LOF): The LOF score is the ratio of the average local density of the k nearest neighbors of a data object to the local density of the data object itself.

[0037] Connectivity Outlier Factor (COF): A point p is an outlier if its average connectivity distance is greater than the average connectivity distance of its k nearest neighbors. COF identifies outliers as points whose neighborhoods are sparser than the neighborhoods of their nearest neighbors.

[0038] Stochastic Outlier Selection Algorithm (SOS): Based on variance, the more neighbors there are, the smaller the variance is; the larger the neighbors are, the larger the variance is.

[0039] This type of method has high computational complexity and is prone to errors due to unevenly distributed points.

[0040] Third, clustering-based methods.

[0041] One approach to using clustering to detect outliers is to discard small clusters that are far away from other clusters. This approach can be used with any clustering method, but requires a minimum cluster size and a threshold for the distance between small clusters and other clusters. Often, the process can be simplified to discarding all clusters smaller than some minimum size. This scheme is highly sensitive to the choice of the number of clusters. In addition, using this scheme, it is difficult to attach outlier scores to objects. Note that considering a group of objects as outliers expands the concept of outliers from individual objects to groups of objects, but does not change the essence.

[0042] A more systematic approach is to first cluster all objects and then assess how well the objects belong to the cluster. For prototype-based clustering, the distance from the object to its cluster center can be used to measure how well the object belongs to the cluster. More generally, for clustering methods based on an objective function, the objective function can be used to assess how well an object belongs to any cluster. In the special case, if removing an object leads to a significant improvement in this objective, we can classify the object as an outlier.

[0043] Fourth, methods based on machine learning.

[0044] Machine learning-based methods can be divided into the following categories:

[0045] Algorithm based on Linear Regression Prediction (LR): Use LR to predict the data value of the next moment based on the past time series data. When the actual value deviates too much from the expected value, it is judged as an outlier. The core of this type of method is to extract the periodic characteristics of time series data as features. At this time, each sample in the training set is "time feature->target value", the dependency of the time series is eliminated, and there is no need to strictly rely on sliding windows to intercept training samples. It is common to express time with 0-1 dummy variables, with the following features: convert the week into a 0-1 variable, from Monday to Sunday, with a total of 7 variables in one-hot encoding; convert holidays into 0-1 variables, depending on the specific number of holidays, it can be simply divided into two categories, "holiday"-"no holiday", with a total of 2 variables in one-hot encoding; or assign different encoding values, such as distinguishing National Day, Spring Festival, Labor Day, etc., using 1, 2, and 3 to represent; convert the beginning of the month into a 0-1 variable, simply divided into two categories as "beginning of the month"-"not beginning of the month", with a total of 2 features; similar mid-month and beginning of the month can be converted into 0-1 variables.

[0046] Anomaly detection algorithm based on ARIMA (Autoregressive Integrated Moving Average, a classic time series analysis and prediction algorithm): The ARIMA model consists of two parts: autoregression (AR) and moving average (MA), combined with differential (Integrated) operations. The differential integrated moving average autoregression model, also known as the integrated moving average autoregression model (moving can also be called sliding), is one of the time series prediction and analysis methods. In ARIMA (p, d, q), AR is "autoregression", p is the number of autoregression terms; MA is "moving average", q is the number of moving average terms, and d is the number of differences (order) made to make it a stationary series.

[0047] Tree-based methods: IForest (Isolation Forest) is an Ensemble-based fast anomaly detection method with linear time complexity and high accuracy. It is the most advanced algorithm that meets the requirements of big data processing.

[0048] IForest is a non-parametric and unsupervised method, which means that it does not require a mathematical model or labeled training. IForest uses a very efficient strategy to find out which points are easy to be isolated. Suppose we use a random hyperplane to split the data space, and one cut can generate two subspaces (imagine using a knife to cut a cake in half). Then we continue to use a random hyperplane to cut each subspace, and loop until there is only one data point in each subspace. Intuitively speaking, we can find that clusters with high density can be cut many times before cutting, but those points with low density can easily stop in a subspace very early.

[0049] Fifth, methods based on deep learning.

[0050] Time series anomaly detection algorithms based on deep learning can be mainly divided into the following categories:

[0051] The generative algorithm is a training algorithm that models normal data and then identifies anomalies through high reconstruction errors. It is often unsupervised, such as the auto encoder class or echo state network.

[0052] Model the probability distribution of the data, and then identify outliers based on the correlation between sample points and extremely low probabilities, such as DAGMM (Deep Autoencoding Gaussian Mixture Model).

[0053] By labeling the data, we tell the model what normal data points look like and what abnormal data points look like, and then train the classification model through a supervised algorithm, also known as a discriminative algorithm.

[0054] The discriminant includes feature engineering of time series and various supervised algorithms, as well as end-to-end deep learning methods. End-to-end deep learning methods include common algorithms such as feedforward neural networks, convolutional neural networks, or other hybrid models.

[0055] Among the above solutions, the statistical method does not require model construction and training, has the strongest generalization, fast calculation speed, and good performance, but relatively low accuracy and high false alarm rate. The distance-based method has high calculation complexity and unevenly distributed points, which is prone to errors. The clustering-based method has a slow calculation speed and average effect. The machine learning-based method is relatively accurate and fast in calculation, but requires the construction of a training data set. The deep learning-based method is accurate, but slow in calculation speed and requires a large number of constructed data sets.

[0056] Time series data anomaly detection has become a common research focus in both industry and academia. At present, common types of time series data anomalies include point anomalies, context anomalies, and sequence anomalies. In order to address these challenges, a variety of anomaly detection methods have been proposed, such as direct detection methods for point anomalies, the core of which is to directly locate outliers and perform outlier detection. Indirect anomaly detection methods can be used for context anomalies and sequence anomalies, that is, these two types of problems are converted into point anomaly problems for solution. In addition, there are many time span detection methods based on prediction.

[0057] These methods have achieved certain results in many fields. However, they cannot be directly applied to large-scale industrial scenarios such as API monitoring. In the current scenario, there are many APIs and the causes of failures are complex (there are dozens or hundreds of corresponding error codes), which makes a single model ineffective.

[0058] See also Figure 5The call success rate time series data diagram shown in the figure shows that the API call success rate showed a downward trend from January 8, 2023 to January 10, 2023. The call success rate values ​​for these three days were 90.33%, 87.64%, and 85.06%, respectively. It can be observed that although the value has not changed much month-on-month, about 3% (in days), if it is further refined to the minute level, the change is even smaller, but overall an anomaly has occurred. In order to accurately and quickly capture this anomaly, a more accurate anomaly detection solution (for example, a machine learning-based algorithm or a deep learning-based algorithm) should be selected for the change in the API call success rate.

[0059] There are many reasons for the change in the success rate of an API call. For cloud service providers, each error cause is represented by an error code. Each API may correspond to dozens or hundreds of error codes. At this time, if you choose an algorithm based on machine learning or deep learning, the cost is very high. For example, the early training data construction, mid-term model training, and later model deployment and iteration. After analyzing the data, it can be found that the change of error codes is usually quite drastic (for example, mutation).

[0060] Figure 6-Figure 8 The error code and trend chart corresponding to a certain API are shown. Figure 6 The first error code (named InvalidAccessKeyId.NotFound) error trend chart is shown. The error code InvalidAccessKeyId.NotFound surged on January 9, and Figure 7 In the second error code (called Throttling) trend chart shown in the figure, the error code Throttling did not change much from 1.8 to 1.10. Figure 8 In the error trend chart of the third error code (named DryRunOperation), the error code DryRunOperation did not change much from January 8 to January 10. After manual review, it was found that the error code InvalidAccessKeyId.NotFound was indeed the core reason for the reduced success rate of API calls.

[0061] Although failures cannot be completely avoided, it is possible to ensure that when a failure occurs, it is quickly discovered, located, and repaired in order to minimize user losses. The call success rate of key APIs is counted in a period of minutes to form a time series. Based on this time series, anomaly detection and root cause location can be performed. Therefore, based on the above background, the present invention provides an API time series data anomaly detection method and device. The method combines the characteristics of the API anomaly detection service, first detects API-level anomalies based on a machine learning algorithm, and then uses a statistical learning method to locate the cause of the API anomaly after determining the API-level anomaly, thereby achieving higher accuracy while maintaining controllable efficiency.

[0062] The terms involved are explained below.

[0063] Time Series Data: Time Series Data is a series of indicator detection data that is continuously generated at a relatively stable frequency. For example, when detecting the health status of an API, a series of data is generated by collecting the success rate of API calls once a minute.

[0064] Anomaly detection: Anomaly detection is one of the most mature applications of time series data analysis. It is defined as the process of identifying abnormal events or behaviors from normal time series, such as the sharp rise and fall of the success rate of API calls in time series data.

[0065] GBDT: GBDT (Gradient Boosting Decision Tree) works well in data analysis and prediction. It is an ensemble algorithm based on decision trees. Gradient Boosting is an algorithm in the ensemble method Boosting, which iterates new learners through gradient descent. The CART decision tree is used in GBDT. Boosting refers to adding multiple weak learners to produce a new strong learner.

[0066] LightGBM: It is a distributed gradient boosting decision tree (GBDT) framework based on the decision tree algorithm, which was open sourced by the Distributed Machine Learning Toolkit team of Microsoft Research Asia.

[0067] STL (Seasonal and Trend decomposition using Loess) is a time series decomposition technology. The time series is generally divided into three parts: trend part, cycle part and residual part. STL is a robust and strong method for decomposing time series, among which Loess is a method for estimating nonlinear relationships.

[0068] In an embodiment of the present invention, a method for detecting anomalies in API time series data is provided. Figure 1 is a flowchart of a method for detecting anomalies in API time series data according to an embodiment of the present application. Figure 1 The method steps involved are described.

[0069] Step S101, obtain the time series data of the target API (Application Programming Interface), and use the machine learning model and the time series data to generate a first prediction value of the time series data for a first target time period.

[0070] In this step, the target API is a certain API that the user is concerned about, and the API can be used to implement the specified function. The method provided by the embodiment of the present invention can be executed for different types of APIs respectively. The time series data of the target API, the corresponding time period, time granularity and data content can be selected according to actual needs. Among them, the time granularity refers to the length of the unit time of the time series data, that is, the duration corresponding to each data content, and the time granularity can be seconds, minutes, hours, days, weeks, months and years. The data content can be obtained by calculating the data generated after the API is run. For example, the time series data of the target API can be the number of calls to the target API every day in March, where the time period is March, the time granularity is every day, and the data content is the number of calls to the target API.

[0071] The machine learning model can automatically discover patterns and regularities in the data by learning and analyzing a large amount of data, and can be used for tasks such as prediction, classification, clustering, and recommendation. In the embodiment of the present invention, the machine learning model is a trained model that can be used for prediction (i.e., a function or pattern is learned based on the existing data to predict future results). The specific machine learning model used can be selected according to actual needs.

[0072] The first target time period is after the time period corresponding to the time series data of the target API. The first target time period is the time period where the first predicted value is to be generated, and the first target time period can be specified according to actual needs. Select part of the data in the time series data of the target API as the input of the machine learning model. Each output of the machine learning model can obtain the data content corresponding to one or more time granularities in the first target time period. The machine learning model performs one or more predictions to obtain the data content corresponding to each time granularity in the first target time period, that is, to obtain the first predicted value of the time series data.

[0073] In the above steps, a machine learning model is used to generate a first prediction value of the time series data within a first target time period in the future, so as to determine whether there is an abnormality in the API time series data.

[0074] Step S102: collect the first actual value of the time series data of the target API within the first target time period. When the difference between the first actual value and the first predicted value corresponding to the same unit time satisfies a preset difference range, determine that the target API is abnormal, and obtain the abnormal cause data corresponding to the first actual value; wherein the abnormal cause data includes multiple abnormal cause sub-data.

[0075] In this step, the first actual value of the time series data of the target API within the first target time period is collected, including collecting the data content actually generated by the target API corresponding to each unit time within the first target time period, and taking all the actually generated data content corresponding to all unit times within the first target time period as the first actual value of the time series data.

[0076] The difference between the first actual value and the first predicted value corresponding to the same unit time satisfies the preset difference range, that is, a group of corresponding first actual values ​​and first predicted values ​​are determined through the same unit time, and the difference between the two is compared. The preset difference range can be determined according to actual needs, and the embodiment of the present invention does not make specific limitations on this. For example, if the preset difference range is that the first actual value is greater than the first predicted value, then if the first predicted value is 95% and the first actual value is 98%, it is determined that there is an abnormality in the time series data of the target API.

[0077] After determining that an abnormality exists in the target API, obtain the abnormality cause data corresponding to the first actual value, wherein the abnormality cause data is data collected in real time and is API operation data related to the first actual value. The abnormality cause data includes a variety of abnormality cause sub-data. The abnormality cause data is time series data, and each type of abnormality cause sub-data is also time series data. The abnormality cause data may include a variety of possible data that cause the target API's time series data to be abnormal. Each abnormality cause sub-data can be used to describe a reason that may cause the target API's time series data to be abnormal.

[0078] In this step, when the difference between the first actual value and the first predicted value is large, it is determined that the time series data of the target API is abnormal. The machine learning model is used to predict whether the API time series data is abnormal. Compared with using the machine learning model to predict the cause of the abnormality, the training and maintenance pressure of the model is greatly reduced, and the amount of data to be processed is greatly reduced.

[0079] Step S103, decomposing the specified abnormal cause sub-data within the first target time period using a time series decomposition method, and calculating a second prediction value of the specified abnormal cause sub-data within a second target time period based on the decomposition result; wherein the second target time period is after the first target time period.

[0080] In this step, the time series decomposition method is a method of decomposing the time series data into three parts: trend, cycle and residual. Commonly used time series decomposition methods include: classical decomposition, X-11 decomposition, STL decomposition, EMD decomposition (Empirical Mode Decomposition), Wavelet decomposition, etc., and a suitable time series decomposition method can be selected according to actual needs, and the embodiment of the present invention does not specifically limit this.

[0081] The specified abnormal cause sub-data may be all abnormal cause sub-data, or some types of abnormal cause sub-data determined from all abnormal cause sub-data according to actual needs. Time series decomposition is performed for each abnormal cause sub-data within the first target time period to obtain a decomposition result. The second target time period is after the first target time period. The second target time period is the time period in which the second predicted value is to be generated, and the second target time period may be specified according to actual needs. The second target time period is determined within the time after the first target time period, and the second predicted value of the specified abnormal cause sub-data within the second target time period is calculated based on the decomposition result, that is, the data of the three parts of trend, cycle and residual are calculated separately to obtain the components of the second predicted value, and then the obtained components are merged to obtain the second predicted value of the specified abnormal cause sub-data within the second target time period.

[0082] In the above steps, based on the specified abnormal cause sub-data obtained based on the machine learning model, the time series decomposition method is used for data processing to improve the accuracy of data processing. The accuracy of data processing refers to the precision or accuracy in the data processing process. It indicates the degree of closeness or error between the data processing result and the true value.

[0083] Step S104, collect the second actual value of the specified abnormal cause sub-data within the second target time period, calculate the difference between the second actual value and the second predicted value corresponding to the same unit time, and determine the target abnormal cause data of the target API from the multiple specified abnormal cause sub-data based on the difference.

[0084] In this step, the second actual value of the specified exception cause sub-data is the data actually generated during the operation of the target API that is related to the specified exception cause sub-data. The same unit time refers to the same time granularity, for example, the same minute, or the same second, etc. To calculate the difference between the second actual value and the second predicted value corresponding to the same unit time, the difference between the second actual value and the second predicted value can be calculated, and the absolute value of the difference is used as the difference value. It should be noted that the difference value can also be obtained by calculating the second actual value and the second predicted value according to other methods, which can be determined according to actual needs.

[0085] A difference value is calculated for each specified abnormal cause sub-data, and the specified abnormal cause sub-data corresponding to the difference value with a larger value or a smaller value is selected according to the requirements as the target abnormal cause data of the target API. The target abnormal cause data is used to describe the main reason causing the abnormality of the target API.

[0086] In the above steps, the difference between the second actual value and the second predicted value is described by the difference value, which can more clearly show the abnormality of the second actual value; the target abnormality cause data of the target API is determined based on the difference value, and the amount of calculated data is small and the accuracy is high.

[0087] In an embodiment of the present invention, time series data of a target API is acquired, and a first prediction value of the time series data for a first target time period is generated using a machine learning model and the time series data; a first actual value of the time series data of the target API within the first target time period is collected, and when the difference between the first actual value and the first prediction value corresponding to the same unit time satisfies a preset difference range, it is determined that the target API has an abnormality, and then the abnormality cause data corresponding to the first actual value is acquired; wherein the abnormality cause data includes a plurality of abnormality cause sub-data; the specified abnormality cause sub-data within the first target time period is decomposed using a time series decomposition method, and a second prediction value of the specified abnormality cause sub-data within a second target time period is calculated based on the decomposition result; wherein the second target time period is after the first target time period; a second actual value of the specified abnormality cause sub-data within the second target time period is collected, and the difference between the second actual value and the first prediction value corresponding to the same unit time is calculated, and according to the difference, the abnormality cause data of the target API is determined in the specified abnormality cause sub-data. The embodiment of the present invention uses a machine learning model to predict and determine whether there is an anomaly in the time series data of the target API, thereby avoiding training and maintaining the machine learning model according to each abnormal cause, and reducing the data processing pressure on the model; after obtaining the abnormal cause data, the specified abnormal cause sub-data is decomposed based on the time series decomposition method, and a second prediction value is calculated based on the decomposition result, and then the difference value is calculated based on the second prediction value and the second actual value. According to the difference value, the target abnormal cause data of the target API can be located, thereby shortening the problem troubleshooting time.

[0088] In a possible implementation, the time series decomposition method is an STL algorithm; using the time series decomposition method to decompose the specified abnormal cause sub-data within the first target time period can be performed according to the following steps: counting the number of occurrences of each abnormal cause sub-data in the abnormal cause data, and taking the abnormal cause sub-data with a number of occurrences greater than a preset number threshold as the specified abnormal cause sub-data; decomposing the specified abnormal cause sub-data into trend data, periodic data and residual data.

[0089] In this possible implementation, the abnormal cause data corresponding to the first actual value includes a variety of abnormal cause sub-data. If each abnormal cause sub-data is subjected to time series decomposition processing, the amount of calculation is large. Since not every abnormal cause sub-data is the root cause of the abnormality in the time series data of the target API, and the root cause of the abnormality in the time series data of the target API usually occurs more frequently, therefore, the number of occurrences of each abnormal cause sub-data in the abnormal cause data is counted, and the abnormal cause sub-data with a number of occurrences greater than a preset number threshold is used as the designated abnormal cause sub-data, so that only the designated abnormal cause sub-data is decomposed, that is, the designated abnormal cause sub-data is decomposed into trend data, periodic data and residual data, which can greatly reduce the amount of calculation. It should be noted here that the abnormal cause sub-data is time series data.

[0090] It should be noted that, in this step, the preset number threshold can be determined according to actual needs and experience, and the embodiment of the present invention does not specifically limit this.

[0091] See also Figure 3 The schematic diagram of the STL time series decomposition results is shown in Figure 1, where the original data ( Figure 3 Original in the figure) indicates a certain specified abnormal cause sub-data, the horizontal axis indicates time, and the vertical axis indicates the number of occurrences. After decomposing the original data, trend data ( Figure 3 Trend), cycle data ( Figure 3 Seasonarity) and residual data ( Figure 3 Residual in the

[0092] In the above steps, statistical analysis is performed on the basis of the abnormal cause data to obtain the specified abnormal cause sub-data, and the specified abnormal cause sub-data is decomposed instead of all abnormal cause sub-data, which can reduce the amount of calculation; in addition, based on the abnormal cause data predicted by machine learning, the root cause is located based on the STL method, which can improve the accuracy of the analysis results and reduce the false alarm rate. The STL method can better handle nonlinear trend and multi-periodic time series data. Processing data based on STL can improve the accuracy and interpretability of predictions.

[0093] In a possible implementation, the second predicted value of the specified abnormal cause sub-data within the second target time period is calculated based on the decomposition result, which can be performed according to the following steps: performing weighted moving average calculation on the trend data to obtain a predicted trend value; based on the periodic information of the second target time period, determining a historical time point within the first target time period, and calculating the average value of the periodic data corresponding to the historical time point to obtain a predicted periodic value; sorting the residual data, determining the residual interval according to the sorting result, and determining the predicted residual value in the residual interval; summing the predicted trend value, the predicted periodic value and the predicted residual value to obtain the second predicted value of the specified abnormal cause sub-data.

[0094] In this possible implementation, after obtaining the trend data, a trend value is predicted based on the trend data using a weighted moving average method. Weighted moving average is a method for smoothing a time series, which gives different weights to data at different time points to reflect the importance of different time points. Weighted moving average can reduce noise and fluctuations in the time series. The weighted moving average calculation of the time series can be implemented in the following steps: Determine the weighting coefficient: First, the weighting coefficient needs to be determined, that is, different weights are given to data at different time points. The weighting coefficient can be determined according to actual conditions. For example, the weighting coefficient includes but is not limited to linear weighting, exponential weighting, etc. Calculate the weighted moving average: According to the determined weighting coefficient, the time series is weighted moving average calculated. The calculation method is to multiply the data at each time point by the corresponding weighting coefficient, and then add all the results to obtain the weighted moving average. Update the weighting coefficient: According to the actual situation, you can choose to update the weighting coefficient. If the data in the time series changes greatly, the weighting coefficient can be re-determined based on the latest data to better reflect the latest trend.

[0095] Based on the cycle information of the second target time period, determine the historical time point in the first target time period, where the historical time point is a time point related to the cycle information. For example, the second target time period corresponds to a certain week, and Monday can be used as a cycle information. If you want to predict the data on Monday of that week, you can use the historical data of the same day in the first target time period, such as Monday last week, or Monday last month, as the historical time point. Calculate the average value of the cycle data corresponding to the historical time point to obtain the predicted cycle value. For example, use the data of the same day in history (the same day last week, or the same day last month) to calculate the average value and obtain a cycle value.

[0096] Trend data is usually easier to predict, and periodic data is easy to derive from historical data, while residual data is usually random and difficult to predict. Therefore, when predicting residual data, the existing residual data is sorted, and the residual interval is determined according to the sorting result, and the predicted residual value is determined in the residual interval. In specific implementation, quartiles are selected from the residual values, that is, the residual data sorted at 1 / 4 to 3 / 4 in the sorting result are used as the upper and lower limits of the residual to obtain the residual interval. In this residual interval, the predicted residual value can be determined in a specified manner or randomly. In this way, it can be ensured that the obtained predicted residual value can represent most of the ordinary residual values ​​and reduce the situation of abnormal predicted residual values. Finally, the predicted trend value, the predicted period value and the predicted residual value are summed to obtain the second predicted value of the specified abnormal cause sub-data.

[0097] In the above steps, a residual value interval is selected, and a predicted residual value is determined within the residual interval. The obtained predicted residual value can better represent the residual value in most cases, thereby making the second predicted value more accurate.

[0098] In a possible implementation, determining the exception cause data of the target API from among the multiple specified exception cause sub-data based on the difference value can be performed according to the following steps: averaging multiple difference values ​​corresponding to each specified exception cause sub-data to obtain an average difference value; sorting the multiple specified exception cause sub-data based on the average difference value; and determining the target exception cause data of the target API from among the multiple specified exception cause sub-data based on the sorting result.

[0099] In this possible implementation, the specified abnormal cause sub-data is time series data, in which there may be multiple points where the second predicted value and the second actual value differ greatly. Therefore, each specified abnormal cause sub-data corresponds to multiple difference values, and the multiple difference values ​​corresponding to each specified abnormal cause sub-data are averaged to obtain an average difference value, that is, each specified abnormal cause sub-data corresponds to an average difference value. According to the average difference value, the multiple specified abnormal cause sub-data are sorted, and the target abnormal cause data of the target API is determined from the multiple specified abnormal cause sub-data according to the sorting result. For example, one or more specified abnormal cause sub-data that are ranked first or last can be used as the target abnormal cause data of the target API.

[0100] In this possible implementation, the corresponding average difference value is calculated for each designated abnormal cause sub-data, and the average difference value is used to describe the abnormal degree of the actual value of each designated abnormal cause sub-data relative to the predicted value. Compared with the solution that describes the abnormal degree in the form of a ratio and the abnormal degree value needs to be in the range of 0 to 1, the numerical change amount of the embodiment of the present invention is more obvious and the accuracy is higher. In addition, when calculating the average difference value corresponding to a certain designated abnormal cause sub-data, the embodiment of the present invention only needs to pay attention to the information involved in the designated abnormal cause sub-data, and does not need to calculate the information involved in other types of designated abnormal cause sub-data, so the amount of calculation is greatly reduced.

[0101] In a possible implementation, the timing data is call success rate data, and obtaining the abnormal cause data corresponding to the first actual value can be performed according to the following steps: obtaining multiple error codes corresponding to the first actual value; using the multiple error codes as abnormal cause data; wherein each error code is used as an abnormal cause sub-data.

[0102] In this possible implementation, the time series data may be call success rate data. The API time series data anomaly detection method can be used to detect whether there is an anomaly in the time series data consisting of the call success rate, that is, it can determine whether there is a sudden increase or decrease in the call success rate. When the time series data is the call success rate data, the first actual value is the call success rate data actually collected within the first target time period, and the first predicted value is the predicted call success rate data within the first target time period. If the difference between the two is relatively large, it is determined that the target API is abnormal. Obtain multiple error codes corresponding to the first actual value; use the multiple error codes as abnormal cause data; wherein each of the error codes is used as an abnormal cause sub-data.

[0103] Subsequently, the specified error code is determined from the multiple error codes, that is, the specified abnormal cause sub-data is obtained. For each specified error code, the time series is decomposed, the predicted value (that is, the second predicted value of the specified abnormal cause sub-data) is generated, the actual value (that is, the second actual value of the specified abnormal cause sub-data) is collected, and then the specific error code (that is, the target abnormal cause data) that causes the abnormality of the target API is located through the difference value.

[0104] In this possible implementation, the time series data can be call success rate data. Each error code is analyzed to obtain the error code that causes the abnormal call success rate. Then, based on the statistical learning method of STL, the API-related error codes are monitored for abnormalities. The machine learning algorithm is combined with the STL algorithm. The service characteristics of API call success rate anomaly detection and the advantages and disadvantages of various anomaly detection methods are fully considered to achieve accurate anomaly detection of API call success rate and root cause location at the error code level.

[0105] It should be noted that, in addition to the call success rate data, the time series data may also be other time series data, which can be selected according to actual needs, and the embodiment of the present invention does not make specific limitations on this.

[0106] In a possible implementation, the machine learning model is a LightGBM model. Before using the machine learning model and the time series data to generate a first prediction value of the time series data in the first target time period, the following steps may also be performed:

[0107] Based on the first target time period, determine the historical time period within the time period corresponding to the time series data, and extract the delay feature data, period feature data and calendar feature data from the time series data of the target API according to the historical time period; generate sample data according to the delay feature data, the period feature data and the calendar feature data, use the sample data to train the initial model to obtain the model to be adjusted; calculate the contribution values ​​of the delay feature data, the period feature data and the calendar feature data, adjust the model to be adjusted according to the contribution values, and obtain the LightGBM model.

[0108] In this possible implementation, delay feature data is extracted, that is, historical information feature extraction. The extraction of delay features needs to consider two main factors. The first is locality, that is, the closer the data is to the prediction target time, the greater the impact. For example, when predicting t_(k+1), the impact of the historical sequence value t_k to t_1 becomes smaller and smaller. The second is periodicity. Most time series in actual tasks are affected by human activities and basically take a week (seven days) as a cycle. Based on this, historical values ​​in the same period as the prediction time point can be aggregated and features can be extracted.

[0109] Specifically, short-term historical data or long-term historical data can be extracted. For example, the extraction of short-term historical data can use the historical value of the previous day, the average of the historical values ​​of the previous two days, or the average of the historical values ​​of the previous three days as local features. For long-term historical data extraction, for example, the data of the past two weeks, the data of the past month, the data of the past two months, etc. can be aggregated.

[0110] In this possible implementation, to extract periodic feature data, historical data of the same period as the target prediction value can be obtained first. When the period is a week, if the data for Monday is predicted, the historical values ​​of Monday in the previous weeks should be extracted as periodic features. Of course, it is best to use the method of adding and averaging to improve stability. For example, the sum of the periodic values ​​of the previous week is averaged, the sum of the periodic values ​​of the previous two weeks is averaged, or the sum of the periodic values ​​of the previous three weeks is averaged.

[0111] In this possible implementation, the calendar information itself is an expression of periodicity, but contains more date characteristics, such as periodic changes in months, and some special events, such as the Spring Festival, National Day, API changes, etc. Extracting calendar feature data can help the LightGBM model learn more about date characteristics.

[0112] After extracting the delay feature data, the period feature data and the calendar feature data, these feature data are used to generate sample data, and the sample data is used to train the initial model to obtain the model to be adjusted. It should be noted that feature extraction is the process of converting raw data into feature representations that can be understood and processed by the machine learning algorithm. It involves selecting and extracting more representative and discriminative features from the raw data. Features can be numerical, categorical or other types of data. The goal of feature extraction is to reduce the dimension of the data, remove redundant information, and highlight the important features of the data. Constructing a training set is the process of combining the extracted features with the corresponding labels (or target variables) into training sample data. The training set is a data set used by the machine learning algorithm to learn the model. It consists of input features and corresponding output labels. The goal of constructing a training set is to enable the machine learning algorithm to learn the relationship between features and labels from the data, so as to establish a model that can make accurate predictions.

[0113] It should also be noted that in time series problems, the construction of training data is generally constructed using a sliding window method. For a time series, Hf-l+1 samples can be constructed, where H is the length of the time series, f is the minimum historical information of each sample, and l is the prediction step size (i.e. predict_distance).

[0114] The parameter combination can be adjusted in a grid search manner to select the final parameter combination. When using LightGBM for grid search to adjust the parameter combination, the following steps can be included: Define parameter space: First, you need to define the parameter space to be adjusted. These parameters can include the depth of the tree, the learning rate, the number of leaf nodes, etc. You can select the parameters that need to be adjusted according to the actual situation. Create parameter combinations: Create different parameter combinations based on the defined parameter space. You can use tool functions such as itertools.product to generate all possible parameter combinations. Divide the training set and validation set: Divide the data set into a training set and a validation set to evaluate the performance of different parameter combinations. You can use methods such as cross-validation or holdout to divide. Define evaluation indicators: Define evaluation indicators based on specific tasks and requirements. For example, for classification problems, you can use indicators such as accuracy, precision, and recall. Loop through parameter combinations: For each parameter combination, perform the following steps: a. Initialize the model: Initialize the LightGBM model with the current parameter combination. b. Train the model: Use the training set to train the model. c. Verify the model: Use the verification set to evaluate the model performance and calculate the evaluation indicators. d. Record results: record the performance indicators of the current parameter combination. Select the optimal parameter combination: based on the recorded results, select the parameter combination with the best performance as the final model parameter. It should be noted that grid search is an exhaustive search method that traverses all possible parameter combinations, so the amount of calculation is large. In order to reduce the calculation time, you can use parallel computing or distributed computing to speed up the grid search process.

[0115] Taking into account that in the process of training the initial model and obtaining the model to be adjusted, the contribution of the delay feature data, the period feature data and the calendar feature data may not meet the user's needs, or a better combination cannot be achieved, therefore, the contribution values ​​of the delay feature data, the period feature data and the calendar feature data are calculated, and the model to be adjusted is adjusted according to the contribution values ​​to obtain the LightGBM model.

[0116] The overall contribution of each feature in the GBDT model can be described by feature importance. Common methods for calculating feature importance are:

[0117] 1. Calculate the number of times the feature is used in the segmentation conditions.

[0118] 2. Calculate the sum of gains of all splits using this feature.

[0119] Both can be obtained in LightGBM by directly calling the model's feature_importance method.

[0120] In the LightGBM algorithm, the feature_importances attribute can be used to obtain the number of times a feature is used in the splitting condition. This attribute is an array whose length is equal to the number of features, and each element represents the number of times the corresponding feature is used in the splitting condition (or each element represents the sum of the splitting gains of the corresponding feature).

[0121] The specific steps are as follows: 1. After training the LightGBM model, you can get the importance of the features through model.feature_importances. 2. model.feature_importances returns an array whose length is equal to the number of features.

[0122] 3. Each element in the array represents the number of times the corresponding feature is used in the segmentation condition (or each element in the array represents the sum of the segmentation gains of the corresponding feature). The larger the value, the higher the importance of the feature in the segmentation condition.

[0123] It should be noted that in the LightGBM algorithm, splitting refers to the operation of splitting a node into two or more child nodes in the process of building a decision tree. Splitting is a key step in the decision tree algorithm. By selecting appropriate splitting points and splitting conditions, the data set can be divided into purer subsets, thereby improving the prediction ability of the model.

[0124] In this possible implementation, the performance and effect of LightGBM are better than other machine learning models, and it is a preferred model; combining the delay feature data, period feature data and calendar feature data training model can improve the prediction accuracy of the trained LightGBM model. Based on this model, the success rate of API-level calls can be accurately detected.

[0125] The implementation of this method is described below with a specific embodiment. In the specific implementation, the API time series data anomaly detection method provided by the embodiment of the present invention is divided into two levels:

[0126] First, the API-level anomaly detection solution based on LightGBM is a machine learning-based anomaly detection solution that is responsible for detecting the call success rate at the API level and issuing an alarm when an anomaly is detected.

[0127] Second, the STL-based anomaly detection and root cause location solution is an anomaly detection solution based on statistical learning. It is responsible for anomaly detection of API-related error codes. When an error code anomaly is found, the absolute value of the change in the number of error codes in two time periods is used to represent the degree of anomaly, and the absolute value is sorted by the degree of anomaly. Then the top error code is exposed as the root cause.

[0128] See also Figure 2 The schematic diagram of the implementation architecture of the API time series data anomaly detection method shown in the figure. In the specific implementation, the method can construct a sample set based on the feature extraction results such as delay features, period features, and calendar features, and participate in model training based on the sample set. After the model training is completed, the trained model is adjusted based on the feature importance to obtain the final LightGBM model. The model is used to generate the predicted value of the API call success rate in the fence time period, for example, see Fig. 9 In the LightGBM time series data prediction result diagram shown, the dotted curve displayed after the dotted vertical line is the predicted value, and the solid curve is the actual value of the call success rate of the implementation collection. By comparing these two parts of data, the model can be used to detect whether there are abnormalities in the API call success rate data. In the case of abnormalities, the number of various error codes obtained by statistics is selected according to the statistical results to perform STL statistical learning on multiple error codes.

[0129] Each error code for STL statistical learning has a corresponding time series. The time series of each error code is decomposed, and three component prediction values ​​are generated based on each decomposition result. After parameter fusion of the three values, the prediction value is obtained, and then the abnormality degree is calculated based on the prediction value and the actual value collected in real time. When the actual value is greater than the prediction value, an alarm is issued. Finally, a comprehensive sorting is performed based on the calculation results, and the comprehensive root cause location is achieved based on the sorting results.

[0130] This method combines service characteristics and algorithm characteristics to provide an optimal method for detecting the success rate of API calls. Pure machine learning or deep learning methods have high accuracy, but high computational complexity and cost. In the face of a large number of error codes, the input-output ratio is seriously insufficient. Pure statistical learning methods are powerless in the face of the high-precision requirements of API-level call success rate detection methods.

[0131] This method combines the actual data characteristics of the API call success rate, and by integrating the statistical learning-based method with the machine learning-based method, it strikes a good balance between effect and efficiency. Specifically, machine learning algorithms are used for anomaly detection at the level of API call success rate to achieve higher accuracy on the basis of controllable efficiency. In the error code dimension, the STL algorithm is used to quickly locate the root cause of the error (for example, determine the specific error code). In a test environment, this solution can shorten the troubleshooting time to within 5 seconds, and the accuracy rate of abnormal alarms is 90%+.

[0132] The present invention provides an API time series data anomaly detection method and device. In the face of tens of thousands of OpenAPI scenarios, the present invention is a hybrid time series data anomaly detection solution that integrates statistical methods and machine learning methods. By reasonably splitting the API time series data anomaly detection scenario, using a GDBT-based anomaly detection algorithm to perform anomaly detection on the API-level time series data, and using a statistical-based algorithm to perform anomaly detection on all error codes associated with the API, at this time, error code anomaly detection is also a root cause analysis method, which helps to discover the root cause of the error more quickly. The solution achieves a balance between efficiency, effect, performance and cost.

[0133] Based on the above-mentioned API time series data anomaly detection method provided by an embodiment of the present invention, an embodiment of the present invention further provides an API time series data anomaly detection device, comprising: a prediction module, used to obtain time series data of a target API, and generate a first predicted value of time series data of a first target time period by using a machine learning model and the time series data; an API anomaly determination module, used to collect a first actual value of the time series data of the target API in the first target time period, and when the difference between the first actual value and the first predicted value corresponding to the same unit time satisfies a preset difference range, determine that the target API is abnormal, and obtain abnormal cause data corresponding to the first actual value; wherein the abnormal cause data includes a plurality of abnormal cause sub-data; a decomposition module, used to decompose the specified abnormal cause sub-data in the first target time period by using a time series decomposition method, and calculate a second predicted value of the specified abnormal cause sub-data in a second target time period based on the decomposition result; wherein the second target time period is after the first target time period; an abnormal cause locating module, used to collect a second actual value of the specified abnormal cause sub-data in the second target time period, calculate the difference between the second actual value and the second predicted value corresponding to the same unit time, and determine the target abnormal cause data of the target API from the plurality of the specified abnormal cause sub-data according to the difference.

[0134] In an embodiment of the present invention, time series data of a target API is acquired, and a first prediction value of the time series data for a first target time period is generated using a machine learning model and the time series data; a first actual value of the time series data of the target API within the first target time period is collected, and when the difference between the first actual value and the first prediction value corresponding to the same unit time satisfies a preset difference range, it is determined that the target API has an abnormality, and then the abnormality cause data corresponding to the first actual value is acquired; wherein the abnormality cause data includes a plurality of abnormality cause sub-data; the specified abnormality cause sub-data within the first target time period is decomposed using a time series decomposition method, and a second prediction value of the specified abnormality cause sub-data within a second target time period is calculated based on the decomposition result; wherein the second target time period is after the first target time period; a second actual value of the specified abnormality cause sub-data within the second target time period is collected, and the difference between the second actual value and the first prediction value corresponding to the same unit time is calculated, and according to the difference, the abnormality cause data of the target API is determined in the specified abnormality cause sub-data. The embodiment of the present invention uses a machine learning model to predict and determine whether there is an anomaly in the time series data of the target API, thereby avoiding training and maintaining the machine learning model according to each abnormal cause, and reducing the data processing pressure on the model; after obtaining the abnormal cause data, the specified abnormal cause sub-data is decomposed based on the time series decomposition method, and a second prediction value is calculated based on the decomposition result, and then the difference value is calculated based on the second prediction value and the second actual value. According to the difference value, the target abnormal cause data of the target API can be located, thereby shortening the problem troubleshooting time.

[0135] In a possible implementation, the time series decomposition method is an STL algorithm; the decomposition module is specifically used to: count the number of occurrences of each abnormal cause sub-data in the abnormal cause data, and use the abnormal cause sub-data with a number of occurrences greater than a preset threshold as designated abnormal cause sub-data; decompose the designated abnormal cause sub-data into trend data, periodic data and residual data.

[0136] In one possible implementation, the decomposition module is specifically used to: perform weighted moving average calculation on the trend data to obtain a predicted trend value; based on the periodic information of the second target time period, determine a historical time point within the first target time period, and calculate an average value for the periodic data corresponding to the historical time point to obtain a predicted periodic value; sort the residual data, determine a residual interval based on the sorting result, and determine a predicted residual value in the residual interval; and sum the predicted trend value, the predicted periodic value, and the predicted residual value to obtain a second predicted value of the specified abnormal cause sub-data.

[0137] In a possible implementation, the abnormal cause location module is specifically used to: average multiple difference values ​​corresponding to each specified abnormal cause sub-data to obtain an average difference value; sort the multiple specified abnormal cause sub-data according to the average difference value; and determine the target abnormal cause data of the target API from the multiple specified abnormal cause sub-data according to the sorting result.

[0138] In a possible implementation, the timing data is call success rate data, and the API exception determination module is specifically used to: obtain multiple error codes corresponding to the first actual value; use the multiple error codes as exception cause data; wherein each error code is used as an exception cause sub-data.

[0139] In one possible implementation, the machine learning model is a LightGBM model, and the device also includes a data processing module, which is used to: determine a historical time period within the time period corresponding to the time series data based on the first target time period, and extract delay feature data, period feature data, and calendar feature data from the time series data of the target API according to the historical time period; generate sample data according to the delay feature data, the period feature data, and the calendar feature data, and use the sample data to train an initial model to obtain a model to be adjusted; calculate contribution values ​​of the delay feature data, the period feature data, and the calendar feature data, and adjust the model to be adjusted according to the contribution values ​​to obtain the LightGBM model.

[0140] An embodiment of the present invention further provides an electronic device, comprising: at least one processor; and a memory in communication with the at least one processor. The memory stores a computer program executable by the at least one processor, and when the computer program is executed by the at least one processor, the electronic device executes the method of the embodiment of the present invention.

[0141] An embodiment of the present invention further provides a non-transitory machine-readable medium storing a computer program, wherein the computer program, when executed by a processor of a computer, is used to cause the computer to execute the method of the embodiment of the present invention.

[0142] An embodiment of the present invention further provides a computer program product, including a computer program, wherein the computer program, when executed by a processor of a computer, is used to enable the computer to execute the method of the embodiment of the present invention.

[0143] refer to Figure 4, a block diagram of an electronic device that can be used as a server or client of an embodiment of the present invention will now be described, which is an example of a hardware device that can be applied to various aspects of the present invention. Electronic devices are intended to represent various forms of digital electronic computer devices, such as laptop computers, desktop computers, workbenches, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. Electronic devices can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0144] like Figure 4 As shown, the electronic device includes a computing unit 401, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 402 or a computer program loaded from a storage unit 408 into a random access memory (RAM) 403. In RAM 403, various programs and data required for the operation of the electronic device can also be stored. The computing unit 401, ROM 402, and RAM 403 are connected to each other via a bus 404. An input / output (I / O) interface 405 is also connected to the bus 404.

[0145] Multiple components in the electronic device are connected to the I / O interface 405, including: an input unit 406, an output unit 407, a storage unit 408, and a communication unit 409. The input unit 406 can be any type of device that can input information to the electronic device, and the input unit 406 can receive input digital or character information, and generate key signal input related to user settings and / or function control of the electronic device. The output unit 407 can be any type of device that can present information, and can include but is not limited to a display, a speaker, a video / audio output terminal, a vibrator, and / or a printer. The storage unit 408 can include but is not limited to a disk, an optical disk. The communication unit 409 allows the electronic device to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks, and can include but is not limited to a modem, a network card, an infrared communication device, a wireless communication transceiver, and / or a chipset, such as a Bluetooth device, a WiFi device, a WiMax device, a cellular communication device, and / or the like.

[0146] The computing unit 401 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the computing unit 401 include, but are not limited to, a CPU, a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The computing unit 401 performs the various methods and processes described above. For example, in some embodiments, the method embodiments of the present invention may be implemented as a computer program, which is tangibly contained in a machine-readable medium, such as a storage unit 408. In some embodiments, part or all of the computer program may be stored in a ROM.

[0147] 402 and / or the communication unit 409 are loaded and / or installed on the electronic device. In some embodiments, the computing unit 401 can be configured to execute the above method in any other appropriate manner (for example, by means of firmware).

[0148] The computer programs for implementing the methods of the embodiments of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer programs are executed by the processor or controller, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer programs may be executed entirely on the machine, partially on the machine, partially on the machine as a stand-alone software package and partially on a remote machine, or entirely on a remote machine or server.

[0149] In the context of an embodiment of the present invention, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable signal medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0150] It should be noted that the term "including" and its variations used in the embodiments of the present invention are open inclusions, that is, "including but not limited to". The term "based on" means "based at least in part on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one other embodiment"; the term "some embodiments" means "at least some embodiments". The modifications of "one" and "multiple" mentioned in the embodiments of the present invention are illustrative rather than restrictive. Those skilled in the art should understand that unless the context clearly indicates otherwise, it should be understood as "one or more".

[0151] The user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in the embodiments of the present invention are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards of relevant countries and regions, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0152] The various steps described in the method implementation methods provided in the embodiments of the present invention may be performed in different orders and / or in parallel. In addition, the method implementation methods may include additional steps and / or omit the steps shown. The scope of protection of the present invention is not limited in this respect.

[0153] The term "embodiment" in this specification refers to specific features, structures or characteristics described in conjunction with the embodiment that can be included in at least one embodiment of the present invention. The appearance of this phrase in various places in the specification does not necessarily mean the same embodiment, nor does it mean that it is mutually exclusive with other embodiments and is independent or optional. The various embodiments in this specification are described in a related manner, and the same or similar parts between the various embodiments refer to each other. In particular, for the device, equipment, and system embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts refer to the partial description of the method embodiment.

[0154] The above-mentioned embodiments only express several implementation methods of the present invention, and the description thereof is relatively specific and detailed, but it cannot be understood as limiting the scope of patent protection. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present invention, and these all belong to the scope of protection of the present invention. Therefore, the scope of protection of the present invention shall be subject to the attached claims.

Claims

1. A method for detecting anomalies in API time series data, comprising: Obtain time series data of a target API, and generate a first prediction value of the time series data for a first target time period using a machine learning model and the time series data; Collecting a first actual value of the time series data of the target API within the first target time period, determining that the target API is abnormal when the difference between the first actual value and the first predicted value corresponding to the same unit time satisfies a preset difference range, and obtaining abnormal cause data corresponding to the first actual value; wherein the abnormal cause data includes a plurality of abnormal cause sub-data; Decomposing the specified abnormal cause sub-data in the first target time period by using a time series decomposition method, and calculating a second prediction value of the specified abnormal cause sub-data in a second target time period based on the decomposition result; wherein the second target time period is after the first target time period; Collect the second actual value of the specified abnormal cause sub-data within the second target time period, calculate the difference between the second actual value and the second predicted value corresponding to the same unit time, and determine the target abnormal cause data of the target API from the multiple specified abnormal cause sub-data based on the difference.

2. The method according to claim 1, wherein: The time series decomposition method is an STL algorithm; using the time series decomposition method to decompose the specified abnormal cause sub-data within the first target time period includes: Counting the number of occurrences of each abnormal cause sub-data in the abnormal cause data, and taking the abnormal cause sub-data whose number of occurrences is greater than a preset number threshold as the designated abnormal cause sub-data; The designated abnormal cause sub-data are decomposed into trend data, period data and residual data.

3. The method according to claim 2, wherein: Calculating a second predicted value of the specified abnormal cause sub-data within a second target time period based on the decomposition result includes: Performing weighted moving average calculation on the trend data to obtain a predicted trend value; Based on the cycle information of the second target time period, determine a historical time point within the first target time period, calculate an average value for the cycle data corresponding to the historical time point, and obtain a predicted cycle value; Sorting the residual data, determining a residual interval according to the sorting result, and determining a predicted residual value in the residual interval; The predicted trend value, the predicted period value and the predicted residual value are summed to obtain a second predicted value of the specified abnormal cause sub-data.

4. The method according to claim 1, wherein: Determining the abnormality cause data of the target API from the plurality of the specified abnormality cause sub-data according to the difference value, including: averaging multiple difference values ​​corresponding to each specified abnormal cause sub-data to obtain an average difference value; sorting the plurality of designated abnormal cause sub-data according to the average difference value; According to the sorting result, the target exception cause data of the target API is determined from the multiple specified exception cause sub-data.

5. The method according to any one of claims 1 to 4, wherein: The time series data is call success rate data, and obtaining abnormal cause data corresponding to the first actual value includes: Obtaining multiple error codes corresponding to the first actual value; The plurality of error codes are used as abnormal cause data; wherein each error code is used as an abnormal cause sub-data.

6. The method according to any one of claims 1 to 4, wherein: The machine learning model is a LightGBM model. Before using the machine learning model and the time series data to generate a first prediction value of the time series data in the first target time period, the method further includes: Based on the first target time period, determine a historical time period within the time period corresponding to the time series data, and extract delay feature data, cycle feature data, and calendar feature data from the time series data of the target API according to the historical time period; Generate sample data according to the delay feature data, the period feature data and the calendar feature data, and use the sample data to train an initial model to obtain a model to be adjusted; The contribution values ​​of the delay characteristic data, the period characteristic data and the calendar characteristic data are calculated, and the model to be adjusted is adjusted according to the contribution values ​​to obtain the LightGBM model.

7. An API time series data anomaly detection device, comprising: A prediction module, used to obtain time series data of a target API, and generate a first prediction value of the time series data in a first target time period by using a machine learning model and the time series data; An API abnormality determination module is used to collect a first actual value of the time series data of the target API within the first target time period, and when the difference between the first actual value and the first predicted value corresponding to the same unit time satisfies a preset difference range, determine that the target API is abnormal, and obtain abnormality cause data corresponding to the first actual value; wherein the abnormality cause data includes a plurality of abnormality cause sub-data; a decomposition module, configured to decompose the specified abnormal cause sub-data within the first target time period by using a time series decomposition method, and calculate a second prediction value of the specified abnormal cause sub-data within a second target time period based on the decomposition result; wherein the second target time period is after the first target time period; The abnormal cause location module is used to collect the second actual value of the specified abnormal cause sub-data within the second target time period, calculate the difference between the second actual value and the second predicted value corresponding to the same unit time, and determine the target abnormal cause data of the target API from the multiple specified abnormal cause sub-data based on the difference value.

8. An electronic device, comprising: A processor, and a memory storing a program, wherein the program comprises instructions which, when executed by the processor, cause the processor to perform the method according to any one of claims 1 to 6.

9. A non-transitory machine-readable medium storing computer instructions, wherein: The computer instructions are used to cause the computer to execute the method according to any one of claims 1-6.

10. A computer program product, wherein: The computer program product comprises a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

Images