Database anomaly detection method and device and computer equipment
By weighting the state detection model of the database running data, the database abnormality is automatically detected, which solves the problem of inefficient traditional manual inspections and improves the efficiency and accuracy of abnormality detection.
Patent Information
- Application Number
- CN202411651536.X
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-11-19
- Publication Date
- 2025-03-07
AI Technical Summary
Traditional database maintenance methods rely on manual inspections, are inefficient and cannot meet the rapidly growing database needs.
By obtaining each running data of the database, input it into the pre-trained state detection model, obtaining the state coefficient, and obtaining the target state coefficient through weighting processing to determine the abnormal running data in the database.
Automatic database abnormality detection is realized, which improves the efficiency and accuracy of abnormality detection and reduces the subjectivity of human detection.
Smart Images
Figure CN119576622A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of big data technology, and in particular to a method, apparatus, computer equipment, storage medium and computer program product for detecting anomalies in a database. Background Art
[0002] With the rapid development of information technology, the amount of data is increasing, the number and types of databases are also increasing, and database maintenance is becoming more and more important. Traditional database maintenance methods usually rely on operation and maintenance personnel to troubleshoot database data based on their own experience and simple scripts. However, this manual troubleshooting method is inefficient. As the scale of databases expands, traditional manual troubleshooting methods can no longer meet the rapidly growing database needs. Summary of the invention
[0003] Based on this, it is necessary to provide a database anomaly detection method, device, computer equipment, computer readable storage medium and computer program product to address the above technical problems.
[0004] In a first aspect, the present application provides a method for detecting anomalies in a database. The method comprises:
[0005] Acquire various operation data of the database; wherein the operation data is used to characterize the performance of the database;
[0006] Input each of the operating data into a pre-trained state detection model to obtain a state coefficient of each of the operating data; wherein the state detection model includes a plurality of state prediction sub-models; each of the state prediction sub-models is used to predict the state coefficient of the operating data; weighted processing is performed on the state coefficient predicted by each state prediction sub-model to obtain a target state coefficient of the operating data;
[0007] According to the state coefficient of each of the operating data, abnormal operating data in the database is determined.
[0008] In one embodiment, the weighted processing of the state coefficients predicted by each state prediction sub-model to obtain the target state coefficient of the operation data includes:
[0009] Obtain the prediction accuracy of each state prediction sub-model;
[0010] Determining the weight of each state prediction sub-model according to the accuracy of the prediction of the state prediction sub-model;
[0011] The state coefficients predicted by each state prediction sub-model are weighted by using the weights of each state prediction sub-model to obtain the target state coefficient of the operation data.
[0012] In one embodiment, after determining abnormal operation data in the database according to the state coefficient of each operation data, the method further comprises:
[0013] According to the abnormal operation data, abnormal cause information of the operation data is obtained by matching from a preset abnormal database; wherein the abnormal database includes a set of abnormal causes of the operation data.
[0014] In one embodiment, the step of obtaining the abnormal cause information of the operating data from a preset abnormal database according to the abnormal operating data includes:
[0015] According to the abnormal operation data type, a set of abnormal reasons for the data type is obtained by matching from a preset database;
[0016] According to the abnormal operation data, the abnormal cause information of the operation data is obtained by matching from the abnormal cause set.
[0017] In one embodiment, the abnormal data set includes solution information corresponding to the abnormal cause; after determining the abnormal operation data in the database according to the state coefficient of each operation data, the method further includes:
[0018] According to the abnormal cause information of the operation data, target solution information of the abnormal operation data is obtained by matching from the abnormal database.
[0019] In one embodiment, the abnormal cause corresponds to a plurality of solution information; and obtaining target solution information of abnormal operation data from the abnormal database according to the abnormal cause information of the operation data includes:
[0020] According to the abnormal cause information of the operation data, a solution information set of the abnormal operation data is matched from the database;
[0021] The target solution information is selected from the solution information set.
[0022] In a second aspect, the present application also provides a database anomaly detection device. The device comprises:
[0023] A data acquisition module, used to acquire various operation data of the database; wherein the operation data is used to characterize the performance of the database;
[0024] A coefficient determination module is used to input each of the operating data into a pre-trained state detection model to obtain a state coefficient of each of the operating data; wherein the state detection model includes a plurality of state prediction sub-models; each of the state prediction sub-models is used to predict the state coefficient of the operating data; and weighted processing is performed on the state coefficients predicted by each state prediction sub-model to obtain a target state coefficient of the operating data;
[0025] The abnormality determination module is used to determine abnormal operation data in the database according to the state coefficient of each operation data.
[0026] In one embodiment, the coefficient determination module includes:
[0027] The accuracy determination submodule is used to obtain the accuracy of the prediction of each state prediction submodel;
[0028] A weight determination submodule, used to determine the weight of each state prediction submodel according to the prediction accuracy of the state prediction submodel;
[0029] The coefficient determination submodule is used to use the weights of each state prediction submodel to perform weighted processing on the state coefficients predicted by each state prediction submodel to obtain the target state coefficient of the operating data.
[0030] In one embodiment, the device further comprises:
[0031] The cause determination module is used to match the abnormal cause information of the operating data from a preset abnormal database according to the abnormal operating data; wherein the abnormal database includes a set of abnormal causes of the operating data.
[0032] In one of the embodiments, the cause determination module includes:
[0033] A cause set determination submodule, used to match and obtain an abnormal cause set of the data type from a preset database according to the abnormal operation data type;
[0034] The abnormality cause determination submodule is used to match the abnormality cause information of the operating data from the abnormality cause set according to the abnormal operating data.
[0035] In one embodiment, the device further comprises:
[0036] The solution determination module is used to match and obtain target solution information of the abnormal operation data from the abnormal database according to the abnormal cause information of the operation data.
[0037] In one embodiment, the solution determination module includes:
[0038] A method set determination submodule, used for matching and obtaining a solution information set of abnormal operation data from the database according to the abnormal cause information of the operation data;
[0039] The solution determination submodule is used to select target solution information from the solution information set.
[0040] In a third aspect, the present application further provides a computer device, wherein the computer device comprises a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the method for detecting anomalies in a database as described in any one of the embodiments of the present disclosure is implemented.
[0041] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the method for detecting anomalies in a database as described in any one of the embodiments of the present disclosure is implemented.
[0042] In a fifth aspect, the present application further provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, the method for detecting anomalies in a database as described in any one of the embodiments of the present disclosure is implemented.
[0043] The above-mentioned database anomaly detection method, device, computer equipment, storage medium and computer program product use multiple state detection sub-models to detect each operation data of the database, obtain the state coefficient of each operation data, and determine whether each operation data is abnormal based on the state coefficient. The above-mentioned detection method can automatically detect anomalies in the database, greatly improving the efficiency of anomaly detection; at the same time, it reduces the subjectivity of manual detection and improves the accuracy and transparency of anomaly detection. BRIEF DESCRIPTION OF THE DRAWINGS
[0044] Figure 1 A schematic diagram of a process flow of a method for detecting anomalies in a database in one embodiment;
[0045] Figure 2 A schematic diagram of a process for collecting database indicator data in one embodiment;
[0046] Figure 3 A schematic diagram of a process for determining a target state coefficient in one embodiment;
[0047] Figure 4 A schematic diagram of a process for obtaining abnormal causes of abnormal data in one embodiment;
[0048] Figure 5 A schematic diagram of a process for obtaining a target solution corresponding to an abnormality cause in an embodiment;
[0049] Figure 6 A schematic diagram of a module flow for implementing an abnormality detection solution for a database in one embodiment;
[0050] Figure 7 It is a flowchart of the internal implementation process of database anomaly detection in one embodiment;
[0051] Figure 8 is a structural block diagram of a database anomaly detection device in one embodiment;
[0052] Fig. 9 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION
[0053] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.
[0054] In one embodiment, Figure 1 As shown, a method for detecting anomalies in a database is provided. This embodiment uses the method applied to a terminal as an example for illustration. It is understandable that the method can also be applied to a server, and can also be applied to a system including a terminal and a server, and is implemented through the interaction between the terminal and the server. In this embodiment, the method includes the following steps:
[0055] Step S100, obtaining various operation data of the database; wherein the operation data is used to characterize the performance of the database.
[0056] In an exemplary embodiment, the operation data of the database may include various performance indicators of the database; for example, load conditions, resource usage, hot spot information, TOPSQL, cache hit rate, lock wait, etc.
[0057] In an exemplary embodiment, the operating data of the database may include different data from multiple databases; and the same information from different databases may be stored in the same file; for example, the load conditions and resource utilization rates of multiple databases may be collected, and the load conditions of each database may be stored in one file, and the resource utilization rates of each database may be stored in another file, etc.
[0058] Step S200, input each of the operating data into a pre-trained and constructed state detection model to obtain a state coefficient of each of the operating data; wherein the state detection model includes a plurality of state prediction sub-models; each of the state prediction sub-models is used to predict the state coefficient of the operating data; weighted processing is performed on the state coefficient predicted by each state prediction sub-model to obtain a target state coefficient of the operating data.
[0059] In an exemplary embodiment, the state coefficient may include a parameter for describing whether the indicator data is abnormal; specifically, the state coefficient may be described as an abnormal coefficient. For example, if the state coefficient is greater than a preset abnormal range, the indicator data corresponding to the state coefficient is considered to be abnormal.
[0060] In an exemplary embodiment, all different indicator data of the database can be input into the state detection model to predict the state coefficients of the indicator data of the database. In another exemplary embodiment, the state prediction model can include sub-models for predicting data of different data types; for example, the state detection model can include a load condition state prediction sub-model, a resource usage rate state prediction sub-model, etc.; one of the sub-models is only used to predict the state coefficient of one indicator data type, so as to improve the accuracy of the state coefficient.
[0061] In an exemplary embodiment, the multiple state detection sub-models may be multiple decision tree regression models; the weighted processing of the state coefficients of each state prediction sub-model may include selecting a decision tree regression model with the highest accuracy from multiple decision tree regression models as the first state prediction sub-model, and using the other decision tree regression models as a whole as a random forest regression model as the second state prediction sub-model; specifically, the state coefficients of each decision tree in the random forest regression model may be weighted; and then the state coefficients of the random forest regression model and the first state prediction sub-model may be weighted. For example, four decision tree regression models are used, namely A, B, C, and D; among them, A is the first state prediction sub-model, and B, C, and D constitute the second state prediction sub-model. Assuming that the weights of each decision tree regression model in the random forest are the same, and the weights of the first state prediction sub-model and the second state prediction sub-model are also the same, the prediction results of A, B, C, and D are {1, 2, 1, 3} respectively. At this time, the first state coefficient predicted by the first state prediction sub-model is 1; the second state coefficient predicted by the second state prediction sub-model is (2+1+3) / 3=2; the first state coefficient and the second state coefficient are weighted to obtain the final state coefficient (2+1) / 2=1.5, etc.
[0062] In an exemplary embodiment, the state coefficient may be used to describe the degree of abnormality. For example, operating data with a state coefficient of 1.5 is slightly abnormal, and operating data with a state coefficient of 2 is abnormal.
[0063] In an exemplary embodiment, the state coefficient may also include determining that the indicator data is abnormal when a model predicts that there is an abnormality; specifically, when the indicator data is predicted to be abnormal, the state coefficient may be determined to be 1, and when the indicator data is normal, the state coefficient may be 0. When weighted processing is performed, when the state coefficient predicted by a model is not 0, the weighted state coefficient is not 0, and the indicator data is determined to be abnormal. Specifically, it may also include determining that the indicator data is abnormal when there is an abnormality in one of the first state prediction sub-model and the second state prediction sub-model as described in the previous embodiment.
[0064] Step S300: determining abnormal operating data in a database according to the state coefficient of each operating data.
[0065] In an exemplary embodiment, determining the abnormal operation data in the database according to the state coefficient of each operation data may include determining that the corresponding operation data is abnormal operation data when the state coefficient is greater than a preset state coefficient threshold.
[0066] In an exemplary embodiment, the operation data of the database can be collected through the Flume system, which is built with JRuby and has the characteristics of high reliability, high scalability, easy management, and support for user expansion. It can be understood that the structure of Flume is mainly divided into three parts: source, channel, and sink. Among them, source is the source, responsible for collecting logs; channel is the channel, responsible for transportation and temporary storage; sink is the destination, which saves the collected logs. The specific collection process can be as follows Figure 2 As shown in the figure, during the data collection process, the source of Flume is customized to collect various indicators of the database, and then the collected indicator data is sinked to the TXSQL database. The TXSQL database stores the indicator data collected from various databases and is the data storage center of the entire database intelligent diagnosis system.
[0067] In the above database anomaly detection method, multiple state detection sub-models are used to detect each operation data of the database, obtain the state coefficient of each operation data, and determine whether each operation data is abnormal based on the state coefficient. The above detection method can automatically detect anomalies in the database, greatly improving the efficiency of anomaly detection; at the same time, it reduces the subjectivity of manual detection and improves the accuracy and transparency of anomaly detection.
[0068] In one embodiment, Figure 3 As shown, the state coefficients predicted by each state prediction sub-model are weighted to obtain the target state coefficients of the operating data, including:
[0069] Step S201, obtaining the prediction accuracy of each state prediction sub-model.
[0070] In an exemplary embodiment, the accuracy of each state prediction sub-model can be determined during training. In another exemplary embodiment, when each state prediction sub-model is used for training, when the state coefficient predicted by the state prediction sub-model is inconsistent with the final state coefficient, the accuracy of the state prediction sub-model with inconsistent predicted state coefficient is changed.
[0071] Step S202: determining the weight of each state prediction sub-model according to the prediction accuracy of the state prediction sub-model.
[0072] Step S203, using the weight of each state prediction sub-model, weighted processing is performed on the state coefficients predicted by each state prediction sub-model to obtain the target state coefficient of the operating data.
[0073] In an exemplary embodiment, the training method of the state prediction sub-model may include obtaining sample indicator data from a sample database, and manually labeling the sample indicator data to indicate whether each operation state data is normal. Specifically, the labeling process may be as shown in formula (1):
[0074] (1)
[0075] Among them, v ij represents the jth indicator data of the i-th database; S ij Represents the labeling result of the corresponding indicator data; after manual labeling, the data matrix of formula (2) can be obtained:
[0076] (2)
[0077] Where, vij represents the jth indicator data of the i-th database; S ij It represents the labeling result of the corresponding indicator data; the corresponding data matrix is used as training data to train the state prediction sub-model to obtain the state prediction sub-model.
[0078] In this embodiment, the accuracy of the state prediction sub-model is used to obtain the weight of the state prediction sub-model, and the state coefficient predicted by each state prediction sub-model is weighted according to the weight to obtain the target state coefficient. The accuracy is used as the weight to weight the state coefficient, which improves the accuracy of the state coefficient and the accuracy of database anomaly detection.
[0079] In one embodiment, after determining abnormal operation data in the database according to the state coefficient of each operation data, the method further includes:
[0080] According to the abnormal operation data, abnormal cause information of the operation data is obtained by matching from a preset abnormal database; wherein the abnormal database includes a set of abnormal causes of the operation data.
[0081] In an exemplary embodiment, the abnormality database may include a set of abnormal reasons that may exist in various operation data; for example, too many connections, too high resource usage, too high TPS (transactions per second) or QPS (queries per second), etc.
[0082] In an exemplary embodiment, the abnormal data set may include a knowledge graph composed of an expert knowledge base, and relevant problem causes are searched in the knowledge graph.
[0083] In this embodiment, the abnormal cause of abnormal operation data is determined through the abnormal database, so that the abnormal cause of abnormal data can be automatically confirmed, the abnormal cause of the database can be quickly located, and the accuracy of database detection is improved.
[0084] In one embodiment, Figure 4 As shown, the abnormal cause information of the operating data is obtained by matching from a preset abnormal database according to the abnormal operating data, including:
[0085] Step S401, according to the abnormal operation data type, obtain the abnormal cause set of the data type from a preset database.
[0086] In an exemplary embodiment, the set of abnormal reasons for the corresponding data types in the preset database may be different abnormal reasons corresponding to each indicator data, specifically, may include abnormal reasons for the number of connections, abnormal reasons for TPS, etc. For example, TPS: {TPS suddenly drops: database requests decrease due to application failure; TPS steadily increases: the system is processing more requests, or the ability to process query requests; TPS exceeds expectations; the system exceeds its design capacity}, etc.
[0087] Step S402: According to the abnormal operation data, obtain the abnormal cause information of the operation data from the abnormal cause set by matching.
[0088] In an exemplary embodiment, the matching to obtain the abnormal reason information of the operation data may include matching the operation data with the abnormal reason set. For example, if the TPS suddenly drops, it can be directly obtained that the database request decreases due to an application failure. In another exemplary embodiment, there may be multiple reasons for an abnormal operation data, which can be displayed at the same time for the administrator to choose. For example, if the TPS rises steadily, the reason may be that the system is processing more requests or there is an internal bottleneck; at this time, the administrator needs to confirm whether there is an internal bottleneck.
[0089] In this embodiment, the abnormal cause set of the data type is determined by the abnormal operation data type, and the abnormal cause of the operation data is determined. The abnormal cause set is stored hierarchically, which reduces the matching times of the abnormal cause and improves the matching efficiency of the abnormal cause.
[0090] In one embodiment, the abnormal data set includes solution information corresponding to the abnormal cause; after determining the abnormal operation data in the database according to the state coefficient of each operation data, the method further includes:
[0091] According to the abnormal cause information of the operation data, target solution information of the abnormal operation data is obtained by matching from the abnormal database.
[0092] In an exemplary embodiment, each abnormal reason in the abnormal data set may have a corresponding solution. For example, if the number of connections is too many, the maximum number of connections may be adjusted.
[0093] In this embodiment, by matching the abnormal data set to obtain the solution corresponding to the abnormal cause, it is possible to automatically generate the solution, quickly solve the problems existing in the database, and improve the efficiency of solving database abnormalities.
[0094] In one embodiment, Figure 5 As shown, the abnormal cause corresponds to a plurality of solution information; the target solution information of the abnormal operation data is matched from the abnormal database according to the abnormal cause information of the operation data, including:
[0095] Step S501: According to the abnormal cause information of the operation data, a solution information set of the abnormal operation data is matched from the database.
[0096] Step S502: Select target solution information from the solution information set.
[0097] In an exemplary embodiment, one abnormal cause may correspond to multiple solutions. For example, too many connections can be solved by optimizing query statements, increasing hardware resources, adjusting database configuration parameters, and other solutions.
[0098] In an exemplary embodiment, after obtaining a solution information set, the solutions can be automatically used in sequence. After the solution is implemented, if the operation data is not abnormal, the solution is determined to be the target solution; in the case of abnormal operation data, the solution can be withdrawn and the next solution can be tried. For example, if the number of connections is too large, the database configuration parameters are adjusted. If the operation data returns to normal, the target solution is to adjust the data configuration parameters; if the operation data is still abnormal, the adjustment of the database configuration parameters is withdrawn, hardware resources are increased, and it is continued to determine whether the operation data returns to normal until the operation data returns to normal.
[0099] In this embodiment, multiple solutions corresponding to the abnormal causes are matched through the abnormal data set, and a target solution is obtained from the multiple solutions, thereby increasing the method for solving data anomalies and improving the accuracy of solving data anomalies.
[0100] In an exemplary embodiment, Figure 6 As shown, the anomaly detection of the database can be implemented in multiple modules, including:
[0101] A data collection module is used to collect indicator data of the controlled database;
[0102] The data analysis module is used to analyze whether the collected indicator data is abnormal; specifically, the matrix shown in the following formula (3) can be obtained:
[0103] (3)
[0104] Among them, the first column is the indicator data, and the second column is the prediction result;
[0105] Problem diagnosis module, used to determine the abnormal causes of abnormal indicator data;
[0106] The solution generation module is used to find corresponding solutions to the abnormal causes of abnormal indicator data.
[0107] In an exemplary embodiment, the database anomaly detection detects different indicator data. Here, the number of database connections is taken as an example. Figure 7 As shown, the connection lines represent the connection between the nodes, including "occurrence", "related", "root cause" or "solution", etc., including:
[0108] Compare the number of connections with the maximum number of possible connections;
[0109] Determine that there are too many database connections;
[0110] The reason for the abnormality is that the maximum number of connections is too small, as the number of connections is too large.
[0111] It was further determined that the maximum number of connections was set too small;
[0112] Since the maximum number of connections is set too small, modify the maximum number of connections.
[0113] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.
[0114] Based on the same inventive concept, the embodiment of the present application also provides a database anomaly detection device for implementing the database anomaly detection method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in the embodiments of the one or more database anomaly detection devices provided below can refer to the limitations of the database anomaly detection method above, and will not be repeated here.
[0115] In one embodiment, Figure 8 As shown, a database anomaly detection device 100 is provided, comprising: a data acquisition module 101, a coefficient determination module 102 and an anomaly determination module 103, wherein:
[0116] A data acquisition module, used to acquire various operation data of the database; wherein the operation data is used to characterize the performance of the database;
[0117] A coefficient determination module is used to input each of the operating data into a pre-trained state detection model to obtain a state coefficient of each of the operating data; wherein the state detection model includes a plurality of state prediction sub-models; each of the state prediction sub-models is used to predict the state coefficient of the operating data; and weighted processing is performed on the state coefficients predicted by each state prediction sub-model to obtain a target state coefficient of the operating data;
[0118] The abnormality determination module is used to determine abnormal operation data in the database according to the state coefficient of each operation data.
[0119] In one embodiment, the coefficient determination module includes:
[0120] The accuracy determination submodule is used to obtain the accuracy of the prediction of each state prediction submodel;
[0121] A weight determination submodule, used to determine the weight of each state prediction submodel according to the prediction accuracy of the state prediction submodel;
[0122] The coefficient determination submodule is used to use the weights of each state prediction submodel to perform weighted processing on the state coefficients predicted by each state prediction submodel to obtain the target state coefficient of the operating data.
[0123] In one embodiment, the device further comprises:
[0124] The cause determination module is used to match the abnormal cause information of the operating data from a preset abnormal database according to the abnormal operating data; wherein the abnormal database includes a set of abnormal causes of the operating data.
[0125] In one embodiment, the cause determination module includes:
[0126] A cause set determination submodule, used to match and obtain an abnormal cause set of the data type from a preset database according to the abnormal operation data type;
[0127] The abnormality cause determination submodule is used to match the abnormality cause information of the operating data from the abnormality cause set according to the abnormal operating data.
[0128] In one embodiment, the device further comprises:
[0129] The solution determination module is used to match and obtain target solution information of the abnormal operation data from the abnormal database according to the abnormal cause information of the operation data.
[0130] In one embodiment, the solution determination module includes:
[0131] A method set determination submodule, used for matching and obtaining a solution information set of abnormal operation data from the database according to the abnormal cause information of the operation data;
[0132] The solution determination submodule is used to select target solution information from the solution information set.
[0133] Each module in the above-mentioned database anomaly detection device can be implemented in whole or in part by software, hardware, or a combination thereof. Each of the above-mentioned modules can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to each of the above modules.
[0134] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Fig. 9 As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. Among them, the processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store indicator data of the database. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a method for detecting anomalies in a database is implemented.
[0135] Those skilled in the art will understand that Fig. 9 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.
[0136] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards of relevant countries and regions.
[0137] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.
[0138] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.
[0139] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.
Claims
1. A database anomaly detection method, characterized in that: The method comprises: Acquire various operation data of the database; wherein the operation data is used to characterize the performance of the database; Input each of the operating data into a pre-trained state detection model to obtain a state coefficient of each of the operating data; wherein the state detection model includes a plurality of state prediction sub-models; each of the state prediction sub-models is used to predict the state coefficient of the operating data; weighted processing is performed on the state coefficient predicted by each state prediction sub-model to obtain a target state coefficient of the operating data; According to the state coefficient of each of the operating data, abnormal operating data in the database is determined.
2. The method according to claim 1, characterized in that The state coefficients predicted by each state prediction sub-model are weighted to obtain the target state coefficients of the operation data, including: Obtain the prediction accuracy of each state prediction sub-model; Determining the weight of each state prediction sub-model according to the accuracy of the prediction of the state prediction sub-model; The state coefficients predicted by each state prediction sub-model are weighted by using the weights of each state prediction sub-model to obtain the target state coefficient of the operation data.
3. The method according to claim 1, characterized in that After determining abnormal operation data in the database according to the state coefficient of each operation data, the method further includes: According to the abnormal operation data, abnormal cause information of the operation data is obtained by matching from a preset abnormal database; wherein the abnormal database includes a set of abnormal causes of the operation data.
4. The method according to claim 3, characterized in that The step of obtaining abnormal cause information of the operating data from a preset abnormal database according to the abnormal operating data includes: According to the abnormal operation data type, a set of abnormal reasons for the data type is obtained by matching from a preset database; According to the abnormal operation data, the abnormal cause information of the operation data is obtained by matching from the abnormal cause set.
5. The method according to claim 3, characterized in that: The abnormality database includes solution information corresponding to the abnormality cause; after determining the abnormal operation data in the database according to the state coefficient of each operation data, it also includes: According to the abnormal cause information of the operation data, target solution information of the abnormal operation data is obtained by matching from the abnormal database.
6. The method according to claim 5, characterized in that The abnormal cause corresponds to a plurality of solution information; the target solution information of the abnormal operation data is matched from the abnormal database according to the abnormal cause information of the operation data, including: According to the abnormal cause information of the operation data, a solution information set of the abnormal operation data is matched from the database; The target solution information is selected from the solution information set.
7. A database anomaly detection device, characterized in that: The device comprises: A data acquisition module, used to acquire various operation data of the database; wherein the operation data is used to characterize the performance of the database; A coefficient determination module is used to input each of the operating data into a pre-trained state detection model to obtain a state coefficient of each of the operating data; wherein the state detection model includes a plurality of state prediction sub-models; each of the state prediction sub-models is used to predict the state coefficient of the operating data; and weighted processing is performed on the state coefficients predicted by each state prediction sub-model to obtain a target state coefficient of the operating data; The abnormality determination module is used to determine abnormal operation data in the database according to the state coefficient of each operation data.
8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.
9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.
10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.