Alarm method and device in distributed system, equipment, medium and program product

Abstract

The embodiment of the invention provides an alarm method and device in a distributed system, equipment, a medium and a program product. The method is applied to any computing node in a distributed system, and comprises the following steps: performing short-term trend analysis on acquired monitoring data to obtain a first prediction result; performing long-term trend analysis on the monitoring data to obtain a second prediction result; and based on the first prediction result and the second prediction result, monitoring indexes corresponding to the monitoring data are adjusted, and the monitoring indexes comprise one or more of an alarm threshold, a monitoring frequency and an alarm priority. The method is used for achieving the effect of improving the sensitivity and reliability of alarm detection.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to an alarm method, device, equipment, medium and program product in a distributed system. Background Art

[0002] Bank transaction systems need to run around the clock to ensure that they can handle 24-hour uninterrupted transaction requests, including deposits, withdrawals, transfers, payments, etc., to ensure the accuracy and real-time nature of transactions and to ensure the security and privacy of customer data.

[0003] The transaction data of banking transaction systems usually show high volatility. With the changes in market activities, the diversity of customer behavior and the expansion of banking business, the amount, type and frequency of transaction data are constantly changing. System log data is also volatile. With the busyness of banking business, system upgrades and maintenance activities, the speed and amount of system log generation will also change.

[0004] With the in-depth development of omni-channel financial services, bank transaction systems generate terabytes of transaction and log data every day. Alarm signals are often hidden in a large amount of data and difficult to find directly. Traditional alarm methods often cannot provide sufficient sensitivity and accuracy in the face of complex financial business environments. Summary of the invention

[0005] The embodiments of the present application provide an alarm method, apparatus, device, medium and program product in a distributed system to achieve the effect of improving the sensitivity and reliability of alarm detection.

[0006] In a first aspect, an embodiment of the present application provides an alarm method in a distributed system, which is applied to any computing node in the distributed system, and the method includes:

[0007] Perform short-term trend analysis on the acquired monitoring data to obtain a first prediction result;

[0008] Performing long-term trend analysis on the monitoring data to obtain a second prediction result;

[0009] Based on the first prediction result and the second prediction result, the monitoring indicators corresponding to the monitoring data are adjusted, and the monitoring indicators include one or more of an alarm threshold, a monitoring frequency, and an alarm priority.

[0010] In a possible implementation, performing short-term trend analysis on the acquired monitoring data to obtain a first prediction result includes:

[0011] Determining a first sliding window size and a weight distribution mode based on the data type of the monitoring data;

[0012] creating a first sliding window based on the first sliding window size;

[0013] Dividing the monitoring data based on the first sliding window to obtain first sliding window data;

[0014] Performing weight allocation on each data point in the first sliding window data according to the weight allocation mode;

[0015] The weighted first sliding window data is used to perform short-term trend analysis to obtain the first prediction result.

[0016] In a possible implementation manner, the computing node stores a mapping relationship between a data type and a first sliding window size, and stores a mapping relationship between a data type and a weight distribution mode, and the determining of the first sliding window size and the weight distribution mode based on the data type of the monitoring data includes:

[0017] Querying a mapping relationship between the data type and the first sliding window size, and using the first sliding window size matching the data type of the monitoring data as a target first sliding window size;

[0018] The mapping relationship between the data type and the weight allocation mode is queried, and the weight allocation mode that matches the data type of the monitoring data is used as the target weight allocation mode.

[0019] In a possible implementation manner, performing long-term trend analysis on the monitoring data to obtain a second prediction result includes:

[0020] Creating a second sliding window based on the data type of the monitoring data;

[0021] Divide the monitoring data based on the second sliding window to obtain second sliding window data;

[0022] The second sliding window data is input into a pre-trained long short-term memory network model for long-term trend analysis to obtain a second prediction result.

[0023] In a possible implementation manner, the computing node stores a mapping relationship between a data type and a size of the second sliding window, and the creating the second sliding window based on the data type of the monitoring data includes:

[0024] Querying a mapping relationship between the data type and the second sliding window size, and using the second sliding window size matching the data type of the monitoring data as a target second sliding window size;

[0025] A second sliding window is created based on the target second sliding window size.

[0026] In a possible implementation, adjusting the monitoring indicator corresponding to the monitoring data based on the first prediction result and the second prediction result includes:

[0027] Performing weighted average calculation on the first prediction result and the second prediction result to obtain a final prediction result;

[0028] Determining a fluctuation range of the final prediction result;

[0029] According to the fluctuation range of the final prediction result, the alarm threshold of the monitoring data is adjusted.

[0030] In a possible implementation, the method further includes:

[0031] Continue to obtain the next monitoring data;

[0032] Determine whether the next monitoring data is within the alarm threshold range of the current time period;

[0033] If the next monitoring data is within the alarm threshold range of the current time period, generating an alarm message;

[0034] The alarm information is sent to the central node of the distributed system.

[0035] In a second aspect, an embodiment of the present application provides an alarm device in a distributed system, which is applied to any computing node in the distributed system, and the device includes:

[0036] A first analysis module, used to perform short-term trend analysis on the acquired monitoring data to obtain a first prediction result;

[0037] A second analysis module is used to perform long-term trend analysis on the monitoring data to obtain a second prediction result;

[0038] An adjustment module is used to adjust the monitoring indicators corresponding to the monitoring data based on the first prediction result and the second prediction result, and the monitoring indicators include one or more of an alarm threshold, a monitoring frequency and an alarm priority.

[0039] In a possible implementation manner, the first analysis module is specifically configured to:

[0040] Determining a first sliding window size and a weight distribution mode based on the data type of the monitoring data;

[0041] creating a first sliding window based on the first sliding window size;

[0042] Dividing the monitoring data based on the first sliding window to obtain first sliding window data;

[0043] Performing weight allocation on each data point in the first sliding window data according to the weight allocation mode;

[0044] The weighted first sliding window data is used to perform short-term trend analysis to obtain the first prediction result.

[0045] In a possible implementation manner, the computing node stores a mapping relationship between a data type and a first sliding window size, and stores a mapping relationship between a data type and a weight distribution mode, and the first analysis module is specifically used to:

[0046] Querying a mapping relationship between the data type and the first sliding window size, and using the first sliding window size matching the data type of the monitoring data as a target first sliding window size;

[0047] The mapping relationship between the data type and the weight allocation mode is queried, and the weight allocation mode that matches the data type of the monitoring data is used as the target weight allocation mode.

[0048] In a possible implementation manner, the second analysis module is specifically used to:

[0049] Creating a second sliding window based on the data type of the monitoring data;

[0050] Divide the monitoring data based on the second sliding window to obtain second sliding window data;

[0051] The second sliding window data is input into a pre-trained long short-term memory network model for long-term trend analysis to obtain a second prediction result.

[0052] In a possible implementation manner, a mapping relationship between a data type and a second sliding window size is stored in the computing node, and the second analysis module is specifically configured to:

[0053] Querying a mapping relationship between the data type and the second sliding window size, and using the second sliding window size matching the data type of the monitoring data as a target second sliding window size;

[0054] A second sliding window is created based on the target second sliding window size.

[0055] In a possible implementation manner, the adjustment module is specifically used to:

[0056] Performing weighted average calculation on the first prediction result and the second prediction result to obtain a final prediction result;

[0057] Determining a fluctuation range of the final prediction result;

[0058] According to the fluctuation range of the final prediction result, the alarm threshold of the monitoring data is adjusted.

[0059] In a possible implementation manner, the device is further specifically used for:

[0060] Continue to obtain the next monitoring data;

[0061] Determine whether the next monitoring data is within the alarm threshold range of the current time period;

[0062] If the next monitoring data is within the alarm threshold range of the current time period, generating an alarm message;

[0063] The alarm information is sent to the central node of the distributed system.

[0064] In a third aspect, an embodiment of the present application provides an alarm device in a distributed system, including: a memory, a processor;

[0065] The memory stores computer-executable instructions;

[0066] The processor executes the computer-executable instructions stored in the memory, so that the processor executes the above first aspect and / or various possible implementations of the first aspect.

[0067] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to implement the first aspect above and / or various possible implementations of the first aspect.

[0068] In a fifth aspect, an embodiment of the present application provides a computer program product, including a computer program, which, when executed by a processor, implements the above first aspect and / or various possible implementation methods of the first aspect.

[0069] The alarm method, apparatus, equipment, medium and program product in a distributed system provided in the embodiments of the present application can independently perform dynamic monitoring index adjustment for any computing node in the distributed system, wherein short-term trend analysis and long-term trend analysis can be performed on the monitoring data to obtain corresponding first prediction results and second prediction results respectively, and the monitoring indicators are set by combining the prediction results of the short-term trend analysis and the long-term trend analysis, which can more accurately identify abnormal situations. It is suitable for systems with complex dynamic characteristics, and can reduce unnecessary alarms while maintaining high sensitivity, thereby achieving the effect of improving the sensitivity and reliability of alarm detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0070] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0071] Figure 1 A schematic diagram of a scenario of an alarm method in a distributed system provided by this application;

[0072] Figure 2 Schematic diagram of the process of the alarm method in the distributed system provided by this application Figure 1 ;

[0073] Figure 3 Schematic diagram of the process of the alarm method in the distributed system provided by this application Figure 2 ;

[0074] Figure 4 A schematic diagram of the execution process of the alarm method in the distributed system provided by this application;

[0075] Figure 5 A schematic diagram of the structure of the alarm device in the distributed system provided by this application;

[0076] Figure 6 A schematic diagram of the structure of the alarm device in the distributed system provided in this application.

[0077] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0078] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0079] Currently, with the in-depth development of omni-channel financial services, bank transaction systems generate terabytes of transaction and log data every day. Bank transaction and log data are highly volatile and complex. Traditional alarm methods often cannot provide sufficient sensitivity and accuracy in the face of complex financial business environments.

[0080] The alarm method in a distributed system provided by the present application can independently perform dynamic monitoring index adjustment for any computing node in the distributed system, wherein the corresponding first prediction result and the second prediction result can be obtained respectively by performing short-term trend analysis and long-term trend analysis on the monitoring data, and the monitoring index is set by combining the prediction results of the short-term trend analysis and the long-term trend analysis. This can more accurately identify abnormal situations and is suitable for systems with complex dynamic characteristics. It can reduce unnecessary alarms while maintaining high sensitivity, and solves the technical problem that the current alarm method cannot provide sufficient sensitivity and accuracy.

[0081] Figure 1 A schematic diagram of a scenario of an alarm method in a distributed system provided in this application, such as Figure 1 As shown, the application scenario of the present application is specifically a scenario in which the computing node 102 in the distributed system independently processes local data, performs dynamic monitoring indicator adjustment and real-time alarm detection, and transmits the alarm information to the central node 101 for summary processing.

[0082] First, the technology involved in this application is explained:

[0083] Time Series Analysis: It is a statistical method used to explore and understand the inherent laws and characteristics of time series data. By analyzing the characteristics of trends, periodicity, seasonality and random fluctuations in time series, a forecasting model can be established to predict future data points or trends.

[0084] Dynamic Threshold: A threshold method that is dynamically adjusted based on real-time changes in data. Unlike fixed thresholds, dynamic thresholds can adapt to changes in data and show higher sensitivity and accuracy in anomaly detection.

[0085] Short-term Model: A model that analyzes the fluctuations and trends of time series data over a shorter period of time (such as hours, days, or weeks). Common short-term models include the simple moving average (SMA), weighted moving average (WMA), and exponential moving average (EMA). These models help identify short-term changes by smoothing data within a short time window.

[0086] Long-term Model: Analyzes the trend and cyclical characteristics of time series data over a longer period of time. Typical long-term models include ARIMA (Autoregressive Integrated Moving Average) and LSTM (Long Short-Term Memory). These models can process data with a longer time span and identify the long-term change patterns of the data.

[0087] Distributed Architecture: A system design method that distributes computing tasks to multiple nodes (i.e., computers or servers). In the distributed system proposed in this application, each computing node independently processes local data, performs dynamic threshold calculations and alarm detection, and the central node assists in summarizing and optimizing alarm information.

[0088] Sliding Window Technique: An efficient data processing method, especially suitable for the analysis of time series data and continuous data streams. By defining a fixed-size window on the time series data and sliding the window position continuously as the data flows, the statistical characteristics of the data in the window are calculated in real time. This technique is often used for real-time monitoring and short-term trend analysis.

[0089] Alert Detection: It refers to monitoring various indicators in the system (such as CPU usage, memory usage, disk space, network traffic, etc.). When the data of these indicators exceeds the preset normal range or meets a certain abnormal mode, the system automatically triggers an alarm.

[0090] Data preprocessing: refers to the process of cleaning, normalizing and converting raw data before formal data analysis and modeling. Common preprocessing steps include removing outliers, filling missing values, data standardization and normalization, etc., to improve data quality and the accuracy of analysis results.

[0091] The technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems are described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0092] Figure 2 Schematic diagram of the process of the alarm method in the distributed system provided by this application Figure 1 ,like Figure 2 As shown, it can be applied to any computing node in a distributed system, and the distributed system can be a bank transaction system. The method includes:

[0093] S201. Perform short-term trend analysis on the acquired monitoring data to obtain a first prediction result.

[0094] Monitoring data can include CPU usage, memory usage, and IO operations.

[0095] In an embodiment of the present application, a short-term trend analysis may be performed on the acquired monitoring data to analyze the short-term change trends and potential anomalies of the monitoring data and generate a first prediction result.

[0096] S202: Perform a long-term trend analysis on the monitoring data to obtain a second prediction result.

[0097] In an embodiment of the present application, a long-term trend analysis may also be performed on the monitoring data to analyze the long-term change trend and periodic change of the monitoring data and generate a second prediction result.

[0098] S203. Based on the first prediction result and the second prediction result, adjust the monitoring indicators corresponding to the monitoring data, where the monitoring indicators include one or more of an alarm threshold, a monitoring frequency, and an alarm priority.

[0099] Based on the obtained first prediction result (ie, short-term prediction result) and the second prediction result (ie, long-term prediction result), the monitoring indicators corresponding to the monitoring data may be adjusted to adapt to the dynamic changes of the monitoring data.

[0100] In an embodiment of the present application, the alarm threshold corresponding to the monitoring data can be adjusted based on the short-term prediction results and the long-term prediction results. Alternatively, if the short-term prediction results show large fluctuations or potential anomalies, the monitoring frequency can be increased; if the long-term prediction results show a stable trend, the monitoring frequency can be reduced. Alternatively, the priority of the alarm can be adjusted according to the severity and potential impact of the prediction results. By combining short-term and long-term trend analysis, it is possible to more flexibly adapt to dynamic changes in data and improve the accuracy and efficiency of monitoring. This approach helps to reduce false positives and missed positives and ensure that key issues are responded to and handled in a timely manner.

[0101] The alarm method in a distributed system provided in an embodiment of the present application can independently perform dynamic monitoring index adjustment for any computing node in the distributed system, wherein short-term trend analysis and long-term trend analysis can be performed on the monitoring data to obtain corresponding first prediction results and second prediction results respectively, and the monitoring indicators are set by combining the prediction results of the short-term trend analysis and the long-term trend analysis. This can more accurately identify abnormal situations and is suitable for systems with complex dynamic characteristics. It can reduce unnecessary alarms while maintaining high sensitivity, thereby achieving the effect of improving the sensitivity and reliability of alarm detection.

[0102] Figure 3 Schematic diagram of the process of the alarm method in the distributed system provided by this application Figure 2 ,like Figure 3 As shown, in this embodiment Figure 2Based on the embodiment, the alarm method in the distributed system is described in detail. The method can be applied to any computing node in the distributed system. The distributed system can be a bank transaction system. The method includes:

[0103] S301. Determine a first sliding window size and a weight distribution mode based on a data type of monitoring data.

[0104] The first sliding window is mainly used to capture short-term changes in data.

[0105] Among them, the monitoring data can be preprocessed first, including removing outliers, filling missing values, and data standardization. Removing outliers means identifying and removing outliers in the data to ensure data quality. Filling missing values ​​can be filling missing values ​​in time series data using interpolation. Data standardization means converting data to a unified scale to eliminate the magnitude differences between different features.

[0106] In an embodiment of the present application, the data type of the preprocessed monitoring data can be determined, such as CPU usage, memory occupancy, network traffic, etc.

[0107] The size of the first sliding window can be determined according to the data type of the monitoring data. For example, the CPU usage rate usually fluctuates quickly, so a smaller first sliding window size can be selected; the memory occupancy rate changes relatively slowly, so a larger first sliding window size can be selected.

[0108] According to the data type of the monitoring data, the weight distribution mode can be determined. The weight distribution mode can include uniform distribution mode, decreasing distribution mode, etc. The uniform distribution mode means that all data points in the window are given the same weight. The decreasing distribution mode emphasizes the importance of the latest data. The closer the data point is to the current time in the window, the higher the weight.

[0109] In a possible implementation, a mapping relationship between a data type and a first sliding window size, and a mapping relationship between a data type and a weight distribution mode are stored in the computing node. Based on the data type of the monitoring data, determining the first sliding window size and the weight distribution mode may specifically include:

[0110] Query the mapping relationship between the data type and the first sliding window size, and use the first sliding window size matching the data type of the monitoring data as the target first sliding window size;

[0111] The mapping relationship between the query data type and the weight distribution mode is obtained, and the weight distribution mode that matches the data type of the monitoring data is used as the target weight distribution mode.

[0112] In this embodiment, the computing node may store a mapping relationship between the data type and the first sliding window size and the weight distribution mode. This mapping relationship enables the system to automatically select an appropriate first sliding window configuration according to the data type, thereby improving the monitoring accuracy and response speed.

[0113] When a short-term trend analysis is required for certain monitoring data, the first sliding window size matching the data type is found by querying the stored mapping relationship, and the matching first sliding window size is set as the target first sliding window size. Similarly, the weight distribution mode matching the data type is found by querying the stored mapping relationship, and the matching weight distribution mode is set as the target weight distribution mode.

[0114] S302: Create a first sliding window based on a first sliding window size.

[0115] A data structure (such as a queue, array, or circular buffer) may be created to store the data points within the first sliding window.

[0116] S303. Divide the monitoring data based on the first sliding window to obtain first sliding window data.

[0117] S304: weight each data point in the first sliding window data according to the weight distribution mode.

[0118] According to the weight allocation mode, a corresponding weight is allocated to each data point in the first sliding window data.

[0119] S305: Use the weighted first sliding window data to perform short-term trend analysis to obtain a first prediction result.

[0120] As an example, a weighted moving average can be used for short-term trend analysis. The calculation formula can be as follows:

[0121]

[0122] Among them, X i is the value of the i-th data point in the first sliding window, W i is the corresponding weight, weight W i The size of the first sliding window is n, in descending order of the time of the data points.

[0123] For different data types, appropriate window size and weight distribution can be selected to adapt to the characteristics of different data.

[0124] S306: Create a second sliding window based on the data type of the monitoring data.

[0125] The second sliding window is mainly used to capture long-term changes in data.

[0126] In an embodiment of the present application, a second sliding window may be created according to the data type of the monitoring data.

[0127] In a possible implementation manner, a mapping relationship between a data type and a size of the second sliding window is stored in the computing node, and creating the second sliding window based on the data type of the monitoring data may specifically include:

[0128] Query the mapping relationship between the data type and the second sliding window size, and use the second sliding window size matching the data type of the monitoring data as the target second sliding window size;

[0129] A second sliding window is created based on the target second sliding window size.

[0130] In this embodiment, the computing node may store a mapping relationship between the data type and the second sliding window size, and this mapping relationship enables the system to automatically select an appropriate second sliding window configuration according to the data type. A second sliding window is created based on the target second sliding window size obtained by the query. If the data type of the monitoring data changes, or the second sliding window size needs to be adjusted based on the real-time analysis results, the mapping relationship can be re-queried and the size of the second sliding window can be adjusted. This dynamic adjustment capability enables the system to flexibly respond to changing environments and data characteristics.

[0131] S307. Divide the monitoring data based on the second sliding window to obtain second sliding window data.

[0132] S308: Input the second sliding window data into a pre-trained long short-term memory network model to perform long-term trend analysis to obtain a second prediction result.

[0133] For the long short-term memory network model, historical monitoring data can be obtained and divided into training sample data and label data for model training. The long short-term memory network model contains input layer, LSTM layer, fully connected layer and output layer. The mean square error can be used to measure the error between the predicted value and the actual value, and the Adam optimizer can be used to adjust the model parameters. The model is trained iteratively and the model parameters are updated through the back propagation algorithm until the loss function converges or the preset number of training times is reached.

[0134] In an embodiment of the present application, a pre-trained long short-term memory network model is used to perform long-term trend analysis.

[0135] S309: Based on the first prediction result and the second prediction result, adjust the monitoring indicators corresponding to the monitoring data, where the monitoring indicators include one or more of an alarm threshold, a monitoring frequency, and an alarm priority.

[0136] In a possible implementation, adjusting the monitoring indicator corresponding to the monitoring data based on the first prediction result and the second prediction result may specifically include:

[0137] Perform weighted average calculation on the first prediction result and the second prediction result to obtain a final prediction result;

[0138] Determine the fluctuation range of the final forecast results;

[0139] Adjust the alarm threshold of the monitoring data according to the fluctuation range of the final prediction results.

[0140] In this embodiment, the first prediction result and the second prediction result can be weighted averaged, wherein Bayesian optimization can be used to dynamically adjust the weights of the first prediction result and the second prediction result. Statistical methods such as standard deviation and percentile can be used to determine the fluctuation range of the final prediction result, and then determine the alarm threshold.

[0141] In a possible implementation manner, the alarm method in the distributed system of the embodiment of the present application may further include:

[0142] Continue to obtain the next monitoring data;

[0143] Determine whether the next monitoring data is within the alarm threshold range of the current time period;

[0144] If the next monitoring data is within the alarm threshold range of the current time period, an alarm message is generated;

[0145] Send the alarm information to the central node of the distributed system.

[0146] The alarm threshold range is dynamically adjusted according to the previous steps. If the next monitoring data is within the alarm threshold range of the current time period, an alarm message is generated and sent to the central node of the distributed system. After receiving the alarm message, the central node performs further processing.

[0147] The central node is responsible for aggregating the alarm information of each computing node and performing global optimization and coordination. The central node can notify the relevant operation and maintenance personnel of the alarm information through SMS, email, message push, etc. A knowledge base has also been established in the central node, which records historical alarm events and their handling methods, and the knowledge base is updated regularly. For some alarm information, if the conditions for automated processing are met, the automatic processing program will be triggered, and the handling script will be automatically executed to handle the alarm. The central node also integrates an artificial intelligence model, which can generate handling suggestions based on the alarm information and knowledge base data. The alarm information and its processing status can be displayed in the form of charts and dashboards to help operation and maintenance personnel quickly understand the system operation status.

[0148] Reference Figure 4 As shown, it is a schematic diagram of the execution process of the alarm method in the distributed system provided by the present application. In this distributed system, each computing node independently performs dynamic threshold adjustment and alarm detection, and the central node summarizes the alarm information of each computing node. In the computing node, the alarm threshold is adjusted by combining short-term trend analysis and long-term trend analysis to improve the accuracy and timeliness of alarm detection. In the central node, by establishing a knowledge base mechanism, historical alarm events and their handling methods are collected and organized to provide reference for similar alarms in the future; by integrating artificial intelligence models, past case experience and alarm handling suggestions can be provided.

[0149] The alarm method in a distributed system provided in an embodiment of the present application can independently perform dynamic monitoring index adjustment for any computing node in the distributed system, wherein short-term trend analysis and long-term trend analysis can be performed on the monitoring data to obtain corresponding first prediction results and second prediction results respectively, and the monitoring indicators are set by combining the prediction results of the short-term trend analysis and the long-term trend analysis. This can more accurately identify abnormal situations and is suitable for systems with complex dynamic characteristics. It can reduce unnecessary alarms while maintaining high sensitivity, thereby achieving the effect of improving the sensitivity and reliability of alarm detection.

[0150] Figure 5 A schematic diagram of the structure of the alarm device in the distributed system provided by this application, such as Figure 5 As shown, the alarm device 50 provided in this embodiment is applied to any computing node in a distributed system and includes:

[0151] The first analysis module 501 is used to perform short-term trend analysis on the acquired monitoring data to obtain a first prediction result;

[0152] The second analysis module 502 is used to perform long-term trend analysis on the monitoring data to obtain a second prediction result;

[0153] The adjustment module 503 is used to adjust the monitoring indicators corresponding to the monitoring data based on the first prediction result and the second prediction result, and the monitoring indicators include one or more of an alarm threshold, a monitoring frequency and an alarm priority.

[0154] In a possible implementation, the first analysis module is specifically used to:

[0155] Determine a first sliding window size and a weight distribution mode based on the data type of the monitoring data;

[0156] creating a first sliding window based on the first sliding window size;

[0157] Divide the monitoring data based on the first sliding window to obtain first sliding window data;

[0158] Performing weight allocation on each data point in the first sliding window data according to the weight allocation mode;

[0159] The weighted first sliding window data is used to perform short-term trend analysis to obtain the first prediction result.

[0160] In a possible implementation, the computing node stores a mapping relationship between a data type and a first sliding window size, and stores a mapping relationship between a data type and a weight distribution mode, and the first analysis module is specifically used to:

[0161] Query the mapping relationship between the data type and the first sliding window size, and use the first sliding window size matching the data type of the monitoring data as the target first sliding window size;

[0162] The mapping relationship between the query data type and the weight distribution mode is obtained, and the weight distribution mode that matches the data type of the monitoring data is used as the target weight distribution mode.

[0163] In a possible implementation, the second analysis module is specifically used to:

[0164] Creating a second sliding window based on the data type of the monitoring data;

[0165] Divide the monitoring data based on the second sliding window to obtain second sliding window data;

[0166] The second sliding window data is input into a pre-trained long short-term memory network model for long-term trend analysis to obtain a second prediction result.

[0167] In a possible implementation manner, a mapping relationship between a data type and a size of the second sliding window is stored in the computing node, and the second analysis module is specifically used for:

[0168] Query the mapping relationship between the data type and the second sliding window size, and use the second sliding window size matching the data type of the monitoring data as the target second sliding window size;

[0169] A second sliding window is created based on the target second sliding window size.

[0170] In a possible implementation, the adjustment module is specifically used to:

[0171] Perform weighted average calculation on the first prediction result and the second prediction result to obtain a final prediction result;

[0172] Determine the fluctuation range of the final forecast results;

[0173] Adjust the alarm threshold of the monitoring data according to the fluctuation range of the final prediction results.

[0174] In a possible implementation, the device is further configured to:

[0175] Continue to obtain the next monitoring data;

[0176] Determine whether the next monitoring data is within the alarm threshold range of the current time period;

[0177] If the next monitoring data is within the alarm threshold range of the current time period, an alarm message is generated;

[0178] Send the alarm information to the central node of the distributed system.

[0179] The alarm device in the distributed system provided in this embodiment can execute the method provided in the above method embodiment. Its implementation principle and technical effect are similar, and this embodiment will not be described in detail here.

[0180] Figure 6 This is a schematic diagram of the structure of the alarm device in the distributed system provided by this application. Figure 6 As shown, the alarm device 60 in the distributed system provided in this embodiment includes: at least one processor 601 and a memory 602. Optionally, the device 60 also includes a communication component 603. The processor 601, the memory 602 and the communication component 603 are connected via a bus.

[0181] In a specific implementation process, at least one processor 601 executes the computer execution instructions stored in the memory 602, so that at least one processor 601 executes the above method.

[0182] The specific implementation process of the processor 601 can be found in the above method embodiment, and its implementation principle and technical effect are similar, so this embodiment will not be repeated here.

[0183] In the above embodiments, it should be understood that the processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), etc. A general-purpose processor may be a microprocessor or any conventional processor. The steps of the method disclosed in the invention may be directly implemented as being executed by a hardware processor, or may be executed by a combination of hardware and software modules in the processor.

[0184] The memory may include a high-speed memory (Random Access Memory, RAM), and may also include a non-volatile memory (Non-volatile Memory, NVM), such as at least one disk memory.

[0185] The bus may be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, the bus in the drawings of the present application is not limited to only one bus or one type of bus.

[0186] The present application also provides a computer program product, including a computer program, which implements the above method when executed by a processor.

[0187] The present application also provides a computer-readable storage medium, in which computer-executable instructions are stored. When a processor executes the computer-executable instructions, the above method is implemented.

[0188] The above-mentioned readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk. The readable storage medium can be any available medium that can be accessed by a general or special-purpose computer.

[0189] An exemplary readable storage medium is coupled to a processor so that the processor can read information from the readable storage medium and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can be located in an application specific integrated circuit (Application Specific Integrated Circuits, referred to as: ASIC). Of course, the processor and the readable storage medium can also exist in the device as discrete components.

[0190] The division of units is only a logical function division, and there may be other divisions in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interface, device or unit, which can be electrical, mechanical or other forms.

[0191] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0192] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0193] If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods of each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0194] Those skilled in the art can understand that all or part of the steps of implementing the above-mentioned method embodiments can be completed by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, the steps of the above-mentioned method embodiments are executed; and the aforementioned storage medium includes: ROM, RAM, disk or optical disk and other media that can store program codes.

[0195] Finally, it should be noted that those skilled in the art will readily conceive of other embodiments of the present invention after considering the specification and practicing the invention disclosed herein. The present invention is intended to cover any variations, uses or adaptations of the present invention, which follow the general principles of the present invention and include common knowledge or customary technical means in the art not disclosed by the present invention, are not limited to the precise structure described above and shown in the drawings, and may be modified and changed in various ways without departing from the scope thereof. The scope of the present invention is limited only by the appended claims.

Claims

1. An alarm method in a distributed system, characterized in that: Applied to any computing node in the distributed system, the method comprises: Perform short-term trend analysis on the acquired monitoring data to obtain a first prediction result; Performing long-term trend analysis on the monitoring data to obtain a second prediction result; Based on the first prediction result and the second prediction result, the monitoring indicators corresponding to the monitoring data are adjusted, and the monitoring indicators include one or more of an alarm threshold, a monitoring frequency, and an alarm priority.

2. The method according to claim 1, characterized in that The performing short-term trend analysis on the acquired monitoring data to obtain a first prediction result includes: Determining a first sliding window size and a weight distribution mode based on the data type of the monitoring data; creating a first sliding window based on the first sliding window size; Divide the monitoring data based on the first sliding window to obtain first sliding window data; Performing weight allocation on each data point in the first sliding window data according to the weight allocation mode; The weighted first sliding window data is used to perform short-term trend analysis to obtain the first prediction result.

3. The method according to claim 2, characterized in that The computing node stores a mapping relationship between a data type and a first sliding window size, and a mapping relationship between a data type and a weight distribution mode. The determining of the first sliding window size and the weight distribution mode based on the data type of the monitoring data includes: Querying a mapping relationship between the data type and the first sliding window size, and using the first sliding window size matching the data type of the monitoring data as a target first sliding window size; The mapping relationship between the data type and the weight allocation mode is queried, and the weight allocation mode that matches the data type of the monitoring data is used as the target weight allocation mode.

4. The method according to claim 1, characterized in that: The performing long-term trend analysis on the monitoring data to obtain a second prediction result includes: Creating a second sliding window based on the data type of the monitoring data; Divide the monitoring data based on the second sliding window to obtain second sliding window data; The second sliding window data is input into a pre-trained long short-term memory network model for long-term trend analysis to obtain a second prediction result.

5. The method according to claim 4, characterized in that The computing node stores a mapping relationship between a data type and a size of a second sliding window, and the creating a second sliding window based on the data type of the monitoring data includes: Querying a mapping relationship between the data type and the second sliding window size, and using the second sliding window size matching the data type of the monitoring data as a target second sliding window size; A second sliding window is created based on the target second sliding window size.

6. The method according to any one of claims 1 to 5, characterized in that: The adjusting the monitoring indicator corresponding to the monitoring data based on the first prediction result and the second prediction result includes: Performing weighted average calculation on the first prediction result and the second prediction result to obtain a final prediction result; Determining a fluctuation range of the final prediction result; According to the fluctuation range of the final prediction result, the alarm threshold of the monitoring data is adjusted.

7. The method according to any one of claims 1 to 5, characterized in that: The method further comprises: Continue to obtain the next monitoring data; Determine whether the next monitoring data is within the alarm threshold range of the current time period; If the next monitoring data is within the alarm threshold range of the current time period, generating an alarm message; The alarm information is sent to the central node of the distributed system.

8. An alarm device in a distributed system, characterized in that: Applied to any computing node in the distributed system, the device comprises: A first analysis module, used to perform short-term trend analysis on the acquired monitoring data to obtain a first prediction result; A second analysis module is used to perform long-term trend analysis on the monitoring data to obtain a second prediction result; An adjustment module is used to adjust the monitoring indicators corresponding to the monitoring data based on the first prediction result and the second prediction result, and the monitoring indicators include one or more of an alarm threshold, a monitoring frequency and an alarm priority.

9. An alarm device in a distributed system, characterized in that: include: Memory, processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory, so that the processor performs the method according to any one of claims 1 to 7.

10. A computer-readable storage medium / computer program product, characterized in that: The computer-readable storage medium stores computer-executable instructions, which are used to implement the method according to any one of claims 1 to 7 when executed by a processor; and / or, The computer program product comprises a computer program, which implements the method according to any one of claims 1 to 7 when executed by a processor.

Images