Monitoring threshold recommendation method, device and equipment
By obtaining target alarm rules and related dimensions and indicator parameters, pre-processing and cleaning of performance monitoring data, and recommending reasonable monitoring thresholds, solving the problems of low efficiency and poor accuracy of thresholds relying on operation and maintenance experience in the existing technology, and achieving more efficient and accurate monitoring threshold configuration.
Patent Information
- Application Number
- CN202411742631.0
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-11-29
- Publication Date
- 2025-03-18
AI Technical Summary
The existing monitoring threshold mainly depends on the operation and maintenance experience of the system manager and the understanding of the system to configure it. It is low efficiency, has a large workload, and is easily affected by human subjective factors, which reduces the configuration accuracy of the monitoring threshold.
Provide a monitoring threshold recommendation method, by obtaining target alarm rules and related dimensions and indicator parameters, obtaining performance monitoring data from the database, performing pre-processing and cleaning processing, and finally estimating and recommending rules thresholds based on the characteristics of different indicator data.
Reliance on human operation and maintenance experience has been reduced, the configuration accuracy of monitoring thresholds has been improved, false alarms have been reduced, and the monitoring and alarm quality has been improved.
Smart Images
Figure CN119645767A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of computer technology, and in particular to a monitoring threshold recommendation method, device and equipment. Background Art
[0002] In recent years, with the rapid development of social economy, major banks, as the center of financial services, need to handle more and more business. In this case, in order to ensure the security of bank and customer data, usually after the various application systems in the bank are put into production, they will select appropriate monitoring methods on demand for monitoring access. The monitoring access process is mainly divided into five parts: analyzing monitoring needs, monitoring configuration access, monitoring rule configuration, monitoring alarm joint debugging, and monitoring production verification. Among them, the configuration of monitoring rules is the key to abnormality detection. The appropriate threshold can detect abnormalities in time without generating too many false alarms.
[0003] However, the current monitoring thresholds are mainly configured based on the operation and maintenance experience of the system manager and his understanding of the system. This is inefficient, requires a large workload, and is easily affected by human subjective factors, which reduces the configuration accuracy of the monitoring thresholds. Summary of the invention
[0004] The main purpose of the embodiments of the present application is to provide a monitoring threshold recommendation method, device and equipment, which can recommend reasonable monitoring thresholds to users as a reference when configuring monitoring indicator rules, reduce dependence on human operation and maintenance experience, and improve the configuration accuracy of monitoring thresholds.
[0005] In a first aspect, an embodiment of the present application provides a monitoring threshold recommendation method, including:
[0006] Obtain target alarm rules, and extract dimensions and indicator parameters involved in the target alarm rules;
[0007] According to the dimensions and indicator parameters involved in the target alarm rule, target performance monitoring data is obtained from the database;
[0008] According to the dimensions and indicator parameters involved in the target alarm rule, the target performance monitoring data is split and preprocessed to fill in missing values to obtain preprocessed target performance monitoring data;
[0009] Cleaning the preprocessed target performance monitoring data to obtain cleaned target performance monitoring data;
[0010] The cleaned target data is estimated based on different indicator data characteristics and the estimated threshold is recommended.
[0011] Optionally, the preprocessing of splitting the target performance monitoring data and filling missing values according to the dimensions and indicator parameters involved in the target alarm rule to obtain the preprocessed target performance monitoring data includes:
[0012] According to the dimensions and indicator parameters involved in the target alarm rule, the target performance monitoring data is split to form multiple groups of time series data sets;
[0013] The missing values in the multiple sets of time series data sets are filled with the mean of historical data to obtain multiple sets of continuous and uninterrupted data sets as pre-processed target performance monitoring data.
[0014] Optionally, after acquiring target performance monitoring data from a database according to the dimensions and indicator parameters involved in the target alarm rule, the method further includes:
[0015] Evaluate the quality of the target performance monitoring data to obtain target performance monitoring data whose evaluation results meet preset conditions;
[0016] The preprocessing of splitting the target performance monitoring data and filling missing values according to the dimensions and indicator parameters involved in the target alarm rule to obtain the preprocessed target performance monitoring data includes:
[0017] According to the dimensions and indicator parameters involved in the target alarm rule, the target performance monitoring data whose evaluation results meet the preset conditions is preprocessed by splitting and filling missing values to obtain the preprocessed target performance monitoring data.
[0018] Optionally, the method according to claim 1 is characterized in that the cleaning of the preprocessed target performance monitoring data to obtain the cleaned target performance monitoring data comprises:
[0019] An outlier detection algorithm is used to detect outliers in the preprocessed target performance monitoring data, and the detection results are processed to remove outliers to obtain cleaned target performance monitoring data.
[0020] In a second aspect, an embodiment of the present application further provides a monitoring threshold recommendation device, including:
[0021] An extraction unit, used to obtain a target alarm rule and extract dimensions and indicator parameters involved in the target alarm rule;
[0022] An acquisition unit, used to acquire target performance monitoring data from a database according to the dimensions and indicator parameters involved in the target alarm rule;
[0023] A preprocessing unit, configured to preprocess the target performance monitoring data by splitting and filling missing values according to the dimensions and indicator parameters involved in the target alarm rule, so as to obtain the preprocessed target performance monitoring data;
[0024] A cleaning unit, used for cleaning the pre-processed target performance monitoring data to obtain cleaned target performance monitoring data;
[0025] The recommendation unit is used to estimate the rule threshold value of the cleaned target data according to different indicator data characteristics, and recommend the estimated threshold value.
[0026] Optionally, the preprocessing unit includes:
[0027] A splitting subunit is used to split the target performance monitoring data according to the dimensions and indicator parameters involved in the target alarm rule to form multiple groups of time series data sets;
[0028] The filling subunit is used to fill the missing values in the multiple groups of time series data sets with the mean value of historical data to obtain multiple groups of continuous and uninterrupted data sets as pre-processed target performance monitoring data.
[0029] Optionally, the device further comprises:
[0030] An evaluation unit, used to evaluate the quality of the target performance monitoring data, and obtain the target performance monitoring data whose evaluation result meets the preset conditions;
[0031] The pre-processing unit is specifically used for:
[0032] According to the dimensions and indicator parameters involved in the target alarm rule, the target performance monitoring data whose evaluation results meet the preset conditions is preprocessed by splitting and filling missing values to obtain the preprocessed target performance monitoring data.
[0033] Optionally, the cleaning unit is specifically used for:
[0034] An outlier detection algorithm is used to detect outliers in the preprocessed target performance monitoring data, and the detection results are processed to remove outliers to obtain cleaned target performance monitoring data.
[0035] The embodiment of the present application also provides a monitoring threshold recommendation device, including: a processor, a memory, and a system bus;
[0036] The processor and the memory are connected via the system bus;
[0037] The memory is used to store one or more programs, and the one or more programs include instructions. When the instructions are executed by the processor, the processor executes any one of the implementations of the above-mentioned monitoring threshold recommendation method.
[0038] An embodiment of the present application also provides a computer-readable storage medium, in which instructions are stored. When the instructions are executed on a terminal device, the terminal device executes any one of the implementations of the above-mentioned monitoring threshold recommendation method.
[0039] The monitoring threshold recommendation method, device and equipment provided by the embodiment of the present application first obtains the target alarm rule and extracts the dimensions and indicator parameters involved in the target alarm rule. Then, according to the dimensions and indicator parameters involved in the target alarm rule, the target performance monitoring data is obtained from the database. Then, according to the dimensions and indicator parameters involved in the target alarm rule, the target performance monitoring data is preprocessed to split and fill in missing values to obtain the preprocessed target performance monitoring data. Then, the preprocessed target performance monitoring data is cleaned to obtain the cleaned target performance monitoring data. Then, the rule threshold of the cleaned target data can be estimated according to the characteristics of different indicator data, and the estimated threshold can be recommended. Therefore, a reasonable monitoring threshold can be recommended to the user as a reference when configuring the monitoring indicator rule, reducing the dependence on human operation and maintenance experience and improving the configuration accuracy of the monitoring threshold. BRIEF DESCRIPTION OF THE DRAWINGS
[0040] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.
[0041] Figure 1 A flowchart of a monitoring threshold recommendation method provided in an embodiment of the present application;
[0042] Figure 2 A schematic diagram of a process for obtaining target performance monitoring data from a database provided in an embodiment of the present application;
[0043] Figure 3 A schematic diagram of a process for cleaning pre-processed target performance monitoring data provided in an embodiment of the present application;
[0044] Figure 4 A schematic diagram of the composition of a monitoring threshold recommendation device provided in an embodiment of the present application. DETAILED DESCRIPTION
[0045] In the financial field, major banks, as the center of financial services, need to handle more and more business. In this case, in order to ensure the security of bank and customer data, banks usually select appropriate monitoring methods for monitoring access as needed after the application systems are put into production. The monitoring access process is mainly divided into five parts: analyzing monitoring needs, monitoring configuration access, monitoring rule configuration, monitoring alarm joint debugging, and monitoring production verification. Among them, the configuration of monitoring rules is the key to abnormality detection. The appropriate threshold can detect abnormalities in time without generating too many false alarms.
[0046] However, the current monitoring thresholds are mainly configured based on the operation and maintenance experience of the system manager and their understanding of the system. This is inefficient, requires a large workload, and is easily affected by subjective factors, which reduces the accuracy of the configuration of the monitoring thresholds. Even if intelligent monitoring methods based on historical data for time series curve prediction have emerged, they also require relatively complete historical data and are more sensitive to curve changes. Intelligent monitoring can only be used when performance data is relatively complete and transactions are not easily affected by external marketing activities.
[0047] To solve the above defects, the embodiment of the present application provides a monitoring threshold recommendation method, firstly, the target alarm rule is obtained, and the dimensions and indicator parameters involved in the target alarm rule are extracted, then, according to the dimensions and indicator parameters involved in the target alarm rule, the target performance monitoring data is obtained from the database, then, according to the dimensions and indicator parameters involved in the target alarm rule, the target performance monitoring data is split and preprocessed to fill the missing values, and the preprocessed target performance monitoring data is obtained, and then the preprocessed target performance monitoring data is cleaned to obtain the cleaned target performance monitoring data, and then the cleaned target data can be estimated according to the characteristics of different indicator data, and the estimated threshold is recommended. Therefore, a reasonable monitoring threshold can be recommended to the user as a reference when configuring the monitoring indicator rule, reducing the dependence on human operation and maintenance experience and improving the configuration accuracy of the monitoring threshold. At the same time, compared with the intelligent monitoring method, a large number of false alarms are reduced.
[0048] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.
[0049] First embodiment
[0050] See also Figure 1, is a flow chart of a monitoring threshold recommendation method provided in this embodiment, the method comprising the following steps:
[0051] S101: Obtain target alarm rules, and extract dimensions and indicator parameters involved in the target alarm rules.
[0052] In this embodiment, any relevant alarm rule for recommending monitoring thresholds using this embodiment is defined as a target alarm rule. It should be noted that this application does not limit the type, content, and acquisition method of the target alarm rule. For ease of understanding, this application will subsequently use alarm rules of success rate and response time types (such as a success rate lower than 90% is abnormal data, or the response time cannot exceed 200 milliseconds, otherwise it is abnormal data, etc.) as target alarm rules for explanation. In addition, after obtaining the target alarm rule, it is necessary to first extract the dimensions and indicator parameters involved in the target alarm rule as a query basis for executing the subsequent step S102.
[0053] Among them, this application does not limit the content and extraction method of the dimensions and indicator parameters involved in the target alarm rules. For example, the dimensions and indicator parameters involved in the target alarm rules may include but are not limited to system number (syscode), performance group number (groupcode), dimension (dim) and indicator (kpi), etc.
[0054] S102: Obtain target performance monitoring data from a database according to the dimensions and indicator parameters involved in the target alarm rule.
[0055] S103: According to the dimensions and indicator parameters involved in the target alarm rule, the target performance monitoring data is preprocessed by splitting and filling missing values to obtain the preprocessed target performance monitoring data.
[0056] S104: Cleaning the preprocessed target performance monitoring data to obtain cleaned target performance monitoring data.
[0057] It should be noted that, since this application will subsequently use success rate and response time alarm rules (such as success rate below 90% is abnormal data, or response time cannot exceed 200 milliseconds, otherwise it is abnormal data, etc.) as target alarm rules for explanation, and since the amount of different types of performance data generated by the operation of the banking system every day is very large. Therefore, it is first necessary to locate the acquisition scope of the target performance monitoring data monitored by the target alarm rule in the database. Therefore, after extracting the dimensions and indicator parameters involved in the target alarm rule (such as application system number, performance group number, time range, monitoring dimension, monitoring indicator) through step S101, the target performance monitoring data can be further obtained from the database based on this series of parameters. For example, you can use these parameters to query all monitoring performance data (i.e., target performance monitoring data) within the past 7 days from the Elasticsearch (ES) library, and then split the target performance monitoring data (forming multiple groups of time series data sets) and pre-process (using the mean of historical data) to fill in missing values according to the dimensions and indicator parameters involved in the target alarm rules (such as according to date and monitoring configuration), so as to obtain multiple groups of continuous and uninterrupted data sets as pre-processed target performance monitoring data, in preparation for data cleaning in subsequent steps. It can be understood that the performance data queried from ES (i.e., target performance monitoring data) will be split according to the system number syscode, performance group number groupcode, dimension dim, and indicator kpi and placed in one data set. Among them, the process of obtaining the target performance monitoring data from the database is as follows: Figure 2 shown.
[0058] However, it should be noted that, since the data quality of each application system performance is often uneven, in this embodiment, it is necessary to first evaluate the quality of the target performance monitoring data. If the evaluation result does not meet the preset conditions, that is, the data quality is too poor, no threshold recommendation will be given. For the target performance monitoring data whose evaluation results meet the preset conditions, that is, for the part with better data quality, subsequent data processing can be further performed to obtain cleaned target performance monitoring data for executing the subsequent step S105, wherein the data processing part is mainly divided into two steps: filling missing data values and cleaning abnormal data. For example, an anomaly detection algorithm can be used to detect outliers in the preprocessed target performance monitoring data, and the detection results can be processed to remove outliers to obtain cleaned target performance monitoring data.
[0059] Specifically, the process of evaluating the quality of target performance monitoring data is mainly divided into two parts: data fluctuation evaluation and data missing evaluation. Among them, data fluctuation is divided into excessive data fluctuation and normal data. Data missing is divided into no historical data, no data on a certain day in history, data missing, intermittent data, data frequency mismatch and normal data. Except for normal data, other types of data cannot be calculated for recommended thresholds due to small data volume or data anomalies. The performance data missing situation is mainly calculated by whether the data volume points match the required data points. The required data points can be calculated by dividing the monitoring time by the monitoring frequency.
[0060] Data fluctuations can be calculated by the standard deviation of performance data. After linear normalization of performance data, the size of the data standard deviation can be used to judge and find data sets with large data fluctuations. For success rate and response time, if the data fluctuations are large, the tolerance range will be larger when formulating recommended thresholds later. Generally speaking, the fluctuation range of success rate indicators is much smaller than that of response time indicators. The success rate only fluctuates between 0 and 1, while the response time has no upper limit. The evaluation rules and performance data labels are shown in Table 1 below:
[0061]
[0062]
[0063] Table 1
[0064] Next, the data with normal data quality (i.e., the target performance monitoring data whose evaluation results meet the preset conditions) is processed and cleaned. Application monitoring performance data usually has missing data at some time points, and some glitches may occur due to special operation or business circumstances. Therefore, the data needs to be processed before it can be used. First, missing values need to be filled. The system can calculate the frequency of performance data based on historical data, and calculate the amount of data for one day by multiplying the frequency by the duration, find the missing parts, and then calculate the average of each time point for the queried historical data, and then fill the missing parts of the daily historical data with the historical average.
[0065] After completing the missing value filling, the outliers will be processed to remove the burrs in the performance data, so as to prevent these abnormal data from affecting the judgment of the normal threshold of the system. Since the performance data meets the normal distribution, the 3-Sigma anomaly detection algorithm is used in this paper to process and clean the performance data, match the outliers to remove them and replace them with the historical mean to remove the burrs in the data, so as to ensure that the recommended threshold calculated in the next step will not be affected by the abnormal data.
[0066] The 3-Sigma algorithm needs to calculate the mean and standard deviation of the time series data. Outliers are defined as data that is more than 3 times the standard deviation from the mean of the overall data. Since the normally distributed data can basically cover 99.7% of the data within this interval, the data outside the interval will be identified as outliers and deleted. Among them, the process of cleaning the pre-processed target performance monitoring data can be as follows: Figure 3 shown.
[0067] S105: Estimating rule thresholds for the cleaned target data according to different indicator data characteristics, and recommending the estimated thresholds.
[0068] In this embodiment, after obtaining the cleaned target performance monitoring data through step S104, the cleaned target data can be further estimated according to the characteristics of different indicator data, and the estimated threshold can be recommended to the person in charge for recommendation and suggestion, so as to help improve the monitoring and alarm quality.
[0069] Among them, the recommended threshold calculation part further processes the cleaned application performance data. It calculates the upper and lower limits of the thresholds for the response time and success rate indicators of different monitoring dimensions of the system according to the characteristics of different indicators, and gives the corresponding recommended values. When users configure performance indicators, for the success rate indicators of the application system, it is generally believed that if the success rate indicator is lower than a certain threshold, it means that an abnormality has occurred. When the performance alarm rule configures the success rate too low, the alarm will not be triggered when the system is abnormal. For response time indicators, if it is higher than a certain threshold, it means that the system is abnormal. When the performance alarm rule configures the response time too high, it also cannot reflect the abnormal situation of the system. Therefore, when calculating the threshold, this module believes that if the response time rule is greater than the upper limit recommended value or the success rate rule is lower than the lower limit recommended value, it is considered that the alarm rule cannot reflect the abnormal situation of the system and needs to be modified in time.
[0070] The recommended threshold calculation first needs to be judged by the data situation. If there is no historical data, no threshold recommendation is made. For historical data with good quality, the quartiles of the historical data are calculated. Quartiles refer to sorting the historical data and dividing it into four equal parts, thus generating three quartiles, of which the second quartile refers to the median, and the first quartile and the third quartile are the data at the 0.25 and 0.75 positions in the data set, respectively.
[0071] When calculating the recommended threshold, the larger the value of the response time, the higher the possibility of abnormality, so the product of the given weight and the third quartile Q3 is used as the recommended threshold. For indicators such as success rate, the smaller the value, the higher the possibility of abnormality, so the product of the first quartile Q1 and the specific weight is used as the recommended threshold. For the success rate, when the data fluctuates greatly, the minimum value Min of the success rate in the performance data is multiplied by the weight to obtain the recommended threshold. The specific recommended value calculation rules are shown in Table 2 below:
[0072] Indicator Type condition Weight Recommended threshold Response time <![CDATA[Q3≤10]]> 3 <![CDATA[3Q3]]> Response time <![CDATA[10≤Q3≤100]]> 4 <![CDATA[4Q3]]> Response time <![CDATA[Q3>100]]> 3 <![CDATA[3Q3]]> Success rate <![CDATA[Q1≥95]]> 0.95 <![CDATA[0.95Q1]]> Success rate <![CDATA[95>Q1≥90]]> 0.9 <![CDATA[0.9Q1]]> Success rate <![CDATA[Q1<90]]> 0.8 <![CDATA[0.8Q1]]> Success rate <![CDATA[The data fluctuates greatly and Q1 < 90]]> 0.9 0.9min
[0073] Table 2
[0074] In this way, by executing the above steps S101-S105, the existing (target) alarm rules are first analyzed, the dimensions and indicators involved in the rules are extracted, and then the performance monitoring data of the application system is obtained from the ES. Then, these performance data are split according to the monitoring dimensions and monitoring indicators to form multiple groups of time series models, and the missing values are filled with the mean of historical data to make them continuous and uninterrupted data. Then, these time series data are cleaned, outliers are detected using anomaly detection algorithms, and outlier processing is performed on the performance data to remove outliers with large deviations, improve data quality and reduce interference, and improve the credibility of the recommended threshold calculation. Then, the rule threshold is estimated for the cleaned data according to the characteristics of different indicator data, and finally an allowable floating error range is given for the estimated threshold. For rules with large differences between the actual set threshold and the model estimated threshold, it is considered that the set rules are unreasonable, and recommended threshold rules are given.
[0075] In summary, the monitoring threshold recommendation method provided by this embodiment first obtains the target alarm rule and extracts the dimensions and indicator parameters involved in the target alarm rule. Then, according to the dimensions and indicator parameters involved in the target alarm rule, the target performance monitoring data is obtained from the database. Then, according to the dimensions and indicator parameters involved in the target alarm rule, the target performance monitoring data is preprocessed to split and fill in missing values to obtain the preprocessed target performance monitoring data. The preprocessed target performance monitoring data is then cleaned to obtain the cleaned target performance monitoring data. Then, the rule threshold of the cleaned target data can be estimated according to the characteristics of different indicator data, and the estimated threshold can be recommended. Therefore, a reasonable monitoring threshold can be recommended to the user as a reference when configuring the monitoring indicator rule, reducing the dependence on human operation and maintenance experience and improving the configuration accuracy of the monitoring threshold.
[0076] Second embodiment
[0077] This embodiment will introduce a monitoring threshold recommendation device. For related content, please refer to the above method embodiment.
[0078] See also Figure 4 , is a schematic diagram of the composition of a monitoring threshold recommendation device provided in this embodiment, the device comprising:
[0079] The extraction unit 401 is used to obtain the target alarm rule and extract the dimensions and indicator parameters involved in the target alarm rule;
[0080] The acquisition unit 402 is used to acquire target performance monitoring data from a database according to the dimensions and indicator parameters involved in the target alarm rule;
[0081] A preprocessing unit 403 is used to preprocess the target performance monitoring data by splitting and filling missing values according to the dimensions and indicator parameters involved in the target alarm rule to obtain preprocessed target performance monitoring data;
[0082] A cleaning unit 404 is used to clean the pre-processed target performance monitoring data to obtain cleaned target performance monitoring data;
[0083] The recommendation unit 405 is used to estimate the rule threshold value of the cleaned target data according to different indicator data characteristics, and recommend the estimated threshold value.
[0084] In an implementation of this embodiment, the preprocessing unit 403 includes:
[0085] A splitting subunit is used to split the target performance monitoring data according to the dimensions and indicator parameters involved in the target alarm rule to form multiple groups of time series data sets;
[0086] The filling subunit is used to fill the missing values in the multiple groups of time series data sets with the mean value of historical data to obtain multiple groups of continuous and uninterrupted data sets as pre-processed target performance monitoring data.
[0087] In an implementation of this embodiment, the device further includes:
[0088] An evaluation unit, used to evaluate the quality of the target performance monitoring data, and obtain the target performance monitoring data whose evaluation result meets the preset conditions;
[0089] The pre-processing unit 403 is specifically used for:
[0090] According to the dimensions and indicator parameters involved in the target alarm rule, the target performance monitoring data whose evaluation results meet the preset conditions is preprocessed by splitting and filling missing values to obtain the preprocessed target performance monitoring data.
[0091] In one implementation of this embodiment, the cleaning unit 404 is specifically used for:
[0092] An outlier detection algorithm is used to detect outliers in the preprocessed target performance monitoring data, and the detection results are processed to remove outliers to obtain cleaned target performance monitoring data.
[0093] In summary, the monitoring threshold recommendation device provided by this embodiment first obtains the target alarm rule and extracts the dimensions and indicator parameters involved in the target alarm rule. Then, according to the dimensions and indicator parameters involved in the target alarm rule, the target performance monitoring data is obtained from the database. Then, according to the dimensions and indicator parameters involved in the target alarm rule, the target performance monitoring data is split and preprocessed to fill in missing values to obtain the preprocessed target performance monitoring data. The preprocessed target performance monitoring data is then cleaned to obtain the cleaned target performance monitoring data. Then, the rule threshold can be estimated for the cleaned target data according to different indicator data characteristics, and the estimated threshold can be recommended. Therefore, a reasonable monitoring threshold can be recommended to the user as a reference when configuring the monitoring indicator rule, reducing the dependence on human operation and maintenance experience and improving the configuration accuracy of the monitoring threshold.
[0094] Furthermore, an embodiment of the present application also provides a monitoring threshold recommendation device, including: a processor, a memory, and a system bus;
[0095] The processor and the memory are connected via the system bus;
[0096] The memory is used to store one or more programs, and the one or more programs include instructions. When the instructions are executed by the processor, the processor executes any one of the implementation methods of the above-mentioned monitoring threshold recommendation method.
[0097] Furthermore, an embodiment of the present application also provides a computer-readable storage medium, in which instructions are stored. When the instructions are executed on a terminal device, the terminal device executes any one of the implementation methods of the above-mentioned monitoring threshold recommendation method.
[0098] It can be known from the description of the above implementation mode that those skilled in the art can clearly understand that all or part of the steps in the above-mentioned embodiment method can be implemented by means of software plus a necessary general hardware platform. Based on such an understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product can be stored in a storage medium such as ROM / RAM, a disk, an optical disk, etc., including several instructions for enabling a computer device (which can be a personal computer, a server, or a network communication device such as a media gateway, etc.) to execute the methods described in the various embodiments of the present application or certain parts of the embodiments.
[0099] It should be noted that the various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments, and the same or similar parts between the various embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part description.
[0100] It should also be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.
[0101] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.
Claims
1. A monitoring threshold recommendation method, characterized in that: include: Obtain target alarm rules, and extract dimensions and indicator parameters involved in the target alarm rules; According to the dimensions and indicator parameters involved in the target alarm rule, target performance monitoring data is obtained from the database; According to the dimensions and indicator parameters involved in the target alarm rule, the target performance monitoring data is split and preprocessed to fill in missing values to obtain preprocessed target performance monitoring data; Cleaning the preprocessed target performance monitoring data to obtain cleaned target performance monitoring data; The cleaned target data is estimated based on different indicator data characteristics and the estimated threshold is recommended.
2. The method according to claim 1, characterized in that The preprocessing of splitting the target performance monitoring data and filling missing values according to the dimensions and indicator parameters involved in the target alarm rule to obtain the preprocessed target performance monitoring data includes: According to the dimensions and indicator parameters involved in the target alarm rule, the target performance monitoring data is split to form multiple groups of time series data sets; The missing values in the multiple sets of time series data sets are filled with the mean of historical data to obtain multiple sets of continuous and uninterrupted data sets as pre-processed target performance monitoring data.
3. The method according to claim 1, characterized in that After acquiring target performance monitoring data from a database according to the dimensions and indicator parameters involved in the target alarm rule, the method further includes: Evaluate the quality of the target performance monitoring data to obtain target performance monitoring data whose evaluation results meet preset conditions; The preprocessing of splitting the target performance monitoring data and filling missing values according to the dimensions and indicator parameters involved in the target alarm rule to obtain the preprocessed target performance monitoring data includes: According to the dimensions and indicator parameters involved in the target alarm rule, the target performance monitoring data whose evaluation results meet the preset conditions is preprocessed by splitting and filling missing values to obtain the preprocessed target performance monitoring data.
4. The method according to claim 1, characterized in that: The method according to claim 1, characterized in that the step of cleaning the preprocessed target performance monitoring data to obtain cleaned target performance monitoring data comprises: An outlier detection algorithm is used to detect outliers in the preprocessed target performance monitoring data, and the detection results are processed to remove outliers to obtain cleaned target performance monitoring data.
5. A monitoring threshold recommendation device, characterized in that: include: An extraction unit, used to obtain a target alarm rule and extract dimensions and indicator parameters involved in the target alarm rule; An acquisition unit, used to acquire target performance monitoring data from a database according to the dimensions and indicator parameters involved in the target alarm rule; A preprocessing unit, configured to preprocess the target performance monitoring data by splitting and filling missing values according to the dimensions and indicator parameters involved in the target alarm rule, so as to obtain the preprocessed target performance monitoring data; A cleaning unit, used for cleaning the pre-processed target performance monitoring data to obtain cleaned target performance monitoring data; The recommendation unit is used to estimate the rule threshold value of the cleaned target data according to different indicator data characteristics, and recommend the estimated threshold value.
6. The device according to claim 5, characterized in that The pre-processing unit comprises: A splitting subunit is used to split the target performance monitoring data according to the dimensions and indicator parameters involved in the target alarm rule to form multiple groups of time series data sets; The filling subunit is used to fill the missing values in the multiple groups of time series data sets with the mean value of historical data, so as to obtain multiple groups of continuous and uninterrupted data sets as the pre-processed target performance monitoring data.
7. The device according to claim 5, characterized in that The device also includes: An evaluation unit, used to evaluate the quality of the target performance monitoring data, and obtain the target performance monitoring data whose evaluation result meets the preset conditions; The pre-processing unit is specifically used for: According to the dimensions and indicator parameters involved in the target alarm rule, the target performance monitoring data whose evaluation results meet the preset conditions is preprocessed by splitting and filling missing values to obtain the preprocessed target performance monitoring data.
8. The device according to claim 5, characterized in that The cleaning unit is specifically used for: An outlier detection algorithm is used to detect outliers in the preprocessed target performance monitoring data, and the detection results are processed to remove outliers to obtain cleaned target performance monitoring data.
9. A monitoring threshold recommendation device, characterized in that: include: Processor, memory, system bus; The processor and the memory are connected via the system bus; The memory is used to store one or more programs, wherein the one or more programs include instructions, and when the instructions are executed by the processor, the processor executes the method according to any one of claims 1 to 4.
10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores instructions, and when the instructions are executed on a terminal device, the terminal device executes the method according to any one of claims 1 to 4.