Failure rate abnormal fluctuation detection method based on historical data

Abstract

The invention discloses a failure rate abnormal fluctuation detection method based on historical data. The method aims to solve the problems of high storage cost and low detection efficiency during detection of abnormal fluctuation of the failure rate in the prior art. Failure rate time sequence data are detected through a series of steps, the fluctuation ratio of the failure rate of the current minute to the weighted average of the previous hour is calculated, and if the fluctuation ratio exceeds a threshold value, the threshold value of a quartile algorithm is calculated to further judge abnormity; merging abnormal points and recording statistical information, and processing historical abnormal events to determine historical rules; and performing segmentation processing on the data, calculating the fluctuation ratio again, and judging whether the fluctuation is abnormal or not in combination with a quartile threshold, a historical rule, a corresponding average value and a corresponding standard deviation. The method utilizes short-time data to detect abnormity and summarize historical rules, reduces the data storage amount, avoids pulling of a large amount of data, improves the detection efficiency, can be effectively applied to calling failure rate fluctuation detection between online services, and improves the service abnormity monitoring capability.

Description

Technical Field

[0001] The present invention relates to the technical field of data detection, and in particular to a method for detecting abnormal fluctuations in failure rate based on historical data. Background Art

[0002] Time series data failure rate detection aims to detect service anomalies by detecting fluctuations in call failure rates between online services. In previous detections of abnormal failure rate fluctuations, in order to ensure detection accuracy, it is often necessary to pull data from the past ten days as a judgment benchmark to determine whether the current failure rate fluctuations have occurred regularly in history, thereby avoiding misjudging periodic fluctuations as abnormal fluctuations. However, this method has many problems. On the one hand, the storage cost is huge, and fourteen days of time series data need to be stored. In order to ensure query efficiency, these data cannot be stored using low-cost OLAP. On the other hand, the detection efficiency is low, and real-time pulling of data from the past fourteen days during the detection process increases the system's IO time and hardware cost consumption. Summary of the invention

[0003] The technical problem to be solved by the present invention is to overcome the defects of the prior art and provide a method for detecting abnormal fluctuations in failure rate based on historical data.

[0004] In order to solve the above technical problems, the present invention provides the following technical solutions:

[0005] The present invention provides a method for detecting abnormal fluctuation of failure rate based on historical data, comprising the following steps:

[0006] 1) Detect the failure rate time series data by detecting the fluctuation of the failure rate. The specific method is to detect the ratio of the failure rate of the current minute to the weighted average of the previous hour to obtain the fluctuation ratio of the current point. The formula is as follows:

[0007]

[0008] where a {i} represents the failure rate in the i-th minute, and n represents the size of the event window;

[0009] 2) If the fluctuation ratio calculated in the previous step exceeds the set threshold, the interquartile range algorithm threshold is calculated for the failure rate in the past hour. If the current value also exceeds the threshold, the current point is considered abnormal;

[0010] 3) Merge the failure rate anomalies found in step 1, connect the anomalies occurring at adjacent time points into one anomaly event, and record the failure rate indicator statistics within this anomaly time period, including the mean value and standard deviation;

[0011] 4) Remove the abnormal events in the past 14 days and use the mean shift algorithm to put the alarm events with similar start and end times in each day into the same set;

[0012] 5) For each set obtained in step 4, if the number of abnormal events in a set is greater than 7, or if the number of abnormal events in a set is greater than 2 on the same day of each week, it is considered that there is a regular fluctuation in this time period. The average value and standard deviation of each abnormal event in this set are calculated and stored as the historical rule;

[0013] 6) Divide each hour into 12 segments of 5 minutes in length, and record the mean and standard deviation of the five-minute values ​​in each segment;

[0014] 7) Divide the failure rate in each minute of the time series by the weighted average of the failure rate in the previous hour to get the fluctuation ratio at the current point. The formula is:

[0015]

[0016] where a {i} represents the failure rate in the i-th minute, and n represents the size of the event window;

[0017] 8) If the failure rate fluctuation ratio calculated in step 7 exceeds the threshold and also exceeds the quartile threshold of the value in the past hour, it is considered an anomaly;

[0018] 9) According to the time period of the current time point, take out the historical rules calculated in step 5, and calculate whether the difference between the current value and the mean in the historical rules is greater than three times the standard deviation. If it is not greater than three times the standard deviation, it is considered that the fluctuation at this time point is a periodic fluctuation and is not considered an abnormal time point. Otherwise, proceed to the next step of judgment;

[0019] 10) If the value at the current point also exceeds the mean value of the corresponding event calculated in step 6 plus three times the standard deviation, the data at this time point is considered abnormal.

[0020] As a preferred technical solution of the present invention, the quartile algorithm includes: arranging all values ​​from small to large, dividing the sequence into four equal parts, the value at the "division point" is the quartile, Q1 is set as the smaller quartile, Q3 is set as the larger quartile, Q2 is set as the median, the interquartile range is Q3-Q1, the limit value of the quartile is Q3+Q2*(Q3-Q1), and the threshold value of the quartile is:

[0021]

[0022] Where a is the link call volume value at the current point, b is the quartile limit of the quartile call volume in the previous hour, and x is the current failure rate.

[0023] Compared with the prior art, the present invention has the following beneficial effects:

[0024] 1: The present invention reduces storage costs: The present invention does not need to store fourteen days of data as a judgment basis. Instead, through an innovative detection process, it uses short-term (1 hour) data to detect anomalies and summarize historical rules, which greatly reduces the amount of data storage and reduces storage costs.

[0025] 2. The present invention improves detection efficiency: it avoids the operation of pulling the data of the past fourteen days in real time during the detection process, reduces the IO time of the system, reduces the hardware cost consumption, and at the same time, through multi-step accurate judgment, it can more efficiently detect real abnormal fluctuations. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] The accompanying drawings are used to provide a further understanding of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention and do not constitute a limitation of the present invention. In the accompanying drawings:

[0027] Figure 1 It is a schematic diagram of the process structure of the present invention; DETAILED DESCRIPTION

[0028] The preferred embodiments of the present invention are described below in conjunction with the accompanying drawings. It should be understood that the preferred embodiments described herein are only used to illustrate and explain the present invention, and are not used to limit the present invention.

[0029] Example 1

[0030] like Figure 1 As shown, the present invention provides a method for detecting abnormal fluctuations in failure rate based on historical data, comprising the following steps:

[0031] Calculate volatility ratio

[0032] The failure rate time series data is tested, and the fluctuation ratio of the current point is obtained by testing the ratio of the failure rate of the current minute to the weighted average of the previous hour. The formula is:

[0033]

[0034] where a {i} represents the failure rate in the i-th minute, and n represents the size of the event window (such as 60 minutes).

[0035] Preliminary determination of abnormal points

[0036] If the fluctuation ratio calculated in the previous step exceeds the set threshold, the failure rate in the past hour is used to calculate the interquartile range algorithm threshold. The quartile algorithm is as follows: Arrange all values ​​from small to large, divide the sequence into four equal parts, and the value at the "split point" is the quartile. Let Q1 be the smaller quartile, Q3 be the larger quartile, Q2 be the median, and the interquartile range be Q3-Q1. The limit value of the quartile is Q3+Q2*(Q3-Q1), and the threshold of the quartile is:

[0037]

[0038] Where a is the link call volume value at the current point, b is the quartile limit of the quartile call volume in the previous hour, and x is the current failure rate. If the current value also exceeds the threshold, then the current point is considered abnormal.

[0039] Merge outliers and record information

[0040] Merge the failure rate anomaly points found in step 1, connect the anomaly points occurring at adjacent time points into one anomaly event, and record the failure rate indicator statistics within this anomaly time period, including the mean value, standard deviation, etc.

[0041] Handling historical abnormal events

[0042] Remove the abnormal events in the past 14 days, and use the mean shift algorithm to put the alarm events with similar start and end times on each day into the same set.

[0043] Determine historical rules

[0044] For each set obtained in step 4, if the number of abnormal events in a set is greater than 7, or the number of occurrences on the same day of each week is greater than 2, then it is considered that there is a regular fluctuation within this time period. The average value and standard deviation of each abnormal event in this set are calculated and stored, which is called the historical rule.

[0045] Data segmentation

[0046] Each hour was divided into 12 segments of 5 minutes in length, and the mean and standard deviation of the five-minute values ​​in each segment were recorded.

[0047] Calculate the volatility ratio again (similar to step 1 but for further judgment)

[0048] The failure rate in each minute of the time series is divided by the weighted average of the failure rate in the previous hour to obtain the fluctuation ratio of the current point. The formula is the same as step 1.

[0049] Determine the abnormal point again (combined with more conditions)

[0050] If the failure rate fluctuation ratio calculated in step 7 exceeds the threshold and also exceeds the quartile threshold of the value in the past hour, it is considered an anomaly.

[0051] Compare historical rules to determine cyclical fluctuations

[0052] According to the time period of the current time point, take out the historical rules calculated in step 5, and calculate whether the difference between the current value and the mean in the historical rules is greater than three times the standard deviation. If it is not greater than three times the standard deviation, it is considered that the fluctuation at this time point is a periodic fluctuation and is not considered an abnormal time point. Otherwise, proceed to the next step of judgment.

[0053] Final abnormal judgment

[0054] If the value at the current point also exceeds the mean value of the corresponding event calculated in step 6 plus three times the standard deviation, the data at this time point is considered abnormal;

[0055] Call volume: The number of calls between service nodes a and b in a certain minute, which is the reference value for life detection

[0056] Failure rate: The ratio of the number of failures in mutual calls between service nodes a and b to the number of calls, which is the target value detected in Life 2

[0057] The quartile algorithm mentioned in step 2 and step 7 is as follows:

[0058] Arrange all the values ​​from small to large, divide the sequence into four equal parts, and the value at the "division point" is the quartile, for example 1, 3, 3, 4, 5, 6, 6, 7, 8, 8, divided into four equal parts, as shown in the table:

[0059]

[0060] The interquartile range is the difference between Q3 and Q1 in the algorithm

[0061]

[0062] The quartile limit is the Q3 value plus two times the interquartile range, that is

[0063] baseline=Q {3} +2*(Q {3} -Q {1} )

[0064] The quartile threshold is

[0065]

[0066] Where a is the link call value at the current point

[0067] b quartile limit of the quartile call volume in the previous hour

[0068] x bit current failure rate

[0069] The threshold obtained is the threshold of the algorithm.

[0070] Specifically, assume that in an online service system, there is call data between service nodes A and B. First, according to the method of the present invention, obtain the failure rate data a per minute i When calculating the volatility ratio, take the event window n = 60 minutes, and calculate the ratio of the current minute to the weighted average of the previous hour according to the formula. For example, when i = 120 minutes, calculate a 120 Compared with the first 60 minutes (a 60 to a 119 ) The fluctuation ratio of the weighted average of the failure rate. If the fluctuation ratio exceeds the set threshold, enter the quartile threshold calculation step. Assuming that the link call volume value a=100 at the current point, the quartile limit b=50 of the quartile call volume in the previous hour, and the current failure rate x=0.1, calculate the threshold according to the quartile algorithm formula and determine whether the current point is abnormal. After that, a series of operations are performed on the abnormal points, such as merging record information, processing historical abnormal events, and determining historical rules. For example, when processing historical abnormal events, the relevant alarm events are classified into sets through the mean shift algorithm, and the number of abnormal events and the occurrence patterns in the set are counted to determine the historical rules. In the actual detection process, the above operations are continuously performed on the data every minute. By comparing with the historical rules and judging the thresholds, the abnormal fluctuation points are finally accurately detected to achieve effective monitoring of service abnormalities.

[0071] Finally, it should be noted that the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art can still modify the technical solutions described in the aforementioned embodiments or replace some of the technical features therein by equivalents. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A method for detecting abnormal fluctuations in failure rate based on historical data, characterized in that: The following steps are involved: 1) Detect the failure rate time series data by detecting the fluctuation of the failure rate. The specific method is to detect the ratio of the failure rate of the current minute to the weighted average of the previous hour to obtain the fluctuation ratio of the current point. The formula is as follows: Where a{i} represents the failure rate in the i-th minute, and n represents the size of the event window; 2) If the fluctuation ratio calculated in the previous step exceeds the set threshold, the interquartile range algorithm threshold is calculated for the failure rate in the past hour. If the current value also exceeds the threshold, the current point is considered abnormal; 3) Merge the failure rate anomalies found in step 1, connect the anomalies occurring at adjacent time points into one anomaly event, and record the failure rate indicator statistics within this abnormal time period, including the mean value and standard deviation; 4) Remove the abnormal events in the past 14 days and use the mean shift algorithm to put the alarm events with similar start and end times in each day into the same set; 5) For each set obtained in step 4, if the number of abnormal events in a set is greater than 7, or if the number of abnormal events in a set is greater than 2 on the same day of each week, it is considered that there is a regular fluctuation in this time period. The average value and standard deviation of each abnormal event in this set are calculated and stored as the historical rule; 6) Divide each hour into 12 segments of 5 minutes in length, and record the mean and standard deviation of the five-minute values ​​in each segment; 7) Divide the failure rate in each minute of the time series by the weighted average of the failure rate in the previous hour to get the fluctuation ratio at the current point. The formula is: Where a{i} represents the failure rate in the i-th minute, and n represents the size of the event window; 8) If the failure rate fluctuation ratio calculated in step 7 exceeds the threshold and also exceeds the quartile threshold of the value in the past hour, it is considered an anomaly; 9) According to the time period of the current time point, take out the historical rules calculated in step 5, and calculate whether the difference between the current value and the mean in the historical rules is greater than three times the standard deviation. If it is not greater than three times the standard deviation, it is considered that the fluctuation at this time point is a periodic fluctuation and is not considered an abnormal time point. Otherwise, proceed to the next step of judgment; 10) If the value at the current point also exceeds the mean value of the corresponding event calculated in step 6 plus three times the standard deviation, the data at this time point is considered abnormal.

2. The method for detecting abnormal fluctuations in failure rate based on historical data according to claim 1, characterized in that: The quartile algorithm includes: arranging all values ​​from small to large, dividing the sequence into four equal parts, and the value at the "division point" is the quartile, assuming Q1 is the smaller quartile, Q3 is the larger quartile, Q2 is the median, the interquartile range is Q3-Q1, the quartile limit is Q3+Q2*(Q3-Q1), and the quartile threshold is: Where a is the link call volume value at the current point, b is the quartile limit of the quartile call volume in the previous hour, and x is the current failure rate.

Images