Abnormal index detection method and device

Abstract

The embodiment of the invention provides an abnormal index detection method and device which are suitable for a distributed system of a stream processing framework, and the method comprises the steps: obtaining a plurality of target indexes of the distributed system of the stream processing framework in a running process; any target index comprises a plurality of target values collected according to a time sequence in a preset time period; for any target index, performing feature extraction on the target index through a plurality of random convolution kernels to obtain feature sequence information of the target index; on the basis of dynamic time warping (DTW), clustering is carried out on the feature sequence information of the multiple target indexes, multiple clustering clusters are determined, and each clustering cluster corresponds to one index type; and for any target index, determining whether the target index is abnormal or not according to the index type of the cluster to which the target index belongs. According to the scheme, the acquisition of the system indexes is considered, and the acquisition of the business indexes of the business logic processing is also considered, so that the specific internal data processing information of the operation can be monitored.

Description

Technical Field

[0001] The present invention relates to the field of intelligent operation and maintenance technology, and in particular to an abnormal indicator detection method and device. Background Art

[0002] Under the existing distributed loosely coupled financial IT architecture, data timeliness requirements are becoming increasingly high. Business-driven real-time computing platforms and systems built on Flink play an important role in digital operations, risk dashboards, and real-time anti-fraud. In the process of exploring and building real-time computing platforms, the stability and maintainability of Flink streaming applications have become increasingly critical.

[0003] The existing Flink monitoring solution reports system indicators based on monitoring plug-ins and only provides visual display on the front-end Grafana page. However, it is unable to monitor the specific internal data processing information of the job, resulting in the inability to quickly discover and locate problems.

[0004] Therefore, how to quickly discover and locate problems is a technical problem that needs to be solved urgently. Summary of the invention

[0005] An abnormal indicator detection method and device provided in an embodiment of the present invention are used to solve the problem that the prior art cannot quickly discover and locate the abnormal indicator.

[0006] In a first aspect, an embodiment of the present invention provides an abnormal indicator detection method, which is applicable to a distributed system of a stream processing framework, comprising: obtaining multiple target indicators of the distributed system of the stream processing framework during operation; any target indicator includes multiple target values ​​collected in a time series within a preset time period; for any target indicator, feature extraction is performed on the target indicator through multiple random convolution kernels to obtain feature sequence information of the target indicator; based on dynamic time wholeing DTW, the feature sequence information of multiple target indicators is clustered to determine multiple cluster clusters, wherein each cluster cluster corresponds to an indicator type; for any target indicator, whether the target indicator is abnormal is determined according to the indicator type of the cluster cluster to which the target indicator belongs.

[0007] In the above technical solution, in the process of obtaining the indicators of the distributed system during operation, this solution not only considers obtaining the system indicators, but also considers obtaining the business indicators of the business logic processing, so that the specific internal data processing information of the job can be monitored. Based on the DTW clustering algorithm, the target indicators with similar representation shapes are clustered into the same type to reduce the complexity of mixed anomaly detection and improve the real-time performance of health monitoring.

[0008] Optionally, multiple target indicators of the distributed system of the stream processing framework during operation are obtained, including: obtaining system indicators of the distributed system of the stream processing framework during operation and business indicators at each stage of data consumption, data processing and data push based on the data processing flow.

[0009] Optionally, feature extraction is performed on the target indicator through multiple random convolution kernels to obtain feature sequence information of the target indicator, including: for any target indicator, feature extraction is performed based on multiple random convolution kernels provided by the MinRocket feature extraction algorithm to obtain the positive proportion value PPV corresponding to each random convolution kernel; and each PPV is used as the feature sequence information of the target indicator.

[0010] Optionally, based on DTW, feature sequence information of multiple target indicators is clustered to determine multiple clustering clusters, including: based on DTW, determining the distance between feature sequence information of any two target indicators, and determining the target indicator that meets a preset condition as a core point; the preset condition is that the number of target indicators whose feature sequence information meets a preset field range is greater than the preset field number; judging in turn whether the feature sequence information of each target indicator is the first core point that has not passed through an inner loop, and if so, dividing the first core point into a newly added first clustering cluster, and obtaining the feature sequence information of each target indicator within the preset field range of the first core point; traversing the feature sequence information of each target indicator within the preset field range of the first core point, judging whether the target indicator is a second core point, and if so, taking the feature sequence information of each target indicator within the preset field range of the second core point as an inner loop traversal set, and performing an inner loop until the inner loop traversal set and each target indicator within the preset field range of the first core point are all subjected to the inner loop and determining whether the clustering cluster to which they belong is the first clustering cluster; continuing to judge whether the feature sequence information of each target indicator is the first core point that has not passed through an inner loop, until the clustering cluster to which each target indicator belongs is determined.

[0011] Optionally, any target value is determined in the following manner, including: based on a sliding collection window constructed with a first collection frequency, and collecting corresponding multiple collection values ​​through multiple collection points on the sliding collection window; determining the average of the multiple collection values ​​collected by the sliding collection window as the target value corresponding to the sliding collection window; any target indicator is composed of multiple target values ​​collected by multiple sliding collection windows in a preset time period in accordance with a time series.

[0012] Optionally, the indicator type is a stable type; according to the indicator type of the cluster to which the target indicator belongs, determine whether the target indicator is abnormal, including: determine each target value in the target indicator as a predicted value in turn, and determine whether the predicted value is abnormal based on multiple first target values ​​corresponding to the first stage corresponding to the predicted value and multiple second target values ​​corresponding to the second stage, if so, the target indicator is an abnormal indicator; the first stage is the first N sliding acquisition windows whose timing is earlier than the predicted value in the target indicator; the second stage is the last M sliding acquisition windows whose timing is later than the predicted value in the target indicator, where N is a positive integer greater than 1; M is a positive integer greater than 1.

[0013] Optionally, based on multiple first target values ​​corresponding to the first stage and multiple second target values ​​corresponding to the second stage corresponding to the predicted value, determine whether the predicted value has an abnormality, including: determining the first target mean of the first stage and the first target standard deviation of the first stage based on the multiple first target values ​​of the first stage; determining the second target mean of the second stage and the second target standard deviation of the second stage based on the multiple second target values ​​of the second stage; and determining whether the predicted value has an overall increase or decrease abnormality based on the first target mean, the second target mean, the first target standard deviation and the second target standard deviation.

[0014] Optionally, it also includes: determining the reconstructed sequence mean based on the predicted value, the first target mean and the second target mean; determining the reconstructed sequence standard deviation based on the predicted value, the first target standard deviation and the second target standard deviation; determining whether there is burr interference in the predicted value based on the reconstructed sequence mean and the reconstructed sequence standard deviation.

[0015] Optionally, the indicator type is a trend type, and whether the target indicator is abnormal is determined according to the indicator type of the cluster to which the target indicator belongs, including: inputting each target value in the target indicator into an isolation forest model, and outputting the attribute result of the target indicator; the attribute result is abnormal or normal.

[0016] Optionally, the indicator type is a periodic type, and whether the target indicator is abnormal is determined according to the indicator type of the cluster to which the target indicator belongs, including: inputting the historical target value corresponding to any target indicator into the neural network prediction model, and outputting the estimated value of the target indicator; determining the growth rate of the target indicator based on the historical target value; if the target values ​​of the target indicator do not meet the second preset range, determining that the target indicator is an abnormal indicator; the second preset range is composed of the estimated value of the target indicator and the growth rate of the target indicator.

[0017] Optionally, after determining whether the target indicator is abnormal, it also includes: constructing a DAG graph based on each operator in the data processing flow; the DAG graph is divided into three levels, and the operator levels from top to bottom based on the data processing flow are the data source source operator level, the data processing Map operator level and the data sink operator level; according to any abnormal business indicator, determining the target operator corresponding to the abnormal business indicator; the target operator is one of the data source source operator, the data processing Map operator and the data sink operator; according to the target operator, according to the data processing flow, exploring whether there are abnormal business indicators or system indicators in the operators of the next level of the target operator; if there are abnormal business indicators, continue to explore the operators of the next level until it is determined that there are abnormal system indicators, and then determine the abnormal system indicators as root cause indicators; the root cause indicators are used to characterize the reasons for the abnormal business indicators.

[0018] In a second aspect, an embodiment of the present invention provides an abnormal indicator detection device, which is applicable to a distributed system of a stream processing framework, and includes: an acquisition unit, which is used to acquire multiple target indicators of the distributed system of the stream processing framework during operation; any target indicator includes multiple target values ​​collected according to a time series within a preset time period; a processing unit, which is used to extract features of any target indicator through multiple random convolution kernels to obtain feature sequence information of the target indicator; based on dynamic time wholeing DTW, the feature sequence information of the multiple target indicators is clustered to determine multiple cluster clusters, wherein each cluster cluster corresponds to an indicator type; for any target indicator, determine whether the target indicator is abnormal according to the indicator type of the cluster cluster to which the target indicator belongs.

[0019] Optionally, the processing unit is specifically used to: obtain system indicators of the distributed system of the stream processing framework during operation and business indicators at each stage of data consumption, data processing and data push based on the data processing flow.

[0020] Optionally, the processing unit is specifically used to: for any target indicator, perform feature extraction based on multiple random convolution kernels provided by the MinRocket feature extraction algorithm to obtain a positive proportion value PPV corresponding to each random convolution kernel; and use each PPV as feature sequence information of the target indicator.

[0021] Optionally, the processing unit is specifically used to: determine the distance between the feature sequence information of any two target indicators based on DTW, and determine the target indicator that meets the preset conditions as the core point; the preset condition is that the number of target indicators whose feature sequence information meets the preset field range is greater than the preset field number; judge in turn whether the feature sequence information of each target indicator is the first core point that has not passed the inner loop, and if so, divide the first core point into a newly added first clustering cluster, and obtain the feature sequence information of each target indicator within the preset field range of the first core point; traverse the feature sequence information of each target indicator within the preset field range of the first core point, and judge whether the target indicator is the second core point, and if so, use the feature sequence information of each target indicator within the preset field range of the second core point as the inner loop traversal set, and perform an inner loop until the inner loop traversal set and each target indicator within the preset field range of the first core point are all subjected to the inner loop and it is determined whether the clustering cluster to which they belong is the first clustering cluster; continue to judge whether the feature sequence information of each target indicator is the first core point that has not passed the inner loop, until the clustering cluster to which each target indicator belongs is determined.

[0022] Optionally, the acquisition unit is specifically used to: based on a sliding acquisition window constructed with a first acquisition frequency, collect corresponding multiple acquisition values ​​through multiple acquisition points on the sliding acquisition window; determine the average of the multiple acquisition values ​​collected by the sliding acquisition window as the target value corresponding to the sliding acquisition window; any one of the target indicators is composed of multiple target values ​​collected by multiple sliding acquisition windows in a preset time period in a time series.

[0023] Optionally, the indicator type is a stable type; the processing unit is specifically used to: determine each target value in the target indicator as a predicted value in turn, and determine whether the predicted value is abnormal based on multiple first target values ​​corresponding to the first stage corresponding to the predicted value and multiple second target values ​​corresponding to the second stage corresponding to the predicted value, and if so, the target indicator is an abnormal indicator; the first stage is the first N sliding acquisition windows in the target indicator whose timing is earlier than the predicted value; the second stage is the last M sliding acquisition windows in the target indicator whose timing is later than the predicted value, where N is a positive integer greater than 1; and M is a positive integer greater than 1.

[0024] Optionally, the processing unit is specifically used to: determine the first target mean and the first target standard deviation of the first stage based on multiple first target values ​​of the first stage; determine the second target mean and the second target standard deviation of the second stage based on multiple second target values ​​of the second stage; determine whether the predicted value has an overall increase or decrease abnormality based on the first target mean, the second target mean, the first target standard deviation and the second target standard deviation.

[0025] Optionally, the processing unit is also used to: determine the reconstructed sequence mean based on the predicted value, the first target mean and the second target mean; determine the reconstructed sequence standard deviation based on the predicted value, the first target standard deviation and the second target standard deviation; and determine whether the predicted value has burr interference based on the reconstructed sequence mean and the reconstructed sequence standard deviation.

[0026] Optionally, the indicator type is a trend type, and the processing unit is specifically used to: input each target value in the target indicator into an isolation forest model, and output an attribute result of the target indicator; the attribute result is abnormal or normal.

[0027] Optionally, the indicator type is a periodic type, and the processing unit is specifically used to: input the historical target value corresponding to any target indicator into the neural network prediction model, and output the estimated value of the target indicator; determine the growth rate of the target indicator based on the historical target value; if the target values ​​of the target indicator do not meet the second preset range, determine that the target indicator is an abnormal indicator; the second preset range is composed of the estimated value of the target indicator and the growth rate of the target indicator.

[0028] Optionally, the processing unit is also used to: construct a DAG graph based on each operator in the data processing flow; the DAG graph is divided into three levels, and the operator levels from top to bottom based on the data processing flow are the data source source operator level, the data processing Map operator level and the data sink operator level; according to any abnormal business indicator, determine the target operator corresponding to the abnormal business indicator; the target operator is one of the data source source operator, the data processing Map operator and the data sink operator; according to the target operator, according to the data processing flow, explore whether there are abnormal business indicators or system indicators in the operators of the next level of the target operator; if there are abnormal business indicators, continue to explore the operators of the next level until it is determined that there are abnormal system indicators, and then determine the abnormal system indicators as root cause indicators; the root cause indicators are used to characterize the reasons for the abnormality of the abnormal business indicators.

[0029] In a third aspect, an embodiment of the present invention further provides a computing device, comprising at least one processor and at least one memory, wherein the memory stores a computer program, and when the program is executed by the processor, the processor executes an abnormal indicator detection method of the first aspect above.

[0030] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium storing a computer program executable by a computer device. When the program runs on the computer device, the computer device executes an abnormal indicator detection method according to the first aspect.

[0031] In a fifth aspect, an embodiment of the present application provides a computer program product, which includes a computer program stored on a computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer device, the computer device executes the steps of any abnormal indicator detection method in the above-mentioned first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0033] Figure 1 A flow chart of an abnormal indicator detection method provided by an embodiment of the present invention;

[0034] Figure 2 A flow chart of a method for determining a target value provided by an embodiment of the present invention;

[0035] Figure 3 A schematic diagram of determining sampling points in a traditional sampling method provided by an embodiment of the present invention;

[0036] Figure 4 A flow chart of a method for determining multiple clusters provided by an embodiment of the present invention;

[0037] Figure 5 A flow chart of a method for determining whether a target indicator is abnormal provided by an embodiment of the present invention;

[0038] Figure 6 A numerical fluctuation diagram of an abnormal target indicator provided by an embodiment of the present invention;

[0039] Figure 7 Another abnormal target indicator value fluctuation diagram provided by an embodiment of the present invention;

[0040] Figure 8 A flow chart of a method for determining whether a predicted value is abnormal provided by an embodiment of the present invention;

[0041] Fig. 9 A flow chart of another method for determining whether a predicted value is abnormal provided by an embodiment of the present invention;

[0042] Fig.10 A numerical fluctuation diagram of an abnormal target indicator provided by an embodiment of the present invention;

[0043] Fig.11A flow chart of a method for determining whether a target indicator is abnormal provided by an embodiment of the present invention;

[0044] Fig.12 A numerical fluctuation diagram of an abnormal target indicator provided by an embodiment of the present invention;

[0045] Fig.13 A flow chart of a method for determining root cause indicators provided by an embodiment of the present invention;

[0046] Fig.14 A DAG structure diagram provided by an embodiment of the present invention;

[0047] Fig.15 A schematic diagram of the structure of an abnormal index detection device provided by an embodiment of the present invention;

[0048] Fig.16 A schematic diagram of the structure of a computing device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0049] In order to make the purpose, technical solution and advantages of the present invention clearer, the present invention will be further described in detail below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0050] like Figure 1 FIG. 1 is a flow chart of an abnormal indicator detection method provided by an embodiment of the present invention, and the method comprises the following steps:

[0051] Step 101, obtaining multiple target indicators of the distributed system of the stream processing framework during operation.

[0052] In an embodiment of the present invention, multiple target indicators of a distributed system of a stream processing framework are obtained during operation, wherein the target indicators include multiple target values ​​collected in a time series within a preset period of time. The target indicators are divided into system indicators and business indicators based on data processing flows at the stages of data consumption, data processing, and data push.

[0053] Step 102: for any target indicator, extract features of the target indicator through multiple random convolution kernels to obtain feature sequence information of the target indicator.

[0054] In an embodiment of the present invention, for any target indicator, feature extraction is performed based on multiple random convolution kernels provided by the MinRocket feature extraction algorithm to obtain a positive proportion value PPV corresponding to each random convolution kernel; and each PPV is used as feature sequence information of the target indicator.

[0055] Step 103 , based on dynamic time warping (DTW), cluster the characteristic sequence information of multiple target indicators to determine multiple clusters.

[0056] In the embodiment of the present invention, based on DTW, characteristic sequence information of multiple target indicators is clustered into multiple clusters, wherein each cluster corresponds to an indicator type, and the indicator types include stable type, trend type and periodic type.

[0057] Step 104: for any target indicator, determine whether the target indicator is abnormal according to the indicator type of the cluster to which the target indicator belongs.

[0058] In the embodiment of the present invention, for any target indicator, the indicator type corresponding to the target indicator is first determined, and then whether the target indicator is abnormal is determined according to the indicator type of the cluster to which the target indicator belongs.

[0059] From the above steps 101 to 104, it can be seen that in the process of obtaining the indicators of the distributed system during operation, this solution not only considers obtaining the system indicators, but also considers obtaining the business indicators of the business logic processing, so that the specific internal data processing information of the job can be monitored. Based on the DTW clustering algorithm, the target indicators with similar representation shapes are clustered into the same type to reduce the complexity of mixed anomaly detection and improve the real-time performance of health monitoring.

[0060] In the embodiment of the present invention, the target indicators include system indicators and business indicators. The system indicators focus on system performance monitoring and are used to characterize the cluster load and the usage status of host resources.

[0061] Among them, business indicators are divided into data consumption business indicators, data processing business indicators and data push business indicators.

[0062] Data consumption business indicators include data source consumption TPS indicators and consumption delay indicators. Data consumption business indicators are used to measure the consumption capacity and throughput performance of the application Source layer. The consumption TPS indicator is obtained by minute aggregation calculation based on the system indicator numRecordsout, and the consumption delay indicator is calculated based on the difference between the system time when the message arrives at the application and the event time when the message is generated. This method is adapted to the commonly used message bus RMB in the bank, and the service governance function based on the message bus call can quickly obtain the event time of message generation. This method takes into account the different statistical dimensions of the maximum receiving delay of a single message and the average receiving delay per unit time, reduces the noise impact of glitches on monitoring, and improves the monitoring of data consumption business indicators.

[0063] Data processing business indicators include link processing time consumption indicators and asynchronous thread utilization indicators. Data processing business indicators are used to evaluate whether the application processing parallelism of the Map layer is reasonable. The link processing time consumption indicator calculates the processing time from the message entering the rule chain to being pushed downstream, which includes data deserialization, external component methods, internal processing calculations, etc. The asynchronous thread utilization indicator calculates the thread in and out degree per unit time to generate a thread utilization indicator, and aggregates at the TM level to evaluate whether there is a processing bottleneck in the application work process. This solution takes into account both business processing time consumption and program resource usage.

[0064] The data push business indicator is used to measure whether there is a blockage in the downstream of Flink application message push. The data push business indicator is obtained based on the difference between the time when the message enters the cache pool and the time when the merge and send are completed.

[0065] Optionally, any target indicator includes multiple target values ​​collected in a time series within a preset period. To facilitate understanding of this solution, the following describes how to determine any target value.

[0066] like Figure 2 FIG. 1 is a flow chart of a method for determining a target value provided by an embodiment of the present invention, the method comprising the following steps:

[0067] Step 201 : Based on a sliding acquisition window constructed with a first acquisition frequency, a plurality of corresponding acquisition values ​​are acquired through a plurality of acquisition points on the sliding acquisition window.

[0068] In the embodiment of the present invention, in a traditional sampling mode, a point sampling is performed at the last moment of each minute, and the instantaneous values ​​of each target indicator at that moment are collected and reported. The instantaneous data per minute is used to represent the running status of the application within this minute, which can be seen in Figure 3 This will result in a lower sampling frequency and aggregation calculation granularity, and poor indicator representation effect in Flink's large-scale continuous data stream monitoring scenario.

[0069] In order to solve the above problems, this solution constructs a sliding acquisition window with a first acquisition frequency, and collects corresponding multiple acquisition values ​​through multiple acquisition points on the sliding acquisition window. For example, if the first acquisition frequency is 15 seconds, any sliding acquisition window is 60 seconds, and a sliding acquisition window is constructed with a collection frequency of 15 seconds, and corresponding multiple acquisition values ​​are collected through multiple acquisition points on the sliding acquisition window. Based on the sliding acquisition window, the 60-second window sliding step can include the last sampling point of the previous window, which can reduce the impact of instantaneous value glitches in traditional sampling methods, and take into account the impact of the sampling values ​​of the previous minute, which can better characterize the application operation status of each minute.

[0070] Step 202: Determine the average value of multiple collected values ​​collected by the sliding collection window as the target value corresponding to the sliding collection window.

[0071] In the embodiment of the present invention, any sliding acquisition window corresponds to multiple acquisition points, and the average of the multiple acquisition values ​​collected by the sliding acquisition window is determined as the target value corresponding to the sliding acquisition window. Any sliding acquisition window corresponds to one target value. Any target indicator is composed of multiple target values ​​collected by multiple sliding acquisition windows in a preset period according to a time series.

[0072] It can be seen from the above steps 201 to 202 that by increasing the number of sampling points in the sliding acquisition window, the first sampling point of the current sliding acquisition window is also the last sampling point of the previous sliding acquisition window. This can reduce the impact of instantaneous value glitches in traditional sampling methods and take into account the impact of the sampling values ​​of the previous minute, which can better characterize the application operation status of each minute.

[0073] Optional, since the maximum and minimum values ​​of the system indicators and business indicators in the target indicators are unknown and have different dimensions. In order to facilitate the subsequent feature extraction and clustering of the target indicators, the robustness and convergence speed. Therefore, before the feature extraction of the target indicator, the target indicator needs to be preprocessed. Specifically, in order to improve the robustness and convergence speed of MinRocket feature extraction and DBSCAN clustering, this method needs to preprocess the original indicator data. The MAXMIN normalization method will be used. After data normalization, the original indicator will map the data value to between [0,1]. The specific processing results and methods are shown in Formula 1:

[0074]

[0075] Among them, x , is the target indicator after preprocessing; x is the target indicator without preprocessing; max is the maximum value of the target indicator without preprocessing; min is the minimum value of the target indicator without preprocessing.

[0076] Optionally, after preprocessing multiple target indicators, it is necessary to perform feature extraction based on the MinRocket algorithm for multiple target indicators, and then use DBSCAN to complete indicator clustering, clustering target indicators represented by the same data into the same type, reducing the detection dimension and the complexity of the anomaly detection module. The clustered target indicators are divided into stable, cyclical and trend types according to their data forms. The following describes how to extract features from multiple target indicators.

[0077] Optionally, for any target indicator after preprocessing, feature extraction is performed based on multiple random convolution kernels provided by the MinRocket feature extraction algorithm to obtain the positive proportion value PPV corresponding to each random convolution kernel. Each PPV is used as the feature sequence information of the target indicator. Specifically, the MinRocket algorithm randomly generates a large number of convolution kernels with parameters such as different sizes, biases, and expansion systems, and constructs a filter to extract features from the target indicator. Convolution operations of shared weights, lengths, and padding of convolutional neural networks are compared. The convolution kernel generated by MinRocket has only a single-layer structure and does not learn kernel permissions. The convolution calculation cost is low, and the various dimensional features of the time series indicator can be obtained through filtering with a large number of convolution kernels. The parameters and generation method of the random convolution kernel are as follows:

[0078] Number of convolution kernels K: Increasing the number of convolution kernels can improve feature extraction accuracy, but it also brings additional convolution overhead. Based on historical experience, this method sets the K value to 10,000, taking into account both convolution accuracy and overhead.

[0079] The length of the convolution kernel l: The convolution kernel size can be randomly selected from {7, 9, 11}. This method is based on the improvement of the native Rocket algorithm and selects a fixed length of 9 to enhance the fixity of the random convolution kernel and improve the convergence rate.

[0080] Convolution kernel weight W: The convolution kernel weight can be obtained from the standard normal distribution The value is taken from the decentralized process w=WW 均值 However, since Flink target indicators are aggregated according to the component type dimension, the values ​​of the target indicators are close to each other. This method will fix the selected value {-1,2} to reduce the overhead of normal distribution random selection and decentralization.

[0081] Convolution kernel bias u: The convolution kernel bias u takes values ​​from the uniform distribution U[0,1]. By randomly taking the bias value, the linearization of the convolution output can be eliminated and the generalization ability of the model can be improved.

[0082] Convolution kernel padding: This method uses zero padding for random padding, and the probability of padding operation is 50%. The padding length is ((l kernel -1)xd) / 2, to ensure that the length of the sequence before and after convolution is consistent.

[0083] Convolution kernel expansion coefficient d: Convolution kernel expansion coefficient d = 2 x Calculated floor-to-floor, where x is drawn from a uniform distribution U[0,A]. l input and l kernelare the length of the input sequence and the convolution kernel, respectively. By setting the expansion coefficient, the receptive field of the convolution kernel is expanded, so that the convolution operation can obtain a wider range of features in the original sequence.

[0084] After the random convolution kernel set is generated, each convolution kernel will transform the target index by sliding convolution, setting the convolution kernel w with expansion coefficient d to the target index X i The result after transformation is calculated as

[0085] As shown in formula 2:

[0086]

[0087] After random convolution kernel transformation, this method performs pooling operation on each feature transformation and calculates the aggregate statistic positive value ratio ppv (proportion of positive values) as the transformed feature sequence information. This method counts the frequency of convolution kernel transformation to positive value and divides it by the convolution operation frequency cnov_num=l input -l kernel -(l kernel -1)*d+1, and finally the positive pooling ratio ppv is obtained, and the characteristic sequence information of the potential positive value in the corresponding target indicator is extracted, as shown in Formula 3:

[0088]

[0089] The following describes how to cluster the characteristic sequence information of multiple target indicators and determine multiple clusters.

[0090] like Figure 4 FIG. 1 is a flow chart of a method for determining multiple clusters provided by an embodiment of the present invention, the method comprising the following steps:

[0091] Step 401: Based on DTW, the distance between feature sequence information of any two target indicators is determined, and the target indicator that meets the preset conditions is determined as a core point.

[0092] In the embodiment of the present invention, due to the different probability filling and expansion coefficients of the random convolution kernel, the feature vectors after convolution have different scales. In order to avoid the inability to directly use the Euclidean distance to calculate the feature vector length or indicator data with different delays, this solution calculates the distance metric between samples based on dynamic time normalization DTW, which is used to process the similarity metric of time series data. It takes into account the possible nonlinear deformation of the time series on the time axis, and attempts to find an optimal alignment method between the two time series so that the cumulative distance after alignment is minimized.

[0093] For example, the characteristic sequence information of two target indicators is T = {q1, q2, ...qn}, R={c1,c2,…c m}, where the length of T is n and the length of R is m. Based on DTW, the steps to calculate the distance between T and R are as follows:

[0094] Construct a matrix D of size n×m, whose dimensions are the product of the length of sequence T and R, and the matrix element d ij = dist(q i ,c j ), where dist is the Euclidean distance calculation function.

[0095] Using dynamic programming search method, search in matrix D from d 11 to d nm All regular search paths are represented by H. According to monotonicity and continuity, it can be seen that the path in the search path H has searched point (i, j), and the next passing point can only be one of the following three cases: (i+1, j), (i+1, j+1), (i, j+1).

[0096] pass Find the path with the minimum regularization cost, where K in the denominator is mainly used to compensate for regularization paths of different lengths. 11 to d nm The shortest path calculation cumulative distance γ, the cumulative distance γ(i,j) is the point q i and c j The Euclidean distance (dist(q i ,c j )) and the sum of the minimum cumulative distance to reach the point, that is, γ(i,j) = dist(q i ,c j )+min{γ(i-1,j),γ(i-1,j-1),γ(i,j-1)}, and use this as the distance measure between time series T and R.

[0097] The target indicators that meet the preset conditions are determined as core points, wherein the preset condition is that the number of target indicators whose characteristic sequence information meets the preset field range is greater than the preset field number. Thus, the core points can be found from multiple target indicators, which makes it easier to determine the clusters according to the core points later.

[0098] Step 402 , determine in turn whether the characteristic sequence information of each target indicator is the first core point that has not passed the inner loop, if so, execute step 403 , if not, execute step 404 .

[0099] In the embodiment of the present invention, it is determined in turn whether the characteristic sequence of each target indicator is the first core point that has not been through the inner loop. If so, it means that the target indicator does not belong to any existing cluster, and a new first cluster needs to be added, and the first core point is divided into the newly added first cluster. If not, it means that the target indicator is not a core point, and it means that the target indicator belongs to the preset field range of any first core point.

[0100] Step 403: divide the first core point into a newly added first cluster, and obtain feature sequence information of each target indicator within a preset domain of the first core point.

[0101] In an embodiment of the present invention, the first core point is divided into a newly added first cluster, and characteristic sequence information of each target indicator within the preset domain of the first core point is obtained, so as to facilitate subsequent determination of whether a second core point exists within the preset domain of the first core point. If so, the preset domain of the first core point can be expanded by the preset domain of the second core point, thereby expanding the first cluster.

[0102] Step 404, end.

[0103] In the embodiment of the present invention, since the target indicator is not a core point, there is no need to perform subsequent steps.

[0104] Step 405 , traverse the feature sequence information of each target indicator within the preset domain of the first core point, and determine whether the target indicator is the second core point. If so, execute step 406 , if not, execute step 407 .

[0105] In the embodiment of the present invention, each first core point is determined through the above steps, and for any core point, the characteristic sequence information of each target indicator within the preset domain of the first core point is traversed to determine whether the target indicator is a second core point. If so, it means that the second core point exists within the preset domain of the first core point, so that the preset domain of the second core point can be expanded to the first cluster corresponding to the first core point. If not, it means that the second core point does not exist within the preset domain of the first core point.

[0106] Step 406, taking the characteristic sequence information of each target indicator within the preset domain of the second core point as the inner loop traversal set, and performing the inner loop until the inner loop traversal set and each target indicator within the preset domain of the first core point have all passed through the inner loop and it is determined whether the cluster to which they belong is the first cluster.

[0107] In the embodiment of the present invention, since the second core point is a target indicator within the preset domain of the first core point, in order to expand the first cluster corresponding to the first core point, the characteristic sequence information of each target indicator within the preset domain of the second core point is used as the inner loop traversal set, and if the target indicator within the preset domain of the second core point already belongs to the second cluster, then the cluster to which the target indicator belongs is determined to be the second cluster. If the target indicator within the preset domain of the second core point does not belong to a cluster, then the cluster to which each target indicator within the preset domain of the second core point belongs can be determined to be the first cluster.

[0108] Then continue to traverse the characteristic sequence information of each target indicator within the preset domain of the first core point until each target indicator has passed the inner loop and the cluster to which it belongs is determined.

[0109] Step 407, adding the target indicator to the inner loop traversal set, and performing the inner loop until all the target indicators in the inner loop traversal set and the preset domain of the first core point are subjected to the inner loop and determining whether the cluster to which they belong is the first cluster.

[0110] In the embodiment of the present invention, since the target indicator is not the second core point, the target indicator is only added to the inner loop traversal set and the inner loop is performed until each target indicator of the inner loop traversal set has passed the inner loop and the cluster to which it belongs is determined.

[0111] Step 408 , continue to determine whether the characteristic sequence information of each target indicator is the first core point that has not passed the inner loop, until the cluster to which each target indicator belongs is determined.

[0112] In the embodiment of the present invention, it is continuously determined whether the characteristic sequence information of each target indicator is the first core point that has not passed the inner loop, thereby realizing the cluster to which each target indicator belongs.

[0113] From the above steps 401 to 408, it can be seen that DTW can find a better alignment method between the characteristic sequence information of the target indicators to measure the distance and determine a nonlinear matching path, so that the characteristic sequence information of the two target indicators can more reasonably measure their actual similarity even if there is a time misalignment when the overall form is similar. By clustering each target indicator with DTW combined with the outer loop and the inner loop, the complexity of the hybrid anomaly detection module can be reduced and the real-time performance of health monitoring can be improved.

[0114] In an embodiment of the present invention, the target indicator is clustered based on MinRocket feature extraction and DTW combined with DBSCAN clustering method to determine the indicator type of the target indicator. The indicator types are divided into stable type, trend type and periodic type. The methods for judging whether the target indicators of different indicator types are abnormal are different. In order to facilitate the understanding of this solution, the following describes how to determine whether the target indicator is abnormal when the indicator type is stable.

[0115] like Figure 5 FIG. 1 is a flow chart of a method for determining whether a target indicator is abnormal provided by an embodiment of the present invention. The method comprises the following steps:

[0116] Step 501, determine each target value in the target indicator as a predicted value in turn, and determine whether the predicted value has an abnormality based on multiple first target values ​​corresponding to the first stage corresponding to the predicted value and multiple second target values ​​corresponding to the second stage. If so, execute step 502, if not, execute step 503.

[0117] In the embodiment of the present invention, the target indicator of the stable type has a weak correlation with the time series, and the fluctuation range of the target indicator is not large, mainly the overall rise or fall abnormality. The abnormal target indicator characterization can be mainly divided into mean shift and standard deviation shift. Figure 6 and Figure 7 , Figure 6 Schematic diagram of the abnormal target indicator being mean shift. Figure 7 Schematic diagram of the abnormal target indicator being the standard deviation shift.

[0118] The target indicators include multiple target values ​​collected in time series within a preset period of time. Figure 6 and Figure 7 It can be seen that if there is an abnormal target value in the target indicator, the target indicator is determined to be an abnormal target indicator.

[0119] Determine each target value in the target indicator as the predicted value in turn, according to Figure 6 and Figure 7 It can be seen that it is necessary to combine the target value of the preceding order and the target value of the succeeding order of the predicted value to determine whether the predicted value is abnormal. Specifically, according to the multiple first target values ​​corresponding to the first stage corresponding to the predicted value and the multiple second target values ​​corresponding to the second stage, it is determined whether the predicted value is abnormal, where the first stage is the first N sliding acquisition windows whose timing is earlier than the predicted value in the target indicator, and the second stage is the last M sliding acquisition windows whose timing is later than the predicted value in the target indicator, where N is a positive integer greater than 1, and M is a positive integer greater than 1, where N and M can be the same value or different values, which are not limited here.

[0120] To help you understand this scenario, here's how to determine whether a predicted value is abnormal.

[0121] like Figure 8 FIG. 1 is a flow chart of a method for determining whether a predicted value is abnormal provided by an embodiment of the present invention, the method comprising the following steps:

[0122] Step 801, determining a first target mean value and a first target standard deviation of the first stage according to a plurality of first target values ​​of the first stage.

[0123] In the embodiment of the present invention, by combining the first target value of the first stage and the second target value of the second stage, it is possible to more accurately determine whether the predicted value is abnormal. First, it is necessary to determine the first target mean of the first stage and the first target standard deviation of the first stage based on multiple first target values ​​of the first stage, so as to facilitate the subsequent determination of whether the predicted value is abnormal based on the first target mean of the first stage and the first target standard deviation of the first stage.

[0124] Step 802, determining a second target mean value and a second target standard deviation of the second stage according to a plurality of second target values ​​of the second stage.

[0125] In an embodiment of the present invention, the second target mean and the second target standard deviation of the second stage are determined based on multiple second target values ​​of the second stage, so as to facilitate the subsequent more accurate determination of whether there is an abnormality in the predicted value based on the second target mean and the second target standard deviation of the second stage and the first target mean and the first target standard deviation of the first stage.

[0126] Step 803, determining whether there is an overall increase or decrease abnormality in the predicted value based on the first target mean, the second target mean, the first target standard deviation, and the second target standard deviation.

[0127] In the embodiment of the present invention, the types of abnormalities in the predicted values ​​can be divided into overall increase and decrease abnormalities. The following describes how to determine the abnormality of the predicted values ​​being overall increased.

[0128] In one possible case, when the first target mean of the first stage is in a normal state and is smaller than the second target mean of the second stage, the predicted value surges and is larger than the first target mean of the first stage, and there is no obvious fluctuation in the first target standard deviation of the first stage and the second target standard deviation of the second stage, then it means that the predicted value is abnormal and the mean of the predicted value has an overall elevated abnormality.

[0129] In another possible situation, when the first target standard deviation of the first stage is in a normal state and is smaller than the second target standard deviation of the second stage, the predicted value surges and is larger than the first target mean of the first stage, and there is no obvious fluctuation between the first target mean of the first stage and the second target mean of the second stage, then it means that the predicted value is abnormal, and the standard deviation of the predicted value has an overall elevated abnormal problem.

[0130] The following describes how to determine if there is an abnormal decrease in the predicted value.

[0131] In one possible case, when the first target mean of the first stage is in a normal state and is greater than the second target mean of the second stage, the predicted value drops sharply and is less than the first target mean of the first stage, and there is no obvious fluctuation between the first target standard deviation of the first stage and the second target standard deviation of the second stage, then it means that the predicted value is abnormal, and the mean of the predicted value has an abnormal decline.

[0132] In another possible case, when the first target standard deviation of the first stage is in a normal state and is smaller than the second target standard deviation of the second stage, the predicted value drops sharply and is smaller than the first target mean of the first stage, and there is no obvious fluctuation between the first target mean of the first stage and the second target mean of the second stage, then it means that the predicted value is abnormal, and the standard deviation of the predicted value has an abnormal decline.

[0133] It can be seen from the above steps 801 to 803 that, considering that the stable target indicator has a weak correlation with the time series, the fluctuation range of the indicator is not very large, and it is mainly an overall rise and fall anomaly. Therefore, based on the comparison between the numerical value of the predicted value and the target value of the front and rear sliding acquisition windows, it can be more accurately determined at which moment in the target indicator the target value has an abnormal change.

[0134] Step 502: The target indicator is an abnormal indicator.

[0135] Step 503: The target indicator is a normal indicator.

[0136] It can be seen from the above steps 501 to 503 that the fluctuation range of the indicator data is not large. Based on the sliding window and data statistics, the overall increase anomaly detection of the indicator is performed, so as to more accurately determine whether the target indicator is abnormal.

[0137] like Fig. 9 FIG. 1 is a flow chart of another method for determining whether a predicted value is abnormal provided by an embodiment of the present invention, the method comprising the following steps:

[0138] Step 901, determining the reconstructed sequence mean according to the predicted value, the first target mean and the second target mean.

[0139] In the embodiment of the present invention, μ w1 is the mean of the previous window, μ w2 is the mean of the rear window, s w1 is the standard deviation of the previous window, s w2 is the standard deviation of the back window, v t1 To determine the index value at the time, Q1 is the first quartile, Q3 is the third quartile, and IQR is the interquartile range, that is, the difference between the third quartile and the first quartile.

[0140] According to the predicted value, the first target mean and the second target mean, the reconstructed sequence mean can be determined by formula 4.

[0141]

[0142] where s 均值 is the mean of the reconstructed sequence; v t1 is the predicted value; μ w1 is the first target mean; μ w2 is the second target mean.

[0143] Step 902: Determine the reconstructed sequence standard deviation according to the predicted value, the first target standard deviation and the second target standard deviation.

[0144] In the embodiment of the present invention, the reconstructed sequence standard deviation can be determined by formula 5 according to the predicted value, the first target standard deviation and the second target standard deviation.

[0145]

[0146] where s 标准差 is the standard deviation of the reconstructed sequence; v t1 is the predicted value; μ w1 is the first target mean; μ w2 is the second target mean.

[0147] Step 903: Determine whether there is burr interference in the predicted value according to the reconstructed sequence mean and the reconstructed sequence standard deviation.

[0148] In the embodiment of the present invention, the reconstructed sequence is determined according to the reconstructed sequence mean and the reconstructed sequence standard deviation, wherein the normal range of the reconstructed sequence s is [Q1-c*IQR, Q3+c*IQR], wherein Q1 is the first quartile, Q3 is the third quartile, and IQR is the interquartile range, i.e., the difference between the third quartile and the first quartile. If the reconstructed sequence s of the predicted value is not within the normal range, it means that the predicted value has a burr interference anomaly.

[0149] It can be seen from the above steps 901 to 903 that by constructing a reconstructed sequence, it is possible to more accurately determine whether the predicted value has burr interference anomalies according to the reconstructed sequence standard deviation and the reconstructed sequence mean.

[0150] Optionally, the indicator type is trend type. According to the indicator type of the cluster to which the target indicator belongs, the target values ​​in the target indicator are input into the isolation forest model, and the attribute results of the target indicator are output; the attribute results are abnormal or normal. Specifically, for a target indicator with a trend type indicator type, the target indicator continues to show an upward (or downward) trend in a certain period of time, and the abnormal scenario is mainly a local regional trend. The numerical growth trend of the target indicator at the abnormal moment may be in the correct direction, but it does not conform to the slope trend growth amplitude. The abnormal target indicator is characterized as follows: Fig.10 As shown in the figure, this scheme combines the isolation forest anomaly detection algorithm. First, historical data is used as training samples. The sample division basis is randomly selected from the training data (a value X is randomly selected between the maximum and minimum values) to create a binary search tree (iTree), and the binary tree forest (iForest) is iteratively constructed repeatedly; then the abnormality of the target indicator is predicted, the binary search tree is traversed in order, and the path length of the target indicator in each iTree is recorded, that is, the path length h(x) from the root node to the leaf node; finally, the expected value E(h(x)) and variance S(h(x)) of each path length of the target indicator are calculated using statistical methods, and E(h(x))→0, S(h(x))→1 are judged as abnormal values.

[0151] like Fig.11 FIG. 1 is a flow chart of a method for determining whether a target indicator is abnormal provided by an embodiment of the present invention. The method comprises the following steps:

[0152] Step 1101, input the historical target value corresponding to any target indicator into the neural network prediction model, and output the estimated value of the target indicator.

[0153] In the embodiment of the present invention, the target indicator of the periodic type is strongly correlated with the time series, and the target indicator has high and low peaks, mainly because the target values ​​in the target indicator have a periodic pattern. When the target value of the target indicator has a periodic pattern abnormality, the target value at the abnormal time is in the normal data interval, but does not conform to the law of periodic fluctuations. Fig.12 .

[0154] The historical target value corresponding to any target indicator is input into the neural network prediction model, and the estimated value of the target indicator is output, where the estimated value is the value estimated by the neural network prediction model based on the historical target value of the target indicator.

[0155] Step 1102, determining the growth rate of the target indicator based on the historical target value.

[0156] In the embodiment of the present invention, by determining the growth rate of the target indicator according to the historical target value, the periodic fluctuation law of the target indicator can be determined, which facilitates the subsequent determination of whether the target indicator is abnormal according to the growth rate of the target indicator.

[0157] Step 1103: If each target value of the target indicator does not satisfy the second preset range, the target indicator is determined to be an abnormal indicator.

[0158] In the embodiment of the present invention, the second preset range is composed of the estimated value of the target indicator and the growth rate of the target indicator. If the target values ​​of the target indicator do not meet the second preset range, it means that the target indicator does not conform to the periodic fluctuation law, and the target indicator can be determined to be an abnormal indicator.

[0159] It can be seen from the above steps 1101 to 1103 that the second preset range of the target value at the current moment is generated by the dynamic threshold setting method, so that the target indicator that does not conform to the periodic fluctuation law can be more accurately regarded as an abnormal indicator.

[0160] like Fig.13 FIG. 1 is a flow chart of a method for determining a root cause indicator provided by an embodiment of the present invention, the method comprising the following steps:

[0161] Step 1301, construct a DAG graph based on each operator in the data processing flow.

[0162] In the embodiment of the present invention, in daily operation and maintenance monitoring, this solution will focus on business indicator anomalies, and changes in system indicators will only serve as a basis for analyzing the root causes of business indicator anomalies, so as to avoid a large number of false alarms caused by the jitter of system indicators of nodes. Business indicator anomalies are often reflected in the application processing entrance, and the root cause of the anomaly is transmitted to the entrance by the abnormality of the downstream data processing node through back pressure. In order to improve the speed of problem locating, this solution uses the REST API developed by Flink to obtain the DAG structure diagram of the data processing flow and the work process TM information of the data processing, and combines the business anomaly indicators returned by the hybrid anomaly detection to trigger the system indicator anomaly detection of the upstream and downstream data processing stages to determine the root cause indicators. Therefore, firstly, a DAG graph is constructed based on each operator in the data processing flow. The DAG graph is divided into three levels. The operator levels from top to bottom based on the data processing flow are the data source source operator level, the data processing Map operator level and the data sink operator level. Please refer to Fig.14 .

[0163] Step 1302: According to any abnormal business indicator, determine a target operator corresponding to the abnormal business indicator.

[0164] In the embodiment of the present invention, according to any abnormal business indicator, a target operator corresponding to the abnormal business indicator is determined, wherein the target operator is one of a data source operator, a data processing Map operator, and a data sink operator.

[0165] For example, if the abnormal business indicator is business indicator A, it is determined that the target operator corresponding to business indicator A is the data source operator.

[0166] Step 1303 , according to the target operator and the data processing direction, check whether there are any abnormal business indicators or system indicators in the operators at the next level of the target operator.

[0167] In the embodiment of the present invention, according to the target operator, Fig.14 In the data processing flow, check whether there are abnormal business indicators or system indicators in the operators at the next level of the target operator. If there are abnormal business indicators in the operators at the next level of the target operator, the business indicators are often reflected in the application processing entrance, and the business indicators are not the root cause indicators, so it is necessary to check further. If the operators at the next level of the target operator are system indicators, the system indicators are determined to be the root cause indicators.

[0168] Step 1304: If there are abnormal business indicators, continue to explore the operators at the next level until it is determined that there are abnormal system indicators, and then determine the abnormal system indicators as root cause indicators.

[0169] In the embodiment of the present invention, if there is an abnormal business indicator, it is necessary to continue to explore the next level of operators until it is determined that there is an abnormal system indicator, wherein the system indicator is the root cause indicator.

[0170] It can be seen from the above steps 1301 to 1304 that by constructing a DAG graph through abnormal target indicators, and by performing a top-down analysis on the DAG graph, it is possible to locate the most downstream root cause indicator, thereby improving the efficiency of abnormal indicator detection.

[0171] Based on the same technical concept, the embodiment of the present application provides an abnormal index detection device, such as Fig.15As shown, the device 1500 is suitable for a distributed system of a stream processing framework, and includes: an acquisition unit 1501, used to acquire multiple target indicators of the distributed system of the stream processing framework during operation; any target indicator includes multiple target values ​​collected in a time series within a preset time period; a processing unit 1502, used to extract features of any target indicator through multiple random convolution kernels to obtain feature sequence information of the target indicator; based on dynamic time wholeing DTW, cluster the feature sequence information of the multiple target indicators to determine multiple cluster clusters, wherein each cluster cluster corresponds to an indicator type; for any target indicator, determine whether the target indicator is abnormal according to the indicator type of the cluster cluster to which the target indicator belongs.

[0172] Optionally, the processing unit 1502 is specifically used to: obtain system indicators of the distributed system of the stream processing framework during operation and business indicators at each stage of data consumption, data processing and data push based on the data processing flow.

[0173] Optionally, the processing unit 1502 is specifically used to: for any target indicator, perform feature extraction based on multiple random convolution kernels provided by the MinRocket feature extraction algorithm to obtain a positive proportion value PPV corresponding to each random convolution kernel; and use each PPV as feature sequence information of the target indicator.

[0174] Optionally, the processing unit 1502 is specifically used to: determine the distance between the feature sequence information of any two target indicators based on DTW, and determine the target indicator that meets the preset condition as the core point; the preset condition is that the number of target indicators whose feature sequence information meets the preset field range is greater than the preset field number; judge in turn whether the feature sequence information of each target indicator is the first core point that has not passed the inner loop, and if so, divide the first core point into a newly added first clustering cluster, and obtain the feature sequence information of each target indicator within the preset field range of the first core point; traverse the feature sequence information of each target indicator within the preset field range of the first core point, and judge whether the target indicator is the second core point, and if so, use the feature sequence information of each target indicator within the preset field range of the second core point as the inner loop traversal set, and perform an inner loop until the inner loop traversal set and each target indicator within the preset field range of the first core point are all subjected to the inner loop and it is determined whether the clustering cluster to which they belong is the first clustering cluster; continue to judge whether the feature sequence information of each target indicator is the first core point that has not passed the inner loop until the clustering cluster to which each target indicator belongs is determined.

[0175] Optionally, the acquisition unit is specifically used to: based on a sliding acquisition window constructed with a first acquisition frequency, collect corresponding multiple acquisition values ​​through multiple acquisition points on the sliding acquisition window; determine the average of the multiple acquisition values ​​collected by the sliding acquisition window as the target value corresponding to the sliding acquisition window; any one of the target indicators is composed of multiple target values ​​collected by multiple sliding acquisition windows in a preset time period in a time series.

[0176] Optionally, the indicator type is a stable type; the processing unit 1502 is specifically used to: determine each target value in the target indicator as a predicted value in turn, and determine whether the predicted value is abnormal based on multiple first target values ​​corresponding to the first stage corresponding to the predicted value and multiple second target values ​​corresponding to the second stage corresponding to the predicted value, and if so, the target indicator is an abnormal indicator; the first stage is the first N sliding acquisition windows in the target indicator whose timing is earlier than the predicted value; the second stage is the last M sliding acquisition windows in the target indicator whose timing is later than the predicted value, where N is a positive integer greater than 1; and M is a positive integer greater than 1.

[0177] Optionally, processing unit 1502 is specifically used to: determine the first target mean and the first target standard deviation of the first stage based on multiple first target values ​​of the first stage; determine the second target mean and the second target standard deviation of the second stage based on multiple second target values ​​of the second stage; determine whether the predicted value has an overall increase or decrease abnormality based on the first target mean, the second target mean, the first target standard deviation and the second target standard deviation.

[0178] Optionally, the processing unit 1502 is further used to: determine a reconstructed sequence mean based on the predicted value, the first target mean and the second target mean; determine a reconstructed sequence standard deviation based on the predicted value, the first target standard deviation and the second target standard deviation; and determine whether the predicted value has burr interference based on the reconstructed sequence mean and the reconstructed sequence standard deviation.

[0179] Optionally, the indicator type is a trend type, and the processing unit 1502 is specifically used to: input each target value in the target indicator into an isolation forest model, and output an attribute result of the target indicator; the attribute result is abnormal or normal.

[0180] Optionally, the indicator type is a periodic type, and the processing unit 1502 is specifically used to: input the historical target value corresponding to any target indicator into the neural network prediction model, and output the estimated value of the target indicator; determine the growth rate of the target indicator based on the historical target value; if the target values ​​of the target indicator do not meet the second preset range, determine that the target indicator is an abnormal indicator; the second preset range is composed of the estimated value of the target indicator and the growth rate of the target indicator.

[0181] Optionally, the processing unit 1502 is also used to: construct a DAG graph based on each operator in the data processing flow; the DAG graph is divided into three levels, and the operator levels from top to bottom based on the data processing flow are the data source source operator level, the data processing Map operator level and the data sink operator level; according to any abnormal business indicator, determine the target operator corresponding to the abnormal business indicator; the target operator is one of the data source source operator, the data processing Map operator and the data sink operator; according to the target operator, according to the data processing flow, explore whether there are abnormal business indicators or system indicators in the operators of the next level of the target operator; if there are abnormal business indicators, continue to explore the operators of the next level until it is determined that there are abnormal system indicators, and then determine the abnormal system indicators as root cause indicators; the root cause indicators are used to characterize the reasons for the abnormality of the abnormal business indicators.

[0182] Based on the same technical concept, the present application embodiment provides a computing device 1600, such as Fig.16 As shown, it includes at least one processor 1601 and a memory 1602 connected to the at least one processor. The specific connection medium between the processor 1601 and the memory 1602 is not limited in the embodiment of the present application. Fig.16 For example, the processor 1601 and the memory 1602 are connected via a bus. The bus can be divided into an address bus, a data bus, a control bus, etc.

[0183] In the embodiment of the present application, the memory 1602 stores instructions that can be executed by at least one processor 1601, and the at least one processor 1601 can perform the above-mentioned abnormal indicator detection method steps by executing the instructions stored in the memory 1602.

[0184] Among them, the processor 1601 is the control center of the computing device, which can use various interfaces and lines to connect various parts of the computing device, and realize the processing of the abnormal indicator detection method by running or executing instructions stored in the memory 1602 and calling data stored in the memory 1602.

[0185] Optionally, the processor 1601 may include one or more processing units, and the processor 1601 may integrate an application processor and a modem processor, wherein the application processor mainly processes an operating system, a user interface, and application programs, and the modem processor mainly processes wireless communications. It is understood that the modem processor may also be integrated into the processor 1601. In some embodiments, the processor 1601 and the memory 1602 may be implemented on the same chip, and in some embodiments, they may also be implemented separately on separate chips.

[0186] Processor 1601 can be a general-purpose processor, such as a central processing unit (CPU), a digital signal processor, an application-specific integrated circuit (ASIC), a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component, and can implement or execute the various methods, steps and logic block diagrams disclosed in the embodiments of the present application. A general-purpose processor can be a microprocessor or any conventional processor, etc. The steps of the method disclosed in the embodiments of the present application can be directly embodied as a hardware processor for execution, or can be executed by a combination of hardware and software modules in the processor.

[0187] Memory 1602, as a non-volatile computer-readable storage medium, can be used to store non-volatile software programs, non-volatile computer executable programs and modules. Memory 1602 may include at least one type of storage medium, such as flash memory, hard disk, multimedia card, card-type memory, random access memory (Random Access Memory, RAM), static random access memory (Static Random Access Memory, SRAM), programmable read-only memory (Programmable Read Only Memory, PROM), read-only memory (Read Only Memory, ROM), electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory, EEPROM), magnetic memory, disk, optical disk, etc. Memory 1602 is any other medium that can be used to carry or store a desired program code in the form of an instruction or data structure and can be accessed by a computer device, but is not limited thereto. The memory 1602 in the embodiment of the present application can also be a circuit or any other device that can realize a storage function, for storing program instructions and / or data.

[0188] Based on the same inventive concept, an embodiment of the present application provides a computer-readable storage medium, which stores a computer program that can be executed by a computer device. When the program runs on the computer device, the computer device executes the steps of the above-mentioned abnormal indicator detection method.

[0189] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0190] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0191] These computer program instructions may also be stored in a computer readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0192] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0193] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A method for detecting abnormal indicators, characterized in that: Distributed systems suitable for stream processing frameworks, including: Acquire multiple target indicators of the distributed system of the stream processing framework during operation; any target indicator includes multiple target values ​​collected in a time series within a preset period; For any target indicator, feature extraction is performed on the target indicator through a plurality of random convolution kernels to obtain feature sequence information of the target indicator; Based on dynamic time warping (DTW), the characteristic sequence information of the plurality of target indicators is clustered to determine a plurality of clusters, wherein each cluster corresponds to an indicator type; For any target indicator, whether the target indicator is abnormal is determined according to the indicator type of the cluster to which the target indicator belongs.

2. The method according to claim 1, characterized in that Obtain multiple target indicators of the distributed system of the stream processing framework during operation, including: Obtain system indicators of the distributed system of the stream processing framework during operation and business indicators at each stage of data consumption, data processing and data push based on the data processing flow.

3. The method according to claim 1, characterized in that The target indicator is subjected to feature extraction through a plurality of random convolution kernels to obtain feature sequence information of the target indicator, including: For any target indicator, feature extraction is performed based on multiple random convolution kernels provided by the MinRocket feature extraction algorithm to obtain the positive proportion value PPV corresponding to each random convolution kernel; each PPV is used as the feature sequence information of the target indicator.

4. The method according to claim 1, characterized in that Based on dynamic time warping (DTW), the characteristic sequence information of the multiple target indicators is clustered to determine multiple cluster clusters, including: Based on DTW, the distance between the characteristic sequence information of any two target indicators is determined, and the target indicator that meets the preset condition is determined as the core point; the preset condition is that the number of target indicators whose characteristic sequence information of the target indicator meets the preset field range is greater than the preset field number; It is judged in turn whether the characteristic sequence information of each target indicator is a first core point that has not been through the inner loop. If so, the first core point is divided into a newly added first cluster, and the characteristic sequence information of each target indicator within the preset domain of the first core point is obtained; Traversing the characteristic sequence information of each target indicator within the preset domain of the first core point, determining whether the target indicator is the second core point, and if so, using the characteristic sequence information of each target indicator within the preset domain of the second core point as the inner loop traversal set, and performing the inner loop until the inner loop traversal set and each target indicator within the preset domain of the first core point are all subjected to the inner loop and determining whether the cluster to which they belong is the first cluster; Continue to judge whether the characteristic sequence information of each target indicator is the first core point that has not passed the inner loop, until the cluster to which each target indicator belongs is determined.

5. The method according to claim 1, characterized in that Determine any target value by: Based on a sliding acquisition window constructed at a first acquisition frequency, a corresponding plurality of acquisition values ​​are acquired through a plurality of acquisition points on the sliding acquisition window; The average of the multiple collection values ​​collected by the sliding collection window is determined as the target value corresponding to the sliding collection window; any one of the target indicators is composed of multiple target values ​​collected by multiple sliding collection windows in a preset time period according to a time series.

6. The method according to any one of claims 1 to 5, characterized in that: The indicator type is stable; according to the indicator type of the cluster to which the target indicator belongs, determining whether the target indicator is abnormal includes: Determine each target value in the target indicator as a predicted value in turn, and determine whether the predicted value is abnormal based on multiple first target values ​​corresponding to the first stage corresponding to the predicted value and multiple second target values ​​corresponding to the second stage. If so, the target indicator is an abnormal indicator; the first stage is the first N sliding acquisition windows in the target indicator whose timing is earlier than the predicted value; the second stage is the last M sliding acquisition windows in the target indicator whose timing is later than the predicted value, where N is a positive integer greater than 1; and M is a positive integer greater than 1.

7. The method according to claim 6, characterized in that Determining whether the predicted value is abnormal according to a plurality of first target values ​​corresponding to the first stage corresponding to the predicted value and a plurality of second target values ​​corresponding to the second stage includes: Determine a first target mean value and a first target standard deviation of the first stage according to the plurality of first target values ​​of the first stage; Determining a second target mean value of the second stage and a second target standard deviation of the second stage according to the plurality of second target values ​​of the second stage; Determine whether the predicted value has an overall increase or decrease abnormality based on the first target mean, the second target mean, the first target standard deviation, and the second target standard deviation.

8. The method according to claim 7, characterized in that Also includes: Determining a reconstructed sequence mean according to the predicted value, the first target mean, and the second target mean; Determining a reconstructed sequence standard deviation according to the predicted value, the first target standard deviation, and the second target standard deviation; It is determined whether the predicted value has burr interference according to the reconstructed sequence mean and the reconstructed sequence standard deviation.

9. The method according to any one of claims 1 to 5, characterized in that: The indicator type is a trend type. According to the indicator type of the cluster to which the target indicator belongs, determining whether the target indicator is abnormal includes: Input each target value in the target indicator into the isolation forest model, and output the attribute result of the target indicator; the attribute result is abnormal or normal.

10. The method according to any one of claims 1 to 5, characterized in that: The indicator type is a periodic type. According to the indicator type of the cluster to which the target indicator belongs, determining whether the target indicator is abnormal includes: Input the historical target value corresponding to any target indicator into the neural network prediction model, and output the estimated value of the target indicator; Determining the growth rate of the target indicator according to the historical target value; If each target value of the target indicator does not satisfy a second preset range, the target indicator is determined to be an abnormal indicator; the second preset range is composed of an estimated value of the target indicator and a growth rate of the target indicator.

11. The method according to any one of claims 1 to 5, characterized in that: After determining whether the target indicator is abnormal, the method further includes: A DAG graph is constructed based on each operator in the data processing flow; the DAG graph is divided into three levels, and the operator levels from top to bottom based on the data processing flow are the data source source operator level, the data processing Map operator level and the data sink operator level; According to any abnormal business indicator, determine the target operator corresponding to the abnormal business indicator; the target operator is one of the data source source operator, the data processing Map operator and the data sink operator; According to the target operator and the data processing direction, check whether there are abnormal business indicators or system indicators in the operators at the next level of the target operator; If there is an abnormal business indicator, the operator at the next level is probed until an abnormal system indicator is determined, and the abnormal system indicator is determined as a root cause indicator; the root cause indicator is used to characterize the cause of the abnormal business indicator.

12. An abnormal index detection device, characterized in that: Distributed systems for stream processing frameworks, including: An acquisition unit, used to acquire multiple target indicators of the distributed system of the stream processing framework during operation; any target indicator includes multiple target values ​​collected in a time series within a preset period; The processing unit is used to extract features of any target indicator through multiple random convolution kernels to obtain feature sequence information of the target indicator; cluster the feature sequence information of the multiple target indicators based on dynamic time warping DTW to determine multiple clusters, wherein each cluster corresponds to an indicator type; for any target indicator, determine whether the target indicator is abnormal according to the indicator type of the cluster to which the target indicator belongs.

13. A computing device, characterized in that: include: Memory for storing computer programs; A processor, configured to call a computer program stored in the memory, and execute the steps of the method according to any one of claims 1 to 11 according to the obtained program.

14. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the steps of the method according to claim 1 are implemented.

Images