Data processing method and device in service monitoring scene

Abstract

The invention provides a data processing method and device in a service monitoring scene. The method comprises the following steps: acquiring to-be-monitored data and comparison sample data of to-be-monitored indexes of a target service activity in real time; performing a data packet operation on the comparison sample data to determine a plurality of reference data packets; determining a reference data group closest to the current value of the to-be-monitored data as a target data group; continuously detecting whether the current value of the to-be-monitored data exceeds the maximum value or the minimum value in the target data group according to a preset detection period so as to execute a preset alarm strategy; or when it is detected that the difference value between the to-be-monitored data and the predicted current value is larger than the preset difference value, an alarm notification operation is executed to notify the service party. Thus, the server can effectively improve the accuracy of warning for the business activity of the abnormal data, improve the business scene compatibility of the server, set different monitoring thresholds for different business activities, improve the monitoring efficiency and reduce the monitoring cost.

Description

Technical Field

[0001] The present application belongs to the general data processing technology field of the Internet industry, and specifically relates to a data processing method and device in a business monitoring scenario. Background Art

[0002] At present, many companies on the market have begun to use business monitoring systems to detect abnormal behaviors and potential risks in business operations, thereby improving the security and stability of business activities.

[0003] However, in traditional business monitoring systems, operators manually configure fixed thresholds, and alarms are triggered when the corresponding indicator data reaches the fixed thresholds. With the rapid development of Internet systems, massive amounts of business activity data are generated every day, and businesses also need to respond quickly to changes in the environment. Fixed thresholds cannot meet the needs of diverse business scenarios and cannot quickly adapt to business changes. If the fixed threshold is too high, the alarm will not be issued in time, and if the fixed threshold is too low, the alarm will be frequent, which reduces the accuracy of the alarm and the practicality of the business monitoring system. Summary of the invention

[0004] The embodiment of the present application provides a data processing method and device in a business monitoring scenario. The server obtains the monitored data of the monitored indicators of the target business activities and the adapted comparison sample data in real time, and then determines the target data grouping applicable to the monitored data based on the comparison sample data, and then executes the business monitoring alarm, so as to improve the accuracy of the business monitoring alarm of the server for specific business scenarios, improve the monitoring efficiency and reduce the monitoring cost.

[0005] In a first aspect, an embodiment of the present application provides a data processing method in a business monitoring scenario, which is applied to a server, and the method includes:

[0006] Acquire the monitored data of the monitored indicator of the target business activity in real time, and acquire the comparison sample data adapted to the monitored data, wherein the target business activity is any reference business activity under the reference business preset by the client corresponding to the server, and the comparison sample data is the business activity data corresponding to the monitored indicator within the preset number of days in the same period as the monitored data, and the monitored indicator is determined by the business type corresponding to the target business activity;

[0007] Performing a data grouping operation on the comparison sample data to determine a plurality of reference data groups;

[0008] determining a reference data group closest to the current value of the data to be monitored as the target data group; and,

[0009] Continuously detecting whether the current value of the data to be monitored exceeds the maximum value or the minimum value in the target data group according to a preset detection period to execute a preset alarm strategy, wherein the preset detection period is adapted to the service type corresponding to the target service activity; or,

[0010] When it is detected that the difference between the monitored data and the predicted current value is greater than a preset difference, an alarm notification operation is performed to notify the business party, and the predicted current value is determined by the values ​​of multiple sample points in the target data group.

[0011] In a second aspect, an embodiment of the present application provides a data processing device in a business monitoring scenario, which is applied to a server, and the device includes:

[0012] An acquisition unit is used to acquire in real time the monitored data of the monitored indicator of the target business activity, and to acquire comparison sample data adapted to the monitored data, wherein the target business activity is any reference business activity under the reference business preset by the client corresponding to the server, and the comparison sample data is business activity data corresponding to the monitored indicator within a preset number of days in the same period as the monitored data, and the monitored indicator is determined by the business type corresponding to the target business activity;

[0013] A first determining unit, configured to perform a data grouping operation on the comparison sample data to determine a plurality of reference data groups;

[0014] A second determining unit, configured to determine a reference data group closest to a current value of the data to be monitored as a target data group;

[0015] An execution unit is used to continuously detect whether the current value of the monitored data exceeds the maximum value or the minimum value in the target data group according to a preset detection period to execute a preset alarm strategy, and the preset detection period is adapted to the business type corresponding to the target business activity; or, when it is detected that the difference between the monitored data and the predicted current value is greater than the preset difference, an alarm notification operation is executed to notify the business party, and the predicted current value is determined by the values ​​of multiple sample points in the target data group.

[0016] In a third aspect, an embodiment of the present application provides a server, comprising a processor, a memory, and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the processor, and the program includes instructions for executing the steps in the first aspect of the embodiment of the present application.

[0017] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium having a computer program / instruction stored thereon, which implements the steps in the first aspect of the embodiment of the present application when the computer program / instruction is executed by a processor.

[0018] In a fifth aspect, an embodiment of the present application provides a computer program product, including a computer program / instructions, which, when executed by a processor, implement some or all of the steps described in the first aspect of the embodiment of the present application.

[0019] It can be seen that in the embodiment of the present application, the server obtains the monitored data of the monitored indicators of the target business activities and the adapted comparison sample data in real time, and then determines the target data grouping applicable to the monitored data based on the comparison sample data, and then executes the business monitoring alarm, in order to improve the accuracy of the server's business monitoring alarm for specific business scenarios, improve monitoring efficiency and reduce monitoring costs. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0021] Figure 1 It is a structural block diagram of a business monitoring system provided by an embodiment of the present application;

[0022] Figure 2 It is a flow chart of a data processing method in a business monitoring scenario provided by an embodiment of the present application;

[0023] Figure 3 This is a business line flow chart of a business monitoring alarm provided by an embodiment of the present application;

[0024] Figure 4 This is another business line flow chart of business monitoring alarm provided by an embodiment of the present application;

[0025] Figure 5a It is a data processing flow chart of performing data grouping based on comparing sample data provided by an embodiment of the present application;

[0026] Figure 5b This is a data processing flow chart of a service alarm provided by an embodiment of the present application;

[0027] Figure 6 This is a schematic diagram of a scenario of an alarm notification provided by an embodiment of the present application;

[0028] Figure 7 This is a block diagram of the functional units of a data processing device in a business monitoring scenario provided by an embodiment of the present application;

[0029] Figure 8This is a block diagram of the functional units of another data processing device in a business monitoring scenario provided by an embodiment of the present application;

[0030] Fig. 9 It is a structural block diagram of a server provided in an embodiment of the present application. DETAILED DESCRIPTION

[0031] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0032] The terms "first", "second", etc. in the specification and claims of this application and the above-mentioned drawings are used to distinguish different objects, rather than to describe a specific order. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not limited to the listed steps or units, but optionally includes steps or units that are not listed, or optionally includes other steps or units inherent to these processes, methods, products or devices.

[0033] Reference to "embodiments" herein means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0034] See also Figure 1 , Figure 1 is a structural block diagram of a business monitoring system provided by an embodiment of the present application. Figure 1As shown, the business monitoring system 100 includes a server 110, a client 120 and a terminal device 130 that are in communication connection. The server 110 is used to monitor specific indicators of any reference business activity under multiple reference businesses preset on the client 120, that is, the indicators to be monitored of the target business activity. The server 110 obtains the real-time updated data to be monitored of the indicators to be monitored of the target business activity, and obtains the comparison sample data adapted to the data to be monitored, and divides the comparison sample data into multiple reference data groups, determines the target data group adapted to the data to be monitored, and uses the target data group as the basis for business monitoring alarms, and executes subsequent business monitoring alarm strategies. In addition, the terminal device 130 can be any terminal device on the market owned by the business party, such as a mobile phone, a computer, a tablet, etc. The business party can control the server 110 through the terminal device 130 to perform the above-mentioned business monitoring on any specific indicator of a reference business activity on the client 120, and when the alarm is met, the server 110 executes a preset alarm strategy or alarm notification operation to notify the business party through the terminal device 130. Timely alarms can help the business party's operation and maintenance team respond to danger quickly and avoid the expansion of problems. One business monitoring system 100 corresponds to one server 110, and one server 110 corresponds to one or more clients 120 and one or more terminal devices 130.

[0035] Based on this, an embodiment of the present application provides a data processing method in a business monitoring scenario, and the embodiment of the present application is described in detail below with reference to the accompanying drawings.

[0036] See also Figure 2 , Figure 2 1 is a flow chart of a data processing method in a business monitoring scenario provided by an embodiment of the present application. The method is applied to the server 110 in the business monitoring system 100. The method includes:

[0037] Step S201, obtaining in real time the monitored data of the monitored indicators of the target business activity, and obtaining comparison sample data adapted to the monitored data.

[0038] Among them, the target business activity is any reference business activity under the reference business preset by the client corresponding to the server, and the comparison sample data is the business activity data corresponding to the monitored indicator within the preset number of days in the same period as the monitored data, and the monitored indicator is determined by the business type corresponding to the target business activity.

[0039] Among them, the function of business monitoring is to discover abnormal behaviors and potential risks in business operations. Different from system monitoring, business monitoring needs to analyze the business activity data generated by specific business activities to ensure that there is no obvious error information. It is necessary to reversely deduce the corresponding business activity situation by analyzing data trends. Since there are differences between the business activity data corresponding to each business activity, in order to ensure the accuracy of business monitoring alarms, the business scenarios (i.e., target business activities) corresponding to the monitored data and the comparison sample data need to be the same.

[0040] Furthermore, in order to improve the compatibility of the server in executing business monitoring alarms, the target business activities involved in the method provided in this application are reference business activities under the reference business preset on the client corresponding to the server. In order to ensure the accuracy and efficiency of the alarm, the server will perform data processing operations on a certain indicator in the target business activity. The indicator to be monitored is determined by the business type corresponding to the target business activity. For example, when the target business activity is a business activity under the transaction business, the corresponding indicator to be monitored can be the success rate of customer transactions, transaction volume, average number of customer operations, total number of customer operations, etc., which are not limited here. It should be noted that the comparison sample data adapted to the data to be monitored refers to the business activity data corresponding to the indicator to be monitored within the preset number of days in the same period as the data to be monitored. In order to avoid the server from processing too much data and resulting in low alarm efficiency, the preset number of days should not be too long, and for the accuracy of the alarm, the preset number of days should not be too long, usually set to 30 days, 45 days, etc. In addition, since the same business activity is affected by time and the rate of change of indicators is relatively large, the comparison sample data also needs to be in the same period as the monitored data (for example, 9 to 10 a.m.), and the comparison sample data belongs to business activity data, which is different from business activity data. Business activity data refers to various data information related to the corresponding reference business activities generated by the enterprise during the operation process, such as customer search activities, transaction activities, and information browsing related data.

[0041] In one possible embodiment, the monitored data of the monitored indicators of the target business activity are obtained in real time, and the comparison sample data adapted to the monitored data are obtained, including: receiving the alarm scheduling information of the current business monitoring, responding to the alarm scheduling information to construct an indicator query input parameter for querying the monitored data and the comparison sample data; obtaining a preset column query database and a preset cache database; according to the indicator query input parameter, performing a data query operation on the column query database and the cache database to obtain the monitored data and the comparison sample data.

[0042] Among them, the column-based query database and the cache database synchronize the business activity data in the data sources corresponding to multiple reference businesses in real time, and perform standardized operations on the business activity data. The cache database is used to cache aggregate indicators, which are indicators determined by aggregate calculation of business activity data in multiple reference businesses that have been queried in historical business monitoring. The column-based query database is used to store the associated data of basic indicators and relative indicators. Basic indicators are indicators of reference business activities corresponding to a single reference business made by users on the client, and relative indicators are indicators of reference business activities corresponding to multiple reference businesses made by users on the client. Basic indicators can be understood as the basic query unit in indicator query, which only involves a single reference business, while relative indicators are indicators involving multiple reference businesses.

[0043] Specifically, the server in the business monitoring system provided by the present application will be equipped with a column-based query database and a cache database. The query database in the present application uses a column-based database, so that the system can still maintain efficient data query calculations under large data volumes. Specifically, it is through the use of a column-based storage method, that is, storing data in the same column together. This storage method can greatly reduce the input / output operations of data and improve query performance, especially when performing aggregate queries and sorting operations. The cache database is used to cache aggregate indicators, wherein the aggregate indicators are indicators determined by aggregate calculations of business activity data in multiple reference businesses that have been queried in historical business monitoring, such as averages, sums, counts, maximum values, minimum values, etc. Caching refers to storing aggregate indicators in a temporary storage area, which is usually located in memory or a faster storage medium for quick access.

[0044] Furthermore, the process of synchronizing the business activity data in the data sources of multiple reference businesses includes collecting business activity data (also called "warehousing", that is, storing business activity data from the data source of the reference business into the database), performing data cleaning, performing standardization operations, and storing in the database. In addition, data cleaning refers to the process of cleaning and organizing the original data set before data processing and analysis. The main purpose of this process is to identify and correct the erroneous, incomplete, inaccurate, irrelevant or repeated parts in the data to ensure the quality and accuracy of the data, thereby improving the efficiency and effectiveness of subsequent data analysis or data mining. In addition, in the process of performing data cleaning in the columnar query database and the cache database, the business activity data will be distinguished based on the business scenario (that is, the reference business activity), thereby maintaining non-interference between the data and improving the monitoring and alarm of abnormal data under specific business activities by the server. In addition, standardization operations refer to converting different business activity data according to certain rules so that they have the same standards and scope. This includes the unification of data formats, fields, and naming specifications. The purpose of this step is to improve the consistency and comparability of data, facilitate data exchange, sharing and analysis; at the same time, it is also an important means to improve data quality and model performance. Ultimately, the reference business activities under different reference businesses corresponding to different business parties can be aligned to meet monitoring requirements and improve the compatibility of the server's execution of business monitoring and alarm services.

[0045] It can be seen that in this example, through the setting of the column query database and the cache database, monitoring can be quickly started after data access, and the manual maintenance cost and learning cost are low, which can effectively improve the efficiency of the server in obtaining comparison sample data, and, by pre-standardizing the business activity data entering the database in advance, the business activity data of multiple reference businesses can be divided in advance to improve the accuracy and efficiency of the server's data processing.

[0046] In one possible embodiment, the column-based query database is also used to store a set of sub-field quantities; based on the indicator query input parameters, a data query operation is performed on the column-based query database and the cache database to obtain the data to be monitored and the comparison sample data, including: constructing the query parameters corresponding to the current data query operation based on the indicator query input parameters; querying the set of sub-field quantities based on the query parameters to determine the size of the grouping fields corresponding to the current data query operation; constructing a paging query condition based on the size of the grouping fields; based on the query parameters and the paging query conditions, querying the cache database and the column-based query database to obtain the data to be monitored and the comparison sample data.

[0047] The paging query condition is used to indicate the upper limit of the amount of data returned by a single query when executing the current data query operation, and to perform a cyclic batch query when the actual amount of data in a single query exceeds the upper limit of the amount of data. The query priority of the cache database is higher than the query priority of the column query database.

[0048] Among them, the advantages of cyclic batch query are: 1. High resource utilization. Reduce memory pressure: When the data set is large, loading all data into the memory at one time may cause excessive memory consumption and even cause the system to crash. Cyclic batch query can divide the large data set into multiple small batches for processing, and only load a small part of the data into the memory each time, thereby effectively reducing memory pressure and maintaining stable operation of the system. Improve the efficiency of data input and output: Batch processing can reduce the amount of data in a single query, making data input and output more efficient, avoiding long-term occupation of system resources, and thus improving overall processing efficiency. 2. Real-time and responsiveness. Load balancing: In high-concurrency scenarios, cyclic batch query can help the server achieve load balancing. By distributing a large number of requests into multiple batches for processing, system congestion and delays caused by a single request processing time that is too long can be avoided. 3. Flexibility and scalability. Flexible processing: Cyclic batch query can flexibly adjust the batch size and query frequency according to actual business needs and data volume. This enables the server to maintain high efficiency and stability when processing data sets of different sizes. Easy to expand: As the business develops and the amount of data grows, the processing capacity of the server can be further improved by increasing the batch size or optimizing the query logic. In addition, you can also consider expanding the overall performance of the system by increasing the number of servers or using more powerful hardware. 4. Reduce costs and maintenance difficulties. Save resources: Since cyclic batch queries can efficiently utilize system resources, a lot of hardware costs and operating costs can be saved. For example, the demand for high-configuration servers can be reduced, and energy consumption and maintenance costs can be reduced. Simplified maintenance: The implementation of cyclic batch queries is relatively simple, and usually only requires writing a loop statement and some query logic. This makes the development and maintenance costs of the system relatively low, and also reduces the probability of errors.

[0049] For example, see Figure 3 , Figure 3 This is a business line flow chart of a business monitoring alarm provided by an embodiment of the present application, such as Figure 3 As shown, the execution process of the business monitoring alarm is completed through data interaction between the terminal device 130, the server 110, the column query database 310 and the cache database 320.

[0050] The execution process of the business monitoring alarm is as follows: the business party executes step S301 through the terminal device 130 to send the alarm scheduling information of the current business monitoring to the server 110; after receiving the alarm scheduling information, the server 110 executes step S302 to construct the index query input parameter, and then executes step S303 to construct the query parameter; the server 110 executes step S304 for the column query database 310 according to the query parameter to query the number of sub-fields, and correspondingly, the column query database 310 executes step S305 to return the size of the grouping field, so that the server 110 executes S306 according to the size of the grouping field to construct the paging query condition; after the paging query condition is constructed, the server 110 queries the column query database 310 based on the paging query condition. 10 and the cache database 320 execute step S307 to perform a data query operation, and correspondingly, the column-based query database 310 and the cache database 302 execute step S308 to return the query data results (i.e., the data to be monitored and the comparison sample data), wherein, in the process of executing the data query operation, the server 110 will choose whether to perform a cyclic batch query according to the upper limit of the data volume; after the server 110 obtains the query data results from the column-based query database 310 and the cache database 320, the server 110 will execute the method provided in the present application to match the alarm rules to determine whether the monitored data of the monitored indicators of the target business activity will trigger an alarm, and if it is determined that the alarm is triggered, step S309 is executed to trigger an alarm to notify the business party (i.e., the terminal device 130).

[0051] Furthermore, the column-based query database is specifically used to store a basic indicator result table, a basic indicator model table, a relative indicator result table, a relative indicator model table, and a relative indicator same value interval data result table. The basic indicator result table is used to store the associated data of each basic indicator corresponding to each reference business activity within a first preset time length. The basic indicator model table is used to store the associated data of each basic indicator corresponding to each reference business activity within a second preset time length. The relative indicator result table is used to store the associated data of each relative indicator corresponding to each reference business activity within the first preset time length. The relative indicator model table is used to store the associated data of each relative indicator corresponding to each reference business activity within the second preset time length. The second preset time length is shorter than the first preset time length. Based on this setting, Figure 3 Based on the business line flowchart shown in FIG. 1 , the server performs a data query operation on the column-based query database 310 and the cache database 320, and the specific flowchart is shown in FIG. Figure 4 , Figure 4 This is another business line flow chart of business monitoring alarm provided by the embodiment of the present application. Figure 4As shown, the server 110 will first execute step S401 to query the aggregate index for the cache database 320 according to the query parameters. After querying the aggregate index, it will then execute step S402 to query the basic index result table, step S403 to query the basic index model table, step S404 to query the relative index result table, and step S405 to query the relative index model table in sequence according to the query parameters. Correspondingly, the cache database 320 will respond to step S401 and execute step S411 to return the query result (if the cache is not empty), and the column query database 310 will respond to steps S402, S403, S404, and S405 and execute steps S412, S413, S414, and S415 to return the query result (if the result is not empty). After the above query steps are executed, the server 110 will summarize the query results to determine the final query data results (i.e., the data to be monitored and the comparison sample data).

[0052] It can be seen that in this example, by constructing paging query conditions, the stability of the server executing a single query can be guaranteed, and abnormal situations such as server freezing can be avoided. In addition, by setting the priority between the cache database and the column query database, the server can prioritize querying cached aggregate indicators, thereby reducing the time to query indicator data from the column query database and improving the efficiency of executing data query operations.

[0053] Step S202 , performing a data grouping operation on the comparison sample data to determine a plurality of reference data groups.

[0054] Among them, since the object of business monitoring performed by the server in this application is business activity data, it is necessary to consider the periodicity, seasonal offset and change trend of the business activity data, so as to divide it into multiple reference data groups according to business scenarios based on the different situations presented by the comparison sample data, and then select the reference data group that is adapted to the data to be monitored as the target data group to execute subsequent alarm strategies, thereby improving the flexibility and compatibility of the server in executing the data analysis process, and improving the accuracy of the server in determining the indicator thresholds for different business scenarios.

[0055] In one possible embodiment, a data grouping operation is performed on the comparison sample data to determine multiple reference data groups, including: determining a first numerical interval of the comparison sample data and a second numerical interval of the data to be monitored; when the first numerical interval does not include the second numerical interval, determining supplementary sample data corresponding to the second numerical interval based on pre-stored historical sample data to supplement the comparison sample data; sorting the supplemented comparison sample data from small to large; and determining the slope value between any two adjacent sample points in the sorted comparison sample data; determining the slope standard deviation and the average slope of the sorted comparison sample data based on the slope value; determining the sample point corresponding to the slope value of the difference or sum of the slope standard deviations that exceeds the average slope and a first preset multiple as a data segmentation point, so as to divide the sorted comparison sample data into multiple reference data groups.

[0056] The historical sample data refers to business activity data outside of the preset number of days in the same period as the data to be monitored.

[0057] For example, the indicator to be monitored corresponding to the comparison sample data and the data to be monitored is the transaction volume of the customer's transaction business on the client. Since the transaction data usually fluctuates in the order of 1000, the range of each data interval is set to 1000. At this time, the first data interval of the comparison sample data is [2000, 3000], [3000, 4000], and the second data interval of the data to be monitored is [2000, 3000], [3000, 4000], [4000, 5000], [5000, 6000]. In this case, the first data interval does not include [4000, 5000], [5000, 6000] in the second data interval, so the server needs to perform data supplementation based on the historical sample data. In order to ensure the accuracy of the data analysis performed by the server, the data to be monitored still needs data as a reference when such an unconventional numerical range appears. Therefore, the business activity data in the historical sample data is not limited to the preset number of days, but only to the same period. Preferably, the first preset multiple can be set to 3. In statistics and data processing, three times the standard deviation (3σ) is selected as the basis for judging outliers, mainly based on the properties of normal distribution and the principles in probability theory. Normal distribution (Gaussian distribution) is a continuous probability distribution that is widely present in nature and social sciences. One of its important characteristics is that approximately 99.7% of the data will fall within the range of the mean (μ) plus or minus three times the standard deviation (3σ). In other words, only about 0.3% of the data will exceed this range, and these points are considered to be extreme outliers or outliers. Using three times the standard deviation as the judgment criterion for outliers can ensure that outliers can be effectively identified and eliminated in most cases, thereby improving the robustness and reliability of the data.

[0058] Furthermore, after the server has supplemented the comparison sample data, each sample point in the comparison sample data is sorted from small to large in value, and then the slope standard deviation and average slope of the sorted comparison sample data are determined, and then the sample points with excessively large differences in slope values ​​are determined as data segmentation points, so as to divide multiple reference data groups representing different business scenarios. Business scenarios may include: regular business activities, popular business activities (i.e., business parties organize related activities to increase the value of business activity data), and abnormal business activities (i.e., customer activities that represent abnormalities). The type of business scenario is associated with the business type of the target business activity.

[0059] It can be seen that in this example, the server determines whether it is necessary to supplement the comparison sample data by determining the numerical ranges corresponding to the comparison sample data and the data to be monitored obtained in real time, thereby improving the comprehensiveness of the comparison sample data and improving the accuracy and practicality of the server's subsequent determination of target data groups to execute alarm strategies.

[0060] Step S203: determine the reference data group closest to the current value of the data to be monitored as the target data group.

[0061] In one possible embodiment, determining a reference data group closest to a current value of the data to be monitored as a target data group includes: detecting that the current value is in a group gap between any two reference data groups, and determining that the reference data group corresponding to the group gap is a first reference data group and a second reference data group; performing a first gap filling operation on the first reference data group and the second reference data group to update the numerical range of the reference data group; if the current value is not in the updated numerical range of the first reference data group or the second reference data group, determining an updated group gap according to the updated numerical range, and determining a maximum difference between a maximum value and a minimum value of the updated numerical range; determining a first ratio of a first data range size of the first reference data group to the maximum difference, and determining a second ratio of a second data range size of the second reference data group to the maximum difference; performing a second gap filling operation according to the first ratio, the second ratio and the updated group gap to determine that the corresponding first reference data group or the second reference data group is the target data group of the current value.

[0062] Among them, the maximum value in the first reference data group is smaller than the minimum value in the second reference data group, the first gap filling operation is to increase the initial numerical range of the first reference data group or the second reference data group according to the data standard deviation corresponding to the first reference data group or the second reference data group, and the second gap filling operation is to divide the updated group gap according to the first ratio and the second ratio to increase the updated numerical range of the first reference data group or the second reference data group again.

[0063] Among them, this embodiment is a specific calculation step for a branch where the current value is in the group gap, and if the current value is in the numerical range corresponding to any reference data group, the server can directly determine the corresponding reference data group as the target data group. And, in this embodiment, if the current value is in the updated numerical range of the first reference data group or the second reference data group, the corresponding reference data group is determined to be the target data group.

[0064] Exemplarily, the group gap means that multiple reference data groups are not continuous, and there may be data gaps. Taking the value of business activity data as an example, the reference data groups determined by the server are now 0-25 and 50-80, 0-25 is the first reference data group, and 50-80 is the second reference data group. Among them, 25-50 is a gap, and the current value of the monitored data is 36, which is in the gap. In order to determine the target reference data group of the current value (36), the server needs to perform the first gap filling operation and the second gap filling operation in sequence to narrow the group gap so that one of the reference data groups covers the current value (36). Under the first gap filling operation, first, the data standard deviations corresponding to the first reference data group and the second reference data group are both assumed to be 10, then the value range of the first reference data group after the first gap filling operation is -10-35, and the value range of the second reference data group after the second gap filling operation is 40-90. At this time, the current value (36) is still not covered, so the next gap filling operation is used to fill the gap between 35-40. In the second gap filling operation, according to the range size, the maximum value of the updated numerical range is determined to be 90, and the minimum value of the updated numerical range is determined to be -10. According to the proportion of -10-35 in -10-90, it is the first ratio (i.e. 45%), and 35-90 is the second ratio (i.e. 55%). Finally, the updated group gap (35-40) is divided by the first ratio and the second ratio, that is, the final numerical range of the first reference data group is (-10-37.25), and the final numerical range of the second reference data group is (37.25-90), then the target data group of the current value (36) is the first reference data group.

[0065] Furthermore, in special cases, after the server executes the embodiment of the present application, it is still possible that the current value does not fall into any reference data group, that is, when the numerical value must be a positive number, and the numerical range after the first reference data group is increased involves a negative number, this will result in a small group gap remaining after the above two gap filling operations are performed. At this time, the server can determine the target data group based on the first difference between the current value and the maximum value of the last numerical range of the first reference data group, and the second difference between the minimum value of the last numerical range of the second reference data group and the current value. For example, the current value is 10, the maximum value of the last numerical range of the first reference data group is 8, the minimum value of the last numerical range of the second reference data group is 13, the first difference is 2, and the second difference is 3. At this time, it is determined that the first difference is smaller, which means that the closer the current value is to the first reference data group, the first reference data group is determined to be the target data group.

[0066] For example, see Figure 5a , Figure 5a is a data processing flow chart of performing data grouping based on comparing sample data provided by an embodiment of the present application, such as Figure 5a As shown, the server executes the above-mentioned sample selection strategy, i.e., obtains the initial comparison sample data (i.e., obtains the business activity data of the same period within the preset number of days), then determines the first numerical interval of the comparison sample data and the second numerical interval of the data to be monitored, and then, if there is a second numerical interval not included in the first numerical interval, supplements the comparison sample data according to the second numerical interval. After that, the server will perform the comparison sample data grouping to select a sample data group adapted to its business scenario for the monitored value of the monitored indicator of the target business activity, as the basis for the server to determine whether its value exceeds the normal numerical range (i.e., the threshold). The steps of comparing sample data groups executed by server 110 include, in chronological order from front to back: sorting the values ​​from small to large, i.e. sorting the values ​​of multiple sample points in the compared sample data; calculating the slope value; determining the slope standard deviation and the average slope according to the slope value; determining the data segmentation point; dividing the reference data groups; executing the first gap filling operation; executing the second gap filling operation; determining the target data group, i.e. determining the adapted reference data group as the target data group according to the numerical value relationship between the current value of the data to be monitored and the two adjacent reference data groups, and then allowing the server to execute subsequent business monitoring alarms according to the target data group.

[0067] It can be seen that in this example, the server fills the grouping gaps between multiple reference data groups that may exist through multi-level gap filling operations, so that the data to be monitored can fall into the numerical range of any data group, so as to execute subsequent threshold alarms, improve the flexibility of the server in data processing, and the stability and accuracy of the server in determining the target data grouping, and avoid the situation where the data to be monitored cannot be grouped normally.

[0068] Step S204, continuously detect whether the current value of the monitored data exceeds the maximum value or minimum value in the target data group according to the preset detection period to execute the preset alarm strategy; or, when it is detected that the difference between the monitored data and the predicted current value is greater than the preset difference, execute the alarm notification operation to notify the business party.

[0069] The preset detection period is adapted to the business type corresponding to the target business activity, and the predicted current value is determined by the values ​​of multiple sample points in the target data group.

[0070] Among them, the preset detection cycle refers to the server detecting whether the current value of the monitored data exceeds the maximum or minimum value in the target data group at intervals of the preset detection cycle. If there is an abnormality in the current value, according to the setting of the preset alarm strategy, the server will execute different degrees of alarm strategies according to different numbers of abnormalities. Usually, the corresponding alarm strategy will increase the degree of danger represented by the alarm strategy according to the increase in the number of abnormalities. It is flexibly set according to the activity type of the target business activity and the needs of the business party.

[0071] In a possible embodiment, whether the current value of the data to be monitored exceeds the maximum value or the minimum value in the target data group is continuously detected according to a preset detection period to execute a preset alarm strategy, including: determining multiple reference alarm levels from low to high in the preset alarm strategy and corresponding multiple reference alarm operations; determining the target alarm level corresponding to the target business activity according to the preset alarm level set; when it is detected for the first time according to the preset detection period that the current value of the data to be monitored exceeds the maximum value or the minimum value in the target data group, executing the reference alarm operation corresponding to the target alarm level; and, if the target alarm level in the initial state is less than the highest level of the reference alarm level, and it is continuously detected that the current value of the data to be monitored exceeds the maximum value or the minimum value in the target data group, the current alarm level of the target business activity is upgraded from the target alarm level to the reference alarm level of the next level, and the reference alarm operation corresponding to the upgraded current alarm level is executed; if it is not detected that the current value of the data to be monitored exceeds the maximum value or the minimum value in the target data group, the current alarm level is restored to the target alarm level; and the above detection operation is repeated until the current alarm level is upgraded to the highest level of the reference alarm level.

[0072] Among them, multiple reference alarm levels correspond one-to-one to multiple reference alarm operations, any two reference alarm operations are different, the reference alarm operation corresponding to the highest level of the reference alarm level is the alarm notification operation, and the alarm level set includes the target alarm level corresponding to the business type of each reference business preset by the client. The target alarm level is the reference alarm level in the initial state determined in advance by the staff according to the importance of the business type of the corresponding reference business.

[0073] Among them, this embodiment is the alarm automatic upgrade strategy preset by the server in this application. The alarm automatic upgrade strategy is mainly aimed at the situation where the current value of the monitored data exceeds the threshold by a small margin, and the purpose is to avoid frequent triggering of alarms to notify the business party. In order to match the business needs of different reference business activities, the server can determine the target alarm level of the target business activity corresponding to the current business monitoring alarm based on the preset alarm level set. This level is flexibly adjusted according to the business type, business needs and business party needs of the corresponding reference business. The target alarm level can be any one of the multiple reference alarm levels in the preset alarm strategy, and each reference alarm level in the preset alarm strategy corresponds to a reference alarm operation. In order for the business party to be able to perceive the difference in reference alarm levels, any two reference alarm operations are set to be different from each other, wherein the reference alarm operation corresponding to the highest level of the reference alarm level is an alarm notification operation, i.e., notifying the business party. The current alarm level of the target business activity will be upgraded from the target alarm level and the corresponding reference alarm operation will be performed based on whether the preset detection period continuously detects that the current value exceeds the maximum or minimum value of the target data group (which can be understood as the divided threshold, but exceeding the threshold does not necessarily directly trigger an alarm to notify the business party).

[0074] Exemplarily, in this business monitoring scenario, the multiple reference alarm levels in the preset alarm strategy are respectively the first level, the second level, and the third level from low to high, and the corresponding reference alarm operations are respectively no alarm, close attention, and notification to the business party. Among them, close attention can be set to shorten the preset detection cycle, or the server side marks the alarm mark for the monitored indicators of the target business activity, etc. When the target alarm level of the target business activity is the first level, the first detection of exceeding the threshold will cause the current alarm level of the target business activity to be upgraded from the first level to the second level, and the reference alarm operation corresponding to the first level (no alarm) will be executed. When the next preset detection cycle arrives, if the current value is detected to exceed the threshold again, the current alarm level will be automatically upgraded to the third level again to execute the reference alarm operation of close attention. If the threshold is not detected, the current alarm level will be restored to the initial alarm level (i.e., target alarm level-first level). Under special circumstances, the target alarm level of the target business activity will be set to the third level. At this time, as long as the current value of the monitored data is detected to exceed the maximum or minimum value in the target data group when the preset detection cycle is reached, the server will directly execute the reference alarm operation corresponding to the third level, that is, notify the business party.

[0075] It can be seen that in this example, the server presets the alarm strategy and sets the initial alarm level of the target business activity, so that the server can continuously detect and execute the corresponding reference alarm operation when the current value exceeds the threshold by a small margin, avoid high-frequency alarm operations to notify the business party, and improve the flexibility and accuracy of the server's execution of business monitoring alarms.

[0076] In one possible embodiment, after determining that the reference data group closest to the current value of the data to be monitored is the target data group, before executing the alarm notification operation to notify the business party, the method also includes: according to the sample times corresponding to the multiple sample points in the target data group, sorting the multiple sample points in sequence from far to near to determine a sample point sequence of the multiple sample points; according to the sample point sequence, determining the sum of the values ​​of a preset number of consecutive sample points in sequence to determine multiple reference average values; according to the multiple reference average values, determining a predicted average value of the predicted current value corresponding to the current time of the data to be monitored; determining the predicted current value according to the predicted average value and the value of each sample point; and determining the value volatility corresponding to the target data group according to the value of each sample point; determining a preset difference according to the predicted current value and the value volatility of a second preset multiple.

[0077] Among them, the server sorts multiple sample points in the target data group according to the sample time of each sample point and the current system time to determine the sample point sequence. The server then determines the sum of the values ​​of the preset number of sample points in sequence to determine multiple reference averages, and then determines the predicted average. Then the value of the predicted current value is determined according to the values ​​of the existing sample points. In addition, the corresponding preset difference is determined according to the predicted current value. Among them, the numerical volatility can be understood as the standard deviation of the values ​​of each sample point in the target data group. Preferably, the second preset multiple can be set to 3. In statistics and data processing, three times the standard deviation (3σ) is selected as the basis for judging abnormal values, mainly based on the properties of normal distribution and the principles of probability theory. Normal distribution (Gaussian distribution) is a continuous probability distribution that is widely present in nature and social sciences. One of its important characteristics is that about 99.7% of the data will fall within the range of the mean (μ) plus or minus three times the standard deviation (3σ). In other words, only about 0.3% of the data will exceed this range, and these points are considered to be extreme abnormal values ​​or outliers. Using three times the standard deviation as the criterion for judging outliers can ensure that outliers can be effectively identified and eliminated in most cases, thereby improving the robustness and reliability of the data.

[0078] Specifically, assuming that the value of the target data group is X={x 1 , x 2 , …, x i}, the calculation formula of the numerical volatility of its data volatility is as follows:

[0079] s 2 =∑ N i＝1 (x i -μ) 2 / N , where S 2 is the variance, N is the number of sample points in the target data group, and N is a natural integer;

[0080] Furthermore, since the standard deviation σ is the variance S 2 The square root of the variance S 2 Find the standard deviation σ.

[0081] Among them, μ is the average value of the values ​​of each sample point in the target data group, and the calculation formula of μ is as follows:

[0082] μ=(x 1 +x 2 +…,+x i ) / N.

[0083] Further, predict the current value X T The calculation process is as follows:

[0084] In which, suppose T represents the time point, X T It is represented as the value of the sample point corresponding to the time point T. The preset number is n, which is less than the total number N of sample points in the target data group, wherein the time point corresponding to the predicted current value is T.

[0085] Among them, the first reference average value is M 1 =(X 1 +X 2 +…+X n ) / n, the second reference mean is M 2 =(X 2 +X 3 +…+X n+1 ) / n;

[0086] Similarly, according to the sample point sequence, the predicted average value is M T-n+1 =(X T-n+1 +X T-n+2 +…+X T ) / n.

[0087] Among them, M T-n+1 The specific value of M is obtained from the previous calculation 1 —M T-n The numerical changes are used to predict the calculation. If the numerical change trend is linear, a linear regression model can be used. A straight line is fitted by the least squares method, which best represents M 1 To M T-n Then, this straight line can be used to predict M T-n+1 If the value is discrete, determine M 1 —M T-n The average value is the predicted average value. T-n+1 After the value of X T-n+1 -X T-1 The values ​​of M are known, so we can combine T-n+1 The final predicted current value X is calculated from the numerical value T The numerical value of .

[0088] For example, see Figure 5b , Figure 5b This is a data processing flow chart of a service alarm provided by an embodiment of the present application. Figure 5bAs shown, after the server has completed the comparison of sample data groups to determine the target data group for the data to be monitored. The server will also execute monitoring alarms, and the monitoring alarms include two alarm strategies. The steps of the first alarm strategy include, from front to back in chronological order: determining a sample point sequence according to the sample time; determining a predicted current value according to the sample point sequence; determining a preset difference according to the predicted current value and the numerical volatility; executing a business alarm according to the predicted current value and the preset difference, that is, when it is detected that the difference between the data to be monitored and the predicted current value is greater than the preset difference as described in the above embodiment, an alarm notification operation is executed to notify the business party. The steps of the second alarm strategy include, from front to back in chronological order: determining multiple reference alarm levels and corresponding multiple reference alarm operations; determining the target alarm level corresponding to the data to be monitored; executing automatic alarm upgrades according to a preset detection cycle, that is, the above embodiment describes the continuous detection of whether the current value of the data to be monitored exceeds the maximum value or minimum value in the target data group according to the preset detection cycle to execute the preset alarm strategy. Based on these two alarm strategies, the server can effectively respond to possible numerical changes in various monitored data. The two alarm strategies are mainly based on the situation where the current value slightly exceeds the threshold, that is, exceeds the maximum or minimum value of the target data group, and the situation where the current value changes significantly. This improves the accuracy of the server's business monitoring alarms and the diversity of applicable business monitoring scenarios.

[0089] For example, please refer to Figure 6 , Figure 6 Schematic diagram of a warning notification scenario provided by an embodiment of the present application. Figure 6 As shown, taking the terminal device 130 as a mobile phone as an example, the mobile phone screen of the terminal device 130 has a camera, and an application running display component is displayed in the top preset area on the display interface of the display screen of the terminal device 130, which is used to indicate the running status of some applications, such as Figure 6The display interface of the terminal device 130 in the example displays the associated information of the network, alarm clock, flow rate and power. In addition, when the server performs the alarm operation of notifying the business party, the server generates the corresponding alarm notification of the business monitoring alarm according to the target business activity, the indicator name of the indicator to be monitored, the current value of the indicator to be monitored and the numerical range of the target numerical group. Taking the target business activity as the transaction activity and the indicator to be monitored as the transaction amount as an example, the alarm notification used to notify the business party includes the following contents: "Target business activity: transaction activity"; "Alarm content: transaction amount (i.e. the indicator name of the indicator to be monitored) exceeds the reasonable numerical range, the current value of the transaction amount: XXX (i.e. the current value of the indicator to be monitored), the reasonable numerical range: (XXX, XXX) (i.e. the numerical range of the target numerical group)", and "Alarm time: XXXX-XX-XX, 14:35:27 (i.e. the year, month, day and specific time, the specific time is determined by the operation time of the server performing the alarm operation of notifying the business party)".

[0090] It can be seen that in this example, the server sets business monitoring alarms by comparing the historical data in the target data group where the monitored data in the sample data is located to predict the current value and the corresponding preset difference, thereby improving the accuracy and flexibility of the server's alarm operations.

[0091] It can be seen that the server obtains the monitored data of the monitored indicators of the target business activities and the adapted comparison sample data in real time, and then determines the target data grouping applicable to the monitored data based on the comparison sample data, and then executes the business monitoring alarm, in order to improve the accuracy of the server's business monitoring alarm for specific business scenarios, improve monitoring efficiency and reduce monitoring costs.

[0092] The following is an embodiment of the device of the present application. The embodiment of the device of the present application and the embodiment of the method of the present application are of the same concept and are used to execute the method described in the embodiment of the present application. For the convenience of explanation, the embodiment of the device of the present application only shows the part related to the embodiment of the device of the present application. For the specific technical details not disclosed, please refer to the description of the embodiment of the method of the present application, which will not be repeated here one by one.

[0093] The present invention provides a data processing device for a business monitoring scenario. The data processing device for a business monitoring scenario is applied to Figure 1The server 110 in the business monitoring system 100 shown is connected to the client 120 and the terminal device 130 in communication. The terminal device 130 is a terminal device held by the business party. The client is used to provide the user with various reference services and reference business activities under each reference service. Specifically, the data processing device in the business monitoring scenario is used to execute the steps executed by the server in the data processing method in the above business monitoring scenario. The data processing device in the business monitoring scenario provided in the embodiment of the present application may include modules corresponding to the corresponding steps.

[0094] The embodiment of the present application can divide the functional modules of the data processing device in the business monitoring scenario according to the above method example. For example, each functional module can be divided corresponding to each function, or two or more functions can be integrated into one processing module. The above integrated module can be implemented in the form of hardware or in the form of software functional modules. The division of modules in the embodiment of the present application is schematic and is only a logical function division. There may be other division methods in actual implementation.

[0095] In the case of dividing each functional module into corresponding functional modules, Figure 7 It is a functional unit composition block diagram of a data processing device in a business monitoring scenario provided by an embodiment of the present application; the data processing device 70 in the business monitoring scenario is applied to the server 110, and the data processing device 70 in the business monitoring scenario includes: an acquisition unit 701, which is used to acquire the monitored data of the monitored indicators of the target business activity in real time, and to acquire comparison sample data adapted to the monitored data, the target business activity is any reference business activity under the reference business preset by the client corresponding to the server, the comparison sample data is the business activity data corresponding to the monitored indicator within the preset number of days in the same period as the monitored data, and the monitored indicator is determined by the business type corresponding to the target business activity; A determination unit 702 is used to perform a data grouping operation on the comparison sample data to determine multiple reference data groups; a second determination unit 703 is used to determine the reference data group closest to the current value of the data to be monitored as the target data group; an execution unit 704 is used to continuously detect whether the current value of the data to be monitored exceeds the maximum value or the minimum value in the target data group according to a preset detection period to execute a preset alarm strategy, and the preset detection period is adapted to the business type corresponding to the target business activity; or, when it is detected that the difference between the data to be monitored and the predicted current value is greater than the preset difference, an alarm notification operation is executed to notify the business party, and the predicted current value is determined by the values ​​of multiple sample points in the target data group.

[0096] In a possible embodiment, in performing a data grouping operation on the comparison sample data to determine multiple reference data groups, the first determination unit 702 is specifically used to: determine a first numerical interval of the comparison sample data and a second numerical interval of the data to be monitored; when the first numerical interval does not include the second numerical interval, determine supplementary sample data corresponding to the second numerical interval based on pre-stored historical sample data to supplement the comparison sample data, the historical sample data being business activity data other than a preset number of days in the same period as the data to be monitored; sort the supplemented comparison sample data from small to large; and determine the slope value between any two adjacent sample points in the sorted comparison sample data; determine the slope standard deviation and average slope of the sorted comparison sample data based on the slope value; determine the sample point corresponding to the slope value of the difference or sum of the slope standard deviations that exceeds the average slope and a first preset multiple as a data segmentation point, so as to divide the sorted comparison sample data into multiple reference data groups.

[0097] In a possible embodiment, in terms of determining that the reference data group closest to the current value of the data to be monitored is the target data group, the second determination unit 703 is specifically used to: detect that the current value is in a group gap between any two reference data groups, determine that the reference data groups corresponding to the group gap are the first reference data group and the second reference data group, and the maximum value in the first reference data group is less than the minimum value in the second reference data group; perform a first gap filling operation on the first reference data group and the second reference data group to update the numerical range of the reference data group, and the first gap filling operation is to increase the initial numerical range of the first reference data group or the second reference data group according to the data standard deviation corresponding to the first reference data group or the second reference data group; if the current value is not in the first The updated numerical range of the reference data group or the second reference data group is determined, the updated group gap is determined according to the updated numerical range, and the maximum difference between the maximum value and the minimum value of the updated numerical range is determined; a first ratio of the first data range size of the first reference data group to the maximum difference is determined, and a second ratio of the second data range size of the second reference data group to the maximum difference is determined; a second gap filling operation is performed according to the first ratio, the second ratio and the updated group gap to determine that the corresponding first reference data group or the second reference data group is the target data group of the current value, and the second gap filling operation is to divide the updated group gap according to the first ratio and the second ratio to increase the updated numerical range of the first reference data group or the second reference data group again.

[0098] In one possible embodiment, in terms of continuously detecting whether the current value of the monitored data exceeds the maximum value or the minimum value in the target data group according to a preset detection period to execute the preset alarm strategy, the execution unit 704 is specifically used to: determine multiple reference alarm levels from low to high in the preset alarm strategy and corresponding multiple reference alarm operations, the multiple reference alarm levels correspond to the multiple reference alarm operations one-to-one, any two reference alarm operations are different from each other, and the reference alarm operation corresponding to the highest level of the reference alarm level is the alarm notification operation; according to the preset alarm level set, determine the target alarm level corresponding to the target business activity, the alarm level set includes the target alarm level corresponding to the business type of each reference business preset by the client, and the target alarm level is an initial alarm level determined in advance by the staff according to the importance of the business type of the corresponding reference business. reference alarm level in the state; when it is detected for the first time according to the preset detection period that the current value of the data to be monitored exceeds the maximum value or the minimum value in the target data group, the reference alarm operation corresponding to the target alarm level is executed; and, if the target alarm level in the initial state is less than the highest level reference alarm level, and it is continuously detected that the current value of the data to be monitored exceeds the maximum value or the minimum value in the target data group, the current alarm level of the target business activity is upgraded from the target alarm level to the reference alarm level of the next level, and the reference alarm operation corresponding to the upgraded current alarm level is executed; if it is not detected that the current value of the data to be monitored exceeds the maximum value or the minimum value in the target data group, the current alarm level is restored to the target alarm level; repeat the above detection operation until the current alarm level is upgraded to the highest level reference alarm level.

[0099] In one possible embodiment, after determining that the reference data group closest to the current value of the data to be monitored is the target data group, before executing the alarm notification operation to notify the business party, the execution unit 704 is specifically further used to: sort the multiple sample points from far to near according to the sample times corresponding to the multiple sample points in the target data group to determine a sample point sequence of the multiple sample points; determine the sum of the values ​​of a preset number of consecutive sample points according to the sample point sequence to determine multiple reference average values; determine a predicted average value of the predicted current value corresponding to the current time of the data to be monitored according to the multiple reference average values; determine the predicted current value according to the predicted average value and the value of each sample point; and determine the value volatility corresponding to the target data group according to the value of each sample point; determine the preset difference according to the predicted current value and the value volatility of the second preset multiple.

[0100] In a possible embodiment, in terms of real-time acquisition of monitored data of the monitored indicators of the target business activity, and acquisition of comparison sample data adapted to the monitored data, the acquisition unit 701 is specifically used to: receive alarm scheduling information of the current business monitoring, respond to the alarm scheduling information to construct an indicator query input parameter for querying the monitored data and the comparison sample data; obtain a preset column query database and a preset cache database, the column query database and the cache database synchronize the business activity data in the data sources corresponding to multiple reference businesses in real time, and perform standardized operations on the business activity data, the cache database is used to cache aggregated indicators, the aggregated indicators are indicators determined by aggregate calculation of business activity data in multiple reference businesses that have been queried in historical business monitoring, the column query database is used to store associated data of basic indicators and relative indicators, the basic indicators are indicators of reference business activities corresponding to a single reference business performed by the user on the client, and the relative indicators are indicators of reference business activities corresponding to multiple reference businesses performed by the user on the client; according to the indicator query input parameter, a data query operation is performed on the column query database and the cache database to obtain the monitored data and the comparison sample data.

[0101] In one possible embodiment, the column-based query database is also used to store a set of sub-field quantities; in terms of performing data query operations on the column-based query database and the cache database according to the indicator query input parameters to obtain the data to be monitored and the comparison sample data, the acquisition unit 701 is specifically used to: construct the query parameters corresponding to the current data query operation according to the indicator query input parameters; query the set of sub-field quantities according to the query parameters to determine the size of the grouping fields corresponding to the current data query operation; construct a paging query condition according to the size of the grouping fields, the paging query condition is used to indicate the upper limit of the amount of data returned by a single query when executing the current data query operation, and to perform a cyclic batch query when the actual amount of data in a single query exceeds the upper limit of the amount of data; query the cache database and the column-based query database according to the query parameters and the paging query condition to obtain the data to be monitored and the comparison sample data, wherein the query priority of the cache database is higher than the query priority of the column-based query database.

[0102] In the case of integrated units, such as Figure 8 As shown, Figure 8 This is a block diagram of the functional units of a data processing device in another business monitoring scenario provided by an embodiment of the present application. Figure 8In the data processing device 70 in the business monitoring scenario, the data processing device 70 includes: a processing module 802 and a communication module 801. The processing module 802 is used to control and manage the actions of the data processing device in the business monitoring scenario, for example, the steps of the acquisition unit 701, the first determination unit 702, the second determination unit 703 and the execution unit 704, and / or other processes for executing the technology described herein. The communication module 801 is used to support the interaction between the data processing device in the business monitoring scenario and other devices. Figure 8 As shown, the data processing device in the business monitoring scenario may include a storage module 803, and the storage module 803 is used to store program codes and data of the data processing device in the business monitoring scenario.

[0103] Among them, the processing module 802 can be a processor or a controller, for example, a central processing unit (CPU), a general processor, a digital signal processor (DSP), an ASIC, an FPGA or other programmable logic device, a transistor logic device, a hardware component or any combination thereof. It can implement or execute various exemplary logic blocks, modules and circuits described in conjunction with the disclosure of this application. The processor can also be a combination that implements a computing function, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, and the like. The communication module 801 can be a transceiver, an RF circuit or a communication interface, and the like. The storage module 803 can be a memory.

[0104] Among them, all relevant contents of each scenario involved in the above method embodiment can be referred to the functional description of the corresponding functional module, and will not be repeated here. The data processing device 70 in the above business monitoring scenario can execute the above Figure 2 The data processing method in the business monitoring scenario shown.

[0105] The above embodiments can be implemented in whole or in part by software, hardware, firmware or any other combination. When implemented using software, the above embodiments can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions or computer programs. When a computer instruction or computer program is loaded or executed on a computer, a process or function according to an embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. Computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, computer instructions can be transmitted from one website site, computer, server or data center to another website site, computer, server or data center by wired or wireless means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center containing one or more available media sets. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium. The semiconductor medium can be a solid-state hard disk.

[0106] Fig. 9 is a structural block diagram of a server provided in an embodiment of the present application. Fig. 9 As shown, the server 110 may include one or more of the following components: a processor 910, a memory 920 coupled to the processor 910, wherein the memory 920 may store one or more programs 921, and the one or more programs 921 may be configured to implement the methods described in the above embodiments when executed by one or more processors 910. The server here is the server 110 mentioned in the above embodiments, and the server may implement the related methods performed by the server 110 described in the above embodiments.

[0107] The processor 910 may include one or more processing cores. The processor 910 uses various interfaces and lines to connect the various parts of the entire server 110, and executes various functions and processes data of the server 110 by running or executing instructions, programs, code sets or instruction sets stored in the memory 920, and calling data stored in the memory 920. Optionally, the processor 910 can be implemented in at least one hardware form of digital signal processing (DSP), field-programmable gate array (FPGA), and programmable logic array (PLA). The processor 910 can integrate one or a combination of a central processing unit (CPU), a graphics processing unit (GPU), and a modem. Among them, the CPU mainly processes the operating system, user interface, and application programs; the GPU is responsible for rendering and drawing display content; and the modem is used to process wireless communications. It can be understood that the above-mentioned modem may not be integrated into the processor 910, but may be implemented separately through a communication chip.

[0108] The memory 920 may include a random access memory (RAM) or a read-only memory (ROM). The memory 920 may be used to store instructions, programs, codes, code sets or instruction sets. The memory 920 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for implementing at least one function (such as a touch function, a sound playback function, an image playback function, etc.), instructions for implementing the above-mentioned various method embodiments, etc. The data storage area may also store data created by the server 110 during use, etc.

[0109] It is understandable that the server 110 may include more or fewer structural elements than those in the above structural block diagram, which is not limited here.

[0110] An embodiment of the present application also provides a computer storage medium, on which a computer program / instruction is stored. When the computer program / instruction is executed by a processor, part or all of the steps of any method recorded in the above method embodiments are implemented.

[0111] An embodiment of the present application also provides a computer program product, which includes a non-transitory computer-readable storage medium storing a computer program, and the computer program is operable to cause a computer to execute part or all of the steps of any method recorded in the above method embodiments.

[0112] It should be understood that in the various embodiments of the present application, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0113] In the several embodiments provided in the present application, it should be understood that the disclosed methods, devices and systems can be implemented in other ways. For example, the device embodiments described above are only schematic; for example, the division of units is only a logical function division, and there may be other division methods in actual implementation; for example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0114] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0115] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may be physically included separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of hardware plus software functional units.

[0116] The above-mentioned integrated unit implemented in the form of a software functional unit can be stored in a computer-readable storage medium. The above-mentioned software functional unit is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform some steps of the methods of various embodiments of the present invention. The aforementioned storage medium includes: a USB flash drive, a mobile hard disk, a magnetic disk, an optical disk, a volatile memory or a non-volatile memory. Among them, the non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM) or a flash memory. The volatile memory can be a random access memory (RAM), which is used as an external cache. By way of example but not limitation, many forms of random access memory (RAM) are available, such as static RAM (SRAM), dynamic random access memory (DRAM), synchronous DRAM (SDRAM), double data rate synchronous dynamic random access memory (double data rate SDRAM, DDR SDRAM), enhanced synchronous dynamic random access memory (enhanced SDRAM, ESDRAM), synchronous link dynamic random access memory (synchlink DRAM, SLDRAM) and direct memory bus random access memory (directrambus RAM, DR RAM) and other media that can store program code.

[0117] Although the present invention is disclosed as above, the present invention is not limited thereto. Any person skilled in the art can easily think of changes or substitutions without departing from the spirit and scope of the present invention, and can make various changes and modifications, including the combination of the above-mentioned different functions and implementation steps, including software and hardware implementation methods, all of which are within the scope of protection of the present invention.

Claims

1. A data processing method in a business monitoring scenario, characterized in that: Applied to a server, the method comprises: Acquire the monitored data of the monitored indicator of the target business activity in real time, and acquire the comparison sample data adapted to the monitored data, wherein the target business activity is any reference business activity under the reference business preset by the client corresponding to the server, and the comparison sample data is the business activity data corresponding to the monitored indicator within the preset number of days in the same period as the monitored data, and the monitored indicator is determined by the business type corresponding to the target business activity; Performing a data grouping operation on the comparison sample data to determine a plurality of reference data groups; determining a reference data group closest to the current value of the data to be monitored as a target data group; and, Continuously detecting whether the current value of the data to be monitored exceeds the maximum value or the minimum value in the target data group according to a preset detection period to execute a preset alarm strategy, wherein the preset detection period is adapted to the service type corresponding to the target service activity; or, When it is detected that the difference between the monitored data and the predicted current value is greater than a preset difference, an alarm notification operation is performed to notify the business party, and the predicted current value is determined by the values ​​of multiple sample points in the target data group.

2. The method according to claim 1, characterized in that The performing a data grouping operation on the comparison sample data to determine a plurality of reference data groups includes: Determine a first numerical interval of the comparison sample data and a second numerical interval of the data to be monitored; When the first numerical interval does not include the second numerical interval, determining supplementary sample data corresponding to the second numerical interval according to pre-stored historical sample data to supplement the comparison sample data, the historical sample data being business activity data other than a preset number of days in the same period as the data to be monitored; Sort the supplemented comparison sample data from small to large; and, Determine the slope value between any two adjacent sample points in the sorted comparison sample data; Determine the slope standard deviation and average slope of the sorted comparison sample data according to the slope value; Determine sample points corresponding to slope values ​​that exceed the difference or sum between the slope standard deviation that exceeds the average slope and a first preset multiple as data segmentation points to divide the sorted comparison sample data into the multiple reference data groups.

3. The method according to claim 2, characterized in that The step of determining a reference data group closest to the current value of the data to be monitored as the target data group includes: detecting that the current value is in a group gap between any two of the reference data groups, determining that the reference data group corresponding to the group gap is a first reference data group and a second reference data group, and that a maximum value in the first reference data group is smaller than a minimum value in the second reference data group; performing a first gap filling operation on the first reference data group and the second reference data group to update the value range of the reference data group, wherein the first gap filling operation is to increase the initial value range of the first reference data group or the second reference data group according to the data standard deviation corresponding to the first reference data group or the second reference data group; If the current value is not within the updated value range of the first reference data group or the second reference data group, determining an updated group gap according to the updated value range, and determining a maximum difference between a maximum value and a minimum value of the updated value range; Determine a first ratio of a first data range size of the first reference data group to the maximum difference, and determine a second ratio of a second data range size of the second reference data group to the maximum difference; A second gap filling operation is performed according to the first ratio, the second ratio and the updated group gap to determine that the corresponding first reference data group or the second reference data group is the target data group of the current value, and the second gap filling operation is to divide the updated group gap according to the first ratio and the second ratio to increase the updated numerical range of the first reference data group or the second reference data group again.

4. The method according to any one of claims 1 to 3, characterized in that: The step of continuously detecting whether the current value of the data to be monitored exceeds the maximum value or the minimum value in the target data group according to a preset detection period to execute a preset alarm strategy includes: Determine multiple reference alarm levels and corresponding multiple reference alarm operations from low to high in the preset alarm strategy, wherein the multiple reference alarm levels correspond to the multiple reference alarm operations one-to-one, any two of the reference alarm operations are different from each other, and the reference alarm operation corresponding to the highest level of the reference alarm level is the alarm notification operation; Determine a target alarm level corresponding to the target business activity according to a preset alarm level set, wherein the alarm level set includes a target alarm level corresponding to a business type of each reference business preset by the client, and the target alarm level is a reference alarm level in an initial state determined in advance by a staff member according to the importance of the business type of the corresponding reference business; When it is detected for the first time according to the preset detection period that the current value of the data to be monitored exceeds the maximum value or the minimum value in the target data group, executing the reference alarm operation corresponding to the target alarm level; and If the target alarm level in the initial state is less than the reference alarm level of the highest level, and it is continuously detected that the current value of the data to be monitored exceeds the maximum value or the minimum value in the target data group, the current alarm level of the target business activity is upgraded from the target alarm level to the reference alarm level of the next level, and the reference alarm operation corresponding to the upgraded current alarm level is performed; If it is not detected that the current value of the data to be monitored exceeds the maximum value or the minimum value in the target data group, the current alarm level is restored to the target alarm level; The above detection operation is repeated until the current alarm level is upgraded to the highest reference alarm level.

5. The method according to any one of claims 1 to 3, characterized in that: After determining the reference data group closest to the current value of the data to be monitored as the target data group and before performing an alarm notification operation to notify the service party, the method further includes: According to the sample times corresponding to the multiple sample points in the target data group, the multiple sample points are sorted in order from far to near to determine a sample point sequence of the multiple sample points; According to the sample point sequence, sequentially determining the sum of the values ​​of a preset number of consecutive sample points to determine a plurality of reference average values; Determine, based on the multiple reference average values, a predicted average value including a predicted current value corresponding to the current time of the data to be monitored; Determining the predicted current value according to the predicted average value and the value of each of the sample points; and Determine the value fluctuation rate corresponding to the target data group according to the value of each sample point; The preset difference is determined according to the numerical fluctuation rate of the predicted current value and the second preset multiple.

6. The method according to claim 1, characterized in that The real-time acquisition of the monitored data of the monitored indicator of the target business activity, and the acquisition of the comparison sample data adapted to the monitored data, include: Receiving alarm scheduling information of the current business monitoring, responding to the alarm scheduling information to construct an indicator query input parameter for querying the monitored data and the comparison sample data; Obtain a preset column-based query database and a preset cache database, wherein the column-based query database and the cache database synchronize business activity data in data sources corresponding to multiple reference businesses in real time, and perform standardized operations on the business activity data, wherein the cache database is used to cache aggregate indicators, wherein the aggregate indicators are indicators determined by aggregate calculation of business activity data in the multiple reference businesses that have been queried in historical business monitoring, and wherein the column-based query database is used to store associated data of basic indicators and relative indicators, wherein the basic indicators are indicators of reference business activities performed by the user on the client involving a corresponding single reference business, and the relative indicators are indicators of reference business activities performed by the user on the client involving multiple reference businesses; According to the indicator query input parameter, a data query operation is performed on the column query database and the cache database to obtain the data to be monitored and the comparison sample data.

7. The method according to claim 6, characterized in that The column-based query database is also used to store a set of sub-field quantities; the query input according to the indicator is used to perform a data query operation on the column-based query database and the cache database to obtain the data to be monitored and the comparison sample data, including: Constructing query parameters corresponding to the current data query operation according to the indicator query input parameter; Query the sub-field quantity set according to the query parameter to determine the grouping field size corresponding to the current data query operation; Constructing a paging query condition according to the size of the grouping field, the paging query condition is used to indicate the upper limit of the amount of data returned by a single query when executing the current data query operation, and executing a cyclic batch query when the actual amount of data in the single query exceeds the upper limit of the amount of data; According to the query parameters and the paging query conditions, the cache database and the column query database are queried to obtain the data to be monitored and the comparison sample data, wherein the query priority of the cache database is higher than the query priority of the column query database.

8. A data processing device in a business monitoring scenario, characterized in that: Applied to a server, the device comprises: an acquisition unit, configured to acquire in real time the monitored data of the monitored indicator of the target business activity, and to acquire comparison sample data adapted to the monitored data, wherein the target business activity is any reference business activity under the reference business preset by the client corresponding to the server, and the comparison sample data is business activity data corresponding to the monitored indicator within a preset number of days in the same period as the monitored data, and the monitored indicator is determined by the business type corresponding to the target business activity; A first determining unit, configured to perform a data grouping operation on the comparison sample data to determine a plurality of reference data groups; A second determining unit, configured to determine a reference data group closest to a current value of the data to be monitored as a target data group; An execution unit is used to continuously detect whether the current value of the monitored data exceeds the maximum value or the minimum value in the target data group according to a preset detection period to execute a preset alarm strategy, and the preset detection period is adapted to the business type corresponding to the target business activity; or, when it is detected that the difference between the monitored data and the predicted current value is greater than a preset difference, execute an alarm notification operation to notify the business party, and the predicted current value is determined by the values ​​of multiple sample points in the target data group.

9. A server, characterized in that: The method comprises a processor, a memory, a communication interface, and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the processor, and the programs include instructions for executing the steps in the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: A computer program for electronic data exchange is stored, wherein the computer program causes a computer to execute the method according to any one of claims 1 to 7.

Images