A dual-axis time axis exception handling method, device, equipment and storage medium

Abstract

The present invention discloses an exception handling method, device, equipment and storage medium of a dual-axis timeline, including: obtaining key information of each node in business data, and saving the key information of each node in a memory; determining a target node according to a display instruction, and constructing a node topology map according to the key information of the target node extracted from the memory; marking an abnormal state of the dual-axis timeline according to the node topology map; and performing exception handling on the dual-axis timeline marked with an abnormal state. After determining the target node, the abnormal state of the target node is displayed through the dual-axis timeline. Since the dual-axis timeline includes a minute scale axis and an hour scale axis, it can be refined on the timeline, so that the abnormal data can be accurately located through the dual-axis timeline, and the dual-axis timeline marked with an abnormal state can be operated and processed, thereby realizing flexible processing of abnormal state data on the dual-axis timeline.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to a dual-axis time axis exception processing method, device, equipment and storage medium. Background Art

[0002] When processing data, it is usually necessary to obtain abnormal data from a large amount of data and delete or repair the screened abnormal data to avoid the impact of abnormal data on business processes and ensure the normal execution of business processes.

[0003] However, the timeline of the current full-link historical backtracking usually uses a fixed number of points, and the length of each time block is calculated by dividing the time range by the number of points. When the numerator is relatively large, the time range represented by a time block is usually relatively large, making it impossible to accurately locate abnormal data and unable to flexibly modify the data marked with abnormalities. Summary of the invention

[0004] The present invention provides a method for handling the exception of a dual-axis time axis, so as to realize handling the exception of a dual-axis time axis.

[0005] According to a first aspect of the present invention, there is provided a dual-axis timeline exception handling method, comprising: acquiring key information of each node in business data, and saving the key information of each node into a memory;

[0006] Determine the target node according to the display instruction, and construct a node topology map according to the key information of the target node extracted from the memory, wherein the state of the target node is marked in the topology map;

[0007] Marking an abnormal state of a dual-axis time axis according to the node topology diagram, wherein the dual-axis time axis includes a minute scale axis and an hour scale axis;

[0008] Exception processing is performed on the dual-axis time axis that marks the abnormal state.

[0009] According to another aspect of the present invention, there is provided a dual-axis timeline exception handling device, comprising: a key information storage module, for acquiring key information of each node in business data, and storing the key information of each node in a memory;

[0010] A node topology map construction module, used to determine a target node according to a display instruction, and to construct a node topology map according to key information of the target node extracted from a memory, wherein the state of the target node is marked in the topology map;

[0011] A dual-axis time axis marking module, used for marking an abnormal state of the dual-axis time axis according to the node topology diagram, wherein the dual-axis time axis includes a minute scale axis and an hour scale axis;

[0012] The exception handling module is used to perform exception handling on the dual-axis time axis marked with an abnormal state.

[0013] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0014] at least one processor; and

[0015] a memory communicatively connected to the at least one processor; wherein,

[0016] The memory stores a computer program that can be executed by the at least one processor. The computer program is executed by the at least one processor so that the at least one processor can perform the method described in any embodiment of the present invention.

[0017] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the method described in any embodiment of the present invention when executed.

[0018] The technical solution of the embodiment of the present invention, after determining the target node, displays the abnormal state of the target node through a dual-axis timeline. Since the dual-axis timeline includes a minute scale axis and an hour scale axis, the timeline can be refined, so that the abnormal data can be accurately located through the dual-axis timeline, and operations and processing can be performed on the dual-axis timeline that marks the abnormal state, thereby realizing flexible processing of the abnormal state data on the dual-axis timeline.

[0019] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0021] Figure 1 is a flowchart of a dual-axis time axis exception handling method provided according to the first embodiment of the present invention;

[0022] Figure 2 is a schematic diagram of the structure of a dual-axis time axis provided according to the first embodiment of the present invention;

[0023] Figure 3 is a flowchart of a dual-axis time axis exception handling method provided according to Embodiment 2 of the present invention;

[0024] Figure 4 It is a structural schematic diagram of a dual-axis time axis exception handling device provided according to Embodiment 3 of the present invention;

[0025] Figure 5 It is a schematic diagram of the structure of an electronic device provided by Embodiment 4 of the present invention. DETAILED DESCRIPTION

[0026] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0027] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0028] Embodiment 1

[0029] Figure 1 A flowchart of a method for identifying phishing emails is provided for the first embodiment of the present invention. This embodiment is applicable to the case of risk identification of internal enterprise emails. The method can be executed by a phishing email identification device, which can be implemented in the form of hardware and / or software. Figure 1 As shown, the method includes:

[0030] Step S101, obtaining key information of each node in the business data, and saving the key information of each node in the memory.

[0031] Optionally, key information of each node in the business data is obtained, including: grouping the business data according to a specified unit time to obtain data groups, and using the data groups as nodes; determining target fields, wherein the target fields include an edge start association field, an edge end association field, a timestamp field, and a status field; and extracting information from each node according to the target field to obtain key information.

[0032] Specifically, in this embodiment, after obtaining a large amount of business data, cleaning will be performed to obtain data that conforms to the data model. When cleaning, the business data can be grouped according to the specified unit time length to obtain data groups. For example, grouping is performed every 1 second, and the obtained data group is used as a node. Therefore, each node includes business data within the unit time length. Of course, this embodiment is only an example, and the specific number of business data included in the node is not limited. Since each node includes a lot of field information, this embodiment will determine the main fields related to exception processing, that is, the target field. For example, the target fields determined in this embodiment include edge start association fields, edge end association fields, timestamp fields, and status fields. Of course, this embodiment is only an example, and the specific type of the determined target field is not limited.

[0033] Among them, the edge start association field is represented by from, which can have only one layer or multiple layers, and multiple layers can be separated by *, for example, the three-layer data is system2*service2_interface2; the edge end association field is represented by to, which can have only one layer or multiple layers, and multiple layers are separated by *, for example, the three-layer data is system2*service2_interface2; the timestamp field is represented by timestamp; the status field is represented by level, and 0 represents normal, 1 represents abnormal, and 2 represents serious abnormal. Of course, this embodiment is only an example, and does not limit the specific type of each target field. In addition, in this embodiment, after the target field is determined, each node will be extracted according to the target field to obtain key information, so the key information in this embodiment can specifically be the specific content of the determined target field.

[0034] It should be noted that, in this embodiment, after the key information of each node is obtained, the key information of each node will be sent to the memory for storage in the memory, so that the key information extracted by each node in the business data according to the target field is stored in the memory. In addition, since the specific time corresponding to the timestamp field is included in the key information, it is convenient for the user to extract data from the memory based on the specific time in the key information. And when the data in the memory reaches a certain amount, it will be transferred to the storage. For example, only data within the past five years is saved. When the stored data is kept for more than five years, the data will be transferred to the database. Since the query frequency of data with a long storage time is very low, in order to ensure the real-time nature of the data in the memory, the storage is regularly updated to ensure that the effective storage space in the memory is always maintained.

[0035] Step S102, determining the target node according to the display instruction, and constructing a node topology map according to the key information of the target node extracted from the memory.

[0036] Optionally, determining the target node according to the display instruction includes: receiving the display instruction, wherein the display instruction includes a date; querying from a memory according to the date to obtain a node whose timestamp field matches the date; and using the matched node as the target node.

[0037] Specifically, when the user needs to locate the abnormality of the data under the specified date, a display instruction can be sent, wherein the display instruction includes the date, and the terminal device queries the target node from the memory based on the display instruction, and extracts the key information of the target node. Among them, the user can select the time in days, for example, the selected date is October 30, 2024. After receiving the date selected by the user, the terminal device will query from the memory according to the date. Since each node stores the key information corresponding to the timestamp field, the timestamp field will be matched with the date, that is, the node contained in the date is queried, and the matched node is used as the target node. Therefore, the target node in this embodiment represents all the relevant data involved in the execution of the business on October 30, 2024. Of course, the specific number of the matched target nodes is not limited in this embodiment, as long as they are all generated on October 30, 2024, they are all within the protection scope of this application.

[0038] Optionally, a node topology map is constructed based on key information of the target nodes extracted from the memory, including: determining the connection relationship of each target node based on the edge start association field and the edge end association field of the target node; connecting each target node according to the connection relationship to construct a node topology map; determining the display name of each target node based on the edge end association field, and marking the key information corresponding to the display name, timestamp field and status field on the node topology map.

[0039] Specifically, in this embodiment, after the target node is determined, the key information of each target node, such as the specific values ​​corresponding to the start association field, the edge end association field, the timestamp field, and the status field, will be extracted from the memory, and the connection relationship of each target node will be determined and a topology map will be drawn based on the edge start association field from and the edge end association field to of the target node. The display name of each target node is determined using the key information corresponding to the edge end association field to, and marked on the node topology map, and the key information corresponding to the timestamp field and the status field will be synchronously marked on the node topology map.

[0040] It should be noted that if the edge start association field from and the edge end association field to are multi-layered, the first layer is displayed, and the nodes of each layer are viewed by drilling down. In this implementation, when the key information corresponding to the status field is marked on the node graph, different colors can be used for marking. For example, when the level is 0, that is, normal state, the node is marked as green; when the level is 1, that is, abnormal, the node is marked as yellow; when the level is 2, that is, serious abnormal, the node is marked as red. Of course, this implementation is only an example, and the specific method of status marking is not limited. As long as it is convenient for users to quickly and conveniently know the current status of the node according to the marked content, it is within the scope of protection of this application and is not limited in this implementation.

[0041] Step S103: marking an abnormal state of the dual-axis time axis according to the node topology diagram.

[0042] Optionally, the dual-axis timeline is marked as abnormal according to the node topology diagram, including: obtaining a target node whose status field standard is abnormal in the node topology diagram; obtaining a timestamp field corresponding to the target node, and determining a target minute module that matches the minute scale axis according to the timestamp field, and marking the target minute module as abnormal; determining a target hour module that matches the target minute module on the hour scale axis, and marking the target hour module as abnormal.

[0043] Among them, Figure 2The figure shows the schematic diagram of the structure of the dual-axis time axis. The upper row represents the hour scale axis, which includes the hour module. The lower row represents the minute scale axis, which includes the minute module. The minute module is a refinement of the hour module. Due to space limitations, Figure 2 Only a part of the minute scale axis and the hour scale axis is exemplified. In this embodiment, the dual-axis time axis can be marked with abnormal status according to the node topology diagram of the marked status, so that the user can quickly locate abnormal data according to the marked dual-axis time axis.

[0044] In a specific implementation, the target node whose status field is marked as abnormal in the node topology diagram is obtained in this embodiment. For example, when it is determined that there is an abnormal target node and its corresponding timestamp is 04:10, it is determined that the timestamp matches the 250th minute module on the minute scale axis, and it is used as the target minute module and marked as abnormal. When marking, the target minute module can be marked as yellow or red, thereby achieving abnormal marking of the minute scale axis. In addition, in this embodiment, the hour scale axis can be marked with reference to the marking of the minute scale axis. For example, when it is determined that the target minute module corresponding to 04:10 is yellow or red, the hour module corresponding to 4 o'clock on the hour scale axis is used as the target hour module, and the target hour module is marked as yellow or red.

[0045] It should be noted that, in this embodiment, by simultaneously marking the dual-axis time axis, even when the amount of data is very large, the specific time when the abnormal data occurs can be quickly obtained based on the marks on the hour scale axis and the minute scale axis, thereby accurately locating the abnormal data. Of course, this embodiment is only an example for illustration, and does not limit the specific marking method of the minute scale axis and the hour scale axis.

[0046] Step S104, performing exception processing on the dual-axis time axis marked with an abnormal state.

[0047] Optionally, exception handling is performed on the dual-axis timeline marked with an abnormal state, including: obtaining the historical state recorded by the module marked with the abnormal state on the dual-axis timeline; determining whether the historical state is abnormal, and if so, automatically marking the module marked with the abnormal state as not requiring processing; otherwise, receiving the user's modification instruction, and modifying the module marked with the abnormal state to normal according to the modification instruction.

[0048] Specifically, in this embodiment, by marking the dual-axis time axis, it is convenient for users to quickly and accurately determine the specific time when abnormal data is generated, thereby realizing abnormal location. In addition, in this embodiment, the dual-axis time axis with abnormal status marked can be subjected to abnormal processing. When performing abnormal processing, the status of the module on the dual-axis time axis is specifically modified, and the modification can be performed manually or automatically. The specific modification method is not limited in this embodiment.

[0049] In a specific implementation, when it is determined that the target hour module corresponding to the 4 points on the hour scale axis is in an abnormal state, the state corresponding to the target hour module of the previous day will be retrieved from the database. If it is also abnormal, it means that the state is not occasional, but has been maintained. At this time, the target hour module will be automatically marked as no need to be processed; if the state corresponding to the target hour module of the previous day is normal, it means that the state is occasional and novel, so the user needs to pay special attention. If it is determined to be a false alarm after detection, the user's modification instruction is received, and the state is changed from abnormal to normal according to the modification instruction. Of course, in this implementation, only the exception handling of the target hour module is taken as an example. The exception handling method for the target minute module is roughly the same, and will not be repeated in this implementation.

[0050] It should be noted that, in this embodiment, when the status of the hour module or the minute module is determined to be occasional, and the module marked as abnormal is modified to normal according to the modification instruction, the user can also fill in modification opinions for the hour module or the minute module, and when the abnormal status occurs again, it will be automatically marked as not requiring processing. The user can fill in the specific content of the modification opinions according to the actual modification method. The specific content of the filled in modification opinions is not limited in this embodiment. As long as it can facilitate the subsequent identification of historical modifications to the hour module and the minute module, it is within the scope of protection of this application.

[0051] In an implementation manner of the present application, after the target node is determined, the abnormal state of the target node is displayed through a dual-axis timeline. Since the dual-axis timeline includes a minute scale axis and an hour scale axis, the timeline can be refined, so that the abnormal data can be accurately located through the dual-axis timeline, and operations and processing can be performed on the dual-axis timeline that marks the abnormal state, thereby achieving flexible processing of abnormal state data on the dual-axis timeline.

[0052] Embodiment 2

[0053] Figure 3This is a flowchart of a dual-axis timeline exception handling method provided in the second embodiment of the present invention. This embodiment is based on the above embodiment. After handling the exception of the dual-axis timeline marked with an abnormal state, it also includes: receiving the user's alarm instruction, and displaying an alarm ignoring pop-up window based on the instruction; receiving the processing opinion text entered by the user, and filling the processing opinion text in the alarm ignoring pop-up window. Figure 3 As shown, the method includes:

[0054] Step S201, obtaining key information of each node in the business data, and saving the key information of each node in the memory.

[0055] Optionally, key information of each node in the business data is obtained, including: grouping the business data according to a specified unit time to obtain data groups, and using the data groups as nodes; determining target fields, wherein the target fields include an edge start association field, an edge end association field, a timestamp field, and a status field; and extracting information from each node according to the target field to obtain key information.

[0056] Step S202 , determining a target node according to the display instruction, and constructing a node topology map according to key information of the target node extracted from the memory.

[0057] Optionally, determining the target node according to the display instruction includes: receiving the display instruction, wherein the display instruction includes a date; querying from a memory according to the date to obtain a node whose timestamp field matches the date; and using the matched node as the target node.

[0058] Optionally, a node topology map is constructed based on key information of the target nodes extracted from the memory, including: determining the connection relationship of each target node based on the edge start association field and the edge end association field of the target node; connecting each target node according to the connection relationship to construct a node topology map; determining the display name of each target node based on the edge end association field, and marking the key information corresponding to the display name, timestamp field and status field on the node topology map.

[0059] Step S203: marking an abnormal state of the dual-axis time axis according to the node topology diagram.

[0060] Optionally, the dual-axis timeline is marked as abnormal according to the node topology diagram, including: obtaining a target node whose status field standard is abnormal in the node topology diagram; obtaining a timestamp field corresponding to the target node, and determining a target minute module that matches the minute scale axis according to the timestamp field, and marking the target minute module as abnormal; determining a target hour module that matches the target minute module on the hour scale axis, and marking the target hour module as abnormal.

[0061] Step S204, performing exception processing on the dual-axis time axis marked with an abnormal state.

[0062] Optionally, exception handling is performed on the dual-axis timeline marked with an abnormal state, including: obtaining the historical state recorded by the module marked with the abnormal state on the dual-axis timeline; determining whether the historical state is abnormal, and if so, automatically marking the module marked with the abnormal state as not requiring processing; otherwise, receiving the user's modification instruction, and modifying the module marked with the abnormal state to normal according to the modification instruction.

[0063] Step S205, receiving the user's alarm instruction, and displaying an alarm ignoring pop-up window based on the instruction; receiving the processing opinion text input by the user, and filling the processing opinion text in the alarm ignoring pop-up window.

[0064] Specifically, when it is determined that there is an abnormality on the link diagram and it has been processed, in order to avoid unnecessary misunderstandings when subsequent users view it, the processing opinions can be filled in for the processed hour module or minute module. Specifically, the "Alarm Ignore" button is included in the lower right corner of the dual-axis timeline. When the alarm instruction input by the user by triggering the "Alarm Ignore" button is received, the alarm ignore pop-up window will be displayed, and the user can fill in the processing opinion text in the alarm ignore pop-up window. And the hour module or minute module filled with the processing opinion text will be marked with a specified symbol. When the subsequent user triggers the above-mentioned specified symbol, the processing opinion text will be displayed. Of course, this embodiment is only an example, and the specific form of the specified symbol is not limited, such as a text box abbreviation or a circle symbol.

[0065] It should be noted that, in this embodiment, after the processing is completed, the hour module or minute module originally marked as abnormal will change from red or yellow to light blue. In addition, the designated symbol can be triggered by hovering the mouse. When the designated symbol, for example, the text box abbreviation is triggered, the specific person who handled it and the text of the processing opinion will be displayed in the form of a floating layer. Of course, this embodiment is only an example, and does not limit the specific triggering method of the text box abbreviation.

[0066] It is worth mentioning that there is no limitation on the source of business data in this implementation. As long as it can be converted into data that meets the requirements and stored in the memory, it can be automatically displayed, and can be operated and processed directly on the timeline according to the user's instructions, thereby realizing flexible modification of the time module corresponding to the data marked with abnormalities.

[0067] In an implementation manner of the present application, after the target node is determined, the abnormal state of the target node is displayed through a dual-axis timeline. Since the dual-axis timeline includes a minute scale axis and an hour scale axis, the timeline can be refined, so that the abnormal data can be accurately located through the dual-axis timeline, and operations and processing can be performed on the dual-axis timeline that marks the abnormal state, thereby achieving flexible processing of abnormal state data on the dual-axis timeline.

[0068] Embodiment 3

[0069] Figure 4 This is a schematic diagram of the structure of a dual-axis time axis exception handling device provided in Embodiment 3 of the present invention. Figure 4 As shown, the device includes: a key information storage module 310, a node topology map construction module 320, a dual-axis timeline marking module 330 and an exception handling module 340.

[0070] The key information storage module 310 is used to obtain the key information of each node in the business data and save the key information of each node in the memory;

[0071] A node topology map construction module 320 is used to determine a target node according to the display instruction, and to construct a node topology map according to key information of the target node extracted from the memory, wherein the state of the target node is marked in the topology map;

[0072] A dual-axis time axis marking module 330 is used to mark an abnormal state of the dual-axis time axis according to the node topology diagram, wherein the dual-axis time axis includes a minute scale axis and an hour scale axis;

[0073] The exception handling module 340 is used to perform exception handling on the dual-axis time axis marked with an abnormal state.

[0074] Optionally, a key information storage module is used to group the business data according to the specified unit time to obtain data groups, and use the data groups as nodes;

[0075] Determine a target field, wherein the target field includes an edge start association field, an edge end association field, a timestamp field, and a status field;

[0076] Extract information from each node according to the target field to obtain key information.

[0077] Optionally, the node topology map construction module includes a target node determination unit, which is used to receive a display instruction, wherein the display instruction includes a date;

[0078] Query the storage based on the date and obtain the nodes whose timestamp field matches the date;

[0079] The matched node is used as the target node.

[0080] Optionally, the node topology map construction module further includes a node topology map construction unit, which is used to determine the connection relationship of each target node according to the edge start association field and the edge end association field of the target node;

[0081] Connect each target node according to the connection relationship to build a node topology graph;

[0082] The display name of each target node is determined according to the edge end association field, and the key information corresponding to the display name, timestamp field and status field is marked on the node topology map.

[0083] Optionally, a dual-axis timeline marking module is used to obtain target nodes whose status field standard is abnormal in the node topology graph;

[0084] Get the timestamp field corresponding to the target node, determine the target minute module that matches the minute scale axis according to the timestamp field, and mark the target minute module as abnormal;

[0085] A target hour module matching the target minute module on the hour scale axis is determined, and the target hour module is marked as abnormal.

[0086] Optionally, an exception handling module is used to obtain the historical status recorded by the module marking the exception on the dual-axis timeline;

[0087] Determine whether the historical status is abnormal. If so, automatically mark the module marked abnormal as not requiring processing. Otherwise, receive the user's modification instruction and modify the module marked abnormal to normal according to the modification instruction.

[0088] Optionally, the device further includes an alarm ignore pop-up window filling module, which is used to receive an alarm instruction from a user and display an alarm ignore pop-up window based on the instruction;

[0089] Receive the processing opinion text entered by the user and fill the processing opinion text in the alarm ignoring pop-up window.

[0090] The dual-axis timeline exception handling device provided in the embodiment of the present invention can execute the dual-axis timeline exception handling method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0091] Embodiment 4

[0092] Figure 5A schematic diagram of the structure of an electronic device 10 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0093] like Figure 5 As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0094] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0095] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, such as the exception handling method of the dual-axis time axis.

[0096] In some embodiments, the exception handling method of the dual-axis timeline can be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program can be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the exception handling method of the dual-axis timeline described above can be performed. Alternatively, in other embodiments, the processor 11 can be configured to execute the exception handling method of the dual-axis timeline in any other appropriate manner (for example, by means of firmware).

[0097] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0098] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0099] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0100] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0101] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0102] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0103] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0104] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A dual-axis time axis exception handling method, characterized in that: include: Obtain key information of each node in the business data, and save the key information of each node in the memory; Determine the target node according to the display instruction, and construct a node topology map according to the key information of the target node extracted from the memory, wherein the state of the target node is marked in the topology map; Marking an abnormal state of a dual-axis time axis according to the node topology diagram, wherein the dual-axis time axis includes a minute scale axis and an hour scale axis; Exception processing is performed on the dual-axis time axis that marks the abnormal state.

2. The method according to claim 1, characterized in that The key information of each node in the business data is obtained, including: Grouping the service data according to a specified unit time length to obtain a data group, and using the data group as the node; Determine a target field, wherein the target field includes an edge start association field, an edge end association field, a timestamp field, and a status field; Extract information from each of the nodes according to the target field to obtain the key information.

3. The method according to claim 1, characterized in that The step of determining the target node according to the display instruction includes: receiving a display instruction, wherein the display instruction includes a date; Querying the storage according to the date to obtain a node whose timestamp field matches the date; The matched node is used as the target node.

4. The method according to claim 2, characterized in that: The step of constructing a node topology map according to key information of the target node extracted from the memory includes: Determine the connection relationship of each target node according to the edge start association field and the edge end association field of the target node; Connecting each of the target nodes according to the connection relationship to construct the node topology graph; The display name of each target node is determined according to the edge end association field, and key information corresponding to the display name, the timestamp field and the status field is marked on the node topology map.

5. The method according to claim 1, characterized in that The marking of an abnormal state of the dual-axis time axis according to the node topology graph includes: Obtain a target node in the node topology graph whose status field standard is abnormal; Acquire the timestamp field corresponding to the target node, determine the target minute module that matches the minute scale axis according to the timestamp field, and mark the target minute module as abnormal; A target hour module on the hour scale axis that matches the target minute module is determined, and the target hour module is marked as abnormal.

6. The method according to claim 1, characterized in that The performing exception processing on the dual-axis time axis marked with an abnormal state includes: Obtaining the historical status recorded by the module marked with anomalies on the dual-axis timeline; It is determined whether the historical status is abnormal. If so, the module marked abnormal is automatically marked as not requiring processing. Otherwise, a modification instruction from the user is received, and the module marked abnormal is modified to be normal according to the modification instruction.

7. The method according to any one of claims 1 to 6, characterized in that: After performing abnormal processing on the dual-axis time axis marked with an abnormal state, the method further includes: Receive an alarm instruction from the user, and display an alarm ignoring pop-up window based on the instruction; Receive the processing suggestion text input by the user, and fill the processing suggestion text in the alarm ignoring pop-up window.

8. A dual-axis time axis exception handling device, characterized in that: include: A key information storage module is used to obtain key information of each node in the business data and save the key information of each node in the memory; A node topology map construction module, used to determine a target node according to a display instruction, and to construct a node topology map according to key information of the target node extracted from a memory, wherein the state of the target node is marked in the topology map; A dual-axis time axis marking module, used for marking an abnormal state of the dual-axis time axis according to the node topology diagram, wherein the dual-axis time axis includes a minute scale axis and an hour scale axis; The exception handling module is used to perform exception handling on the dual-axis time axis marked with an abnormal state.

9. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can perform the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the method according to any one of claims 1 to 7 when executed.

Images