Root cause analysis method, device and electronic equipment

Abstract

The embodiments of the present application disclose a root cause analysis method, device and electronic device, the method comprising: decomposing abnormal derivative indicators to obtain at least two basic indicators; obtaining the predicted value corresponding to each basic indicator according to the kernel density model corresponding to each basic indicator; taking partial derivatives of the relationship formula of the derivative indicators based on the finite difference method to obtain the explanatory power relationship formula of the derivative indicators; obtaining the explanatory power of the derivative indicators according to the predicted value corresponding to each basic indicator and the explanatory power relationship formula; performing weight conversion on the explanatory power of the derivative indicators to obtain the target explanatory power corresponding to each dimensional combination in the derivative indicators; determining the root cause combination based on the surprise value and the target explanatory power corresponding to each dimensional combination; the present application solves the problem in the related art that it is impossible to perform root cause analysis on the derivative indicators.

Description

Technical Field

[0001] The present application relates to the technical field of root cause analysis; specifically, to a root cause analysis method, device and electronic equipment. Background Art

[0002] Among the important monitorable indicator data generated in the company's business processes, there are abnormal fluctuations in multi-dimensional indicator data. In order to find the root cause of this abnormal fluctuation, all dimensional combinations are usually used as independent indicators for abnormal monitoring; for each dimensional combination, it can be cut out from the overall indicator data as an independent indicator, and the abnormal fluctuations of these new indicators can be analyzed independently; if it is found that the overall indicator is abnormal, and the indicator corresponding to a certain dimensional combination also shows an abnormality in the same direction, it is considered to be the root cause of this indicator abnormality.

[0003] The core of root cause analysis is to find a combination of dimensions that can explain the abnormal fluctuations of current indicators. However, traditional root cause analysis is often limited to basic indicators. It can simply decompose indicator data based on dimension values, which is a simple addition relationship in terms of values. However, it does not support derivative indicators with other complex relationships such as multiplication and division.

[0004] Therefore, how to analyze the root causes of derived indicators is an urgent problem to be solved. Summary of the invention

[0005] To solve the above technical problems, the embodiments of the present application provide a root cause analysis method, device and electronic device, which solve the problem in the related art that root cause analysis of derived indicators cannot be performed.

[0006] According to one aspect of an embodiment of the present application, a root cause analysis method is provided, the method comprising: decomposing an abnormal derived indicator to obtain at least two basic indicators; obtaining a predicted value corresponding to each basic indicator according to a kernel density model corresponding to each basic indicator; calculating partial derivatives of a relationship of the derived indicator based on a finite difference method to obtain an explanatory power relationship of the derived indicator; obtaining the explanatory power of the derived indicator according to the predicted value corresponding to each basic indicator and the explanatory power relationship; performing weight transformation on the explanatory power of the derived indicator to obtain a target explanatory power corresponding to each dimensional combination in the derived indicator; and determining a root cause combination based on a surprise value and a target explanatory power corresponding to each dimensional combination.

[0007] According to one aspect of an embodiment of the present application, a root cause analysis device is provided, the device comprising: an indicator decomposition module, used to decompose abnormal derivative indicators to obtain at least two basic indicators; a predicted value acquisition module, used to obtain the predicted value corresponding to each basic indicator according to the kernel density model corresponding to each basic indicator; a relational expression acquisition module, used to obtain the partial derivative of the relational expression of the derivative indicators based on the finite difference method to obtain the explanatory power relational expression of the derivative indicators; an explanatory power acquisition module, used to obtain the explanatory power of the derivative indicators according to the predicted value corresponding to each basic indicator and the explanatory power relational expression; a weight conversion module, used to perform weight conversion on the explanatory power of the derivative indicators to obtain the target explanatory power corresponding to each dimensional combination in the derivative indicators; a root cause determination module, used to determine the root cause combination based on the surprise value and the target explanatory power corresponding to each dimensional combination.

[0008] According to one aspect of an embodiment of the present application, a computer-readable medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the root cause analysis method in the above technical solution is implemented.

[0009] According to one aspect of an embodiment of the present application, an electronic device is provided, comprising: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to execute the executable instructions so that the electronic device implements a root cause analysis method as in the above technical solution.

[0010] According to one aspect of an embodiment of the present application, a computer program product is provided, including a computer program, and when the computer program is executed by a processor, the root cause analysis method in the above technical solution is implemented.

[0011] The technical solution provided by this application includes at least the following beneficial effects:

[0012] 1. This application uses the finite difference method to calculate the partial derivatives of the relationship formula of the derived indicators to obtain the explanatory power relationship formula of the derived indicators. The explanatory power corresponding to each dimensional combination in the derived indicators can be obtained through the predicted value and explanatory power relationship formula corresponding to each basic indicator. Finally, the root cause combination is determined through the surprise value and target explanatory power corresponding to each dimensional combination, thereby realizing the root cause analysis of the derived indicators.

[0013] 2. This application obtains the predicted value of the basic indicator by constructing a kernel density model based on the historical data corresponding to the basic indicator, which improves the accuracy of the predicted value and provides precise data support for subsequent root cause location, thereby improving the accuracy of root cause analysis.

[0014] 3. This application screens the dimension combinations in the cyclic recursive process through the surprise value and target explanatory power corresponding to each dimension combination, thereby reducing the interference of noise combinations and improving the recursive efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] The drawings herein are incorporated into the specification and constitute a part of the specification, showing embodiments consistent with the present application, and together with the specification, are used to explain the principles of the present application. Obviously, the drawings described below are only some embodiments of the present application, and for those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative work. In the drawings:

[0016] Figure 1 The figure is a schematic diagram of a process of a root cause analysis method provided in an embodiment of the present application;

[0017] Figure 2 Shown Figure 1 An exemplary flow chart of step S20 in FIG.

[0018] Figure 3 Shown is a schematic diagram of a kernel density curve provided in an embodiment of the present application;

[0019] Figure 4 Shown is another schematic diagram of a kernel density curve provided in an embodiment of the present application;

[0020] Figure 5 Shown is another schematic diagram of a kernel density curve provided in an embodiment of the present application;

[0021] Figure 6 Shown Figure 2 An exemplary flow chart of step S250 in FIG.

[0022] Figure 7 Shown Figure 1 An exemplary flow chart of step S60 in FIG.

[0023] Figure 8 Shown is a flow chart of another root cause analysis method provided in an embodiment of the present application;

[0024] Fig. 9 The figure is a schematic diagram of the structure of a root cause analysis device provided in an embodiment of the present application;

[0025] Fig.10 A schematic diagram of the structure of a computer system suitable for implementing an electronic device of an embodiment of the present application is shown. DETAILED DESCRIPTION

[0026] Here, exemplary embodiments will be described in detail, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are only examples of devices and methods consistent with some aspects of the present application as detailed in the attached claims.

[0027] The block diagrams shown in the accompanying drawings are merely functional entities and do not necessarily correspond to physically independent entities. That is, these functional entities may be implemented in software form, or in one or more hardware modules or integrated circuits, or in different networks and / or processor devices and / or microcontroller devices.

[0028] The flowcharts shown in the accompanying drawings are only exemplary and do not necessarily include all the contents and operations / steps, nor must they be executed in the order described. For example, some operations / steps can be decomposed, and some operations / steps can be combined or partially combined, so the actual execution order may change according to actual conditions.

[0029] It should also be noted that the "multiple" mentioned in this application refers to two or more than two. "And / or" describes the association relationship of the associated objects, indicating that there can be three relationships. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship.

[0030] The abbreviations and key terms in this application are defined as follows:

[0031] Basic indicators: simply decompose the indicator data based on the dimension values, and the values ​​are simply additive, such as product order volume and product visit volume; assuming that these indicators have the following dimensions: channel (values: mobile / web / third party), model (values: A / B / C), region (values: provinces); assuming that the indicators have been counted according to the above dimensions, you can cut out basic indicator data such as product A's web page order volume in Beijing and product C's third-party visit volume in Guangdong.

[0032] Derived indicator: an indicator calculated by multiplication or division of at least two basic indicators; for example: It is a derived indicator.

[0033] Dimension combination: Equivalent to a multi-dimensional array, a combination of values ​​in each dimension is used as a candidate combination for the root cause; among them, dimension combinations are divided into the following three categories:

[0034] (1) Complete dimension combination: Each dimension takes a specific value to achieve the finest granularity; for example: (webpage, A, Beijing);

[0035] (2) Partial dimension combination (also called incomplete dimension combination): some dimensions are allowed not to take specific values, and all possible values ​​are allowed on these dimensions; for example: (webpage, -, Beijing) means that the model dimension can take any value;

[0036] (3) Sub-dimension combination: If a dimension combination only adds a new value in one dimension compared to another dimension combination, then the dimension combination is a sub-dimension combination of that dimension combination;

[0037] For example: (webpage, A, Beijing) is the sub-dimension combination of (webpage, -, Beijing);

[0038] Example: (webpage, A, Beijing) is not a sub-dimension combination of (-, -, Beijing).

[0039] The inventors of this case have found through research that traditional root cause location problems are often limited to basic indicators. For such indicators, the indicator data can be simply decomposed by dimensional values, and the values ​​are simply additive (for example, the product order volume is 100, and when decomposed by channel, it can be simply obtained that mobile phone 40+web page 30+third party 30=100), and then various reference values ​​required by various algorithms are calculated. However, for derived indicators, the above method is more complicated, and the values ​​of each dimension cannot be simply obtained by addition (for example, product conversion rate is 0.2, mobile phone 0.15, web page 0.2, third party 0.4) or averaging. This has led to the failure of a large number of methods, and such indicators occupy a considerable proportion in the design business and should not be ignored; therefore, in order to solve the root cause analysis problem of derived indicators, this application provides the following embodiments:

[0040] Figure 1 FIG. 1 is a flow chart of a root cause analysis method provided in an embodiment of the present application; Figure 1 As shown, the method specifically comprises the following steps:

[0041] Step S10: Decompose the abnormal derivative indicator to obtain at least two basic indicators.

[0042] In this embodiment, the derived indicator is decomposed into two or more basic indicators according to the calculation formula between the derived indicator and the basic indicator; for example, when the derived indicator is the product conversion rate, according to The basic indicators obtained by breaking down the derived indicators into the following calculation formula are: product order volume and product visit volume.

[0043] It should also be noted that this embodiment can compare the current actual value of the derived indicator with the current predicted value to determine whether there is an abnormality in the derived indicator; for example: the current actual value of the product conversion rate is 30%, but the current predicted value obtained by the prediction model should be 60%. The current actual value and the current predicted value are quite different, so it can be determined that the derived indicator of product conversion rate is abnormal, and root cause location analysis is required to find out the dimensional combination that causes the abnormality.

[0044] Step S20: Obtain the predicted value corresponding to each basic indicator according to the kernel density model corresponding to each basic indicator.

[0045] In this embodiment, if Figure 2 As shown, according to the kernel density model corresponding to each basic indicator, obtaining the predicted value corresponding to each basic indicator specifically includes the following steps:

[0046] Step S210, obtaining historical indicator data of each basic indicator within a preset time period;

[0047] It should be noted that the preset time period refers to n hours or n days before the current time; this embodiment takes n days as an example, and sets the current day as t, then the preset time period is the historical indicator data corresponding to the time period from tn to the current day t.

[0048] Furthermore, the historical indicator data is preprocessed to obtain complete data of each dimension of the derived basic indicators, including: (1) data cleaning: removing null values ​​and outliers in the historical data to make each historical indicator data a complete dimensional combination; (2) periodic data extraction: selecting a default method based on the timestamp of the incoming data. For example, for data with one data point per hour, daily year-on-year comparison can be used; for data with one data point per day, weekly year-on-year comparison can be tried, etc.

[0049] For example, the historical indicator data of the basic indicators of product order volume and product visit volume within the preset time period are shown in Table 1 and Table 2:

[0050] Table 1. Historical indicator data of product order volume

[0051]

[0052] Table 2. Historical indicator data of product visits

[0053]

[0054] Step S220: According to the historical indicator data, the actual proportion of each basic indicator at each historical time point is obtained.

[0055] In this embodiment, the actual proportion value of each basic indicator at each historical time point represents the actual proportion value corresponding to each dimension value in each dimension of each basic indicator.

[0056] In this embodiment, the target dimension template is initialized according to the number of dimensions of the basic indicator, and the target dimension template includes the i-th dimension, i=[1,…,N], and N is the number of dimensions.

[0057] It should be noted that an empty target dimension template is defined as the starting point of the loop recursion; for example: the target dimension template is (-, -, -), the number of dimensions is 3, and none of the three dimensions has a value.

[0058] Optionally, a dimension whose dimension value in the target dimension template is empty is selected as the current recursive dimension; for example, the target dimension template includes a channel dimension, a model dimension and a region dimension; in the first recursive loop, the dimension values ​​in the target dimension template are all empty, so any dimension can be selected as the current recursive dimension, and in the next recursive loop, there may be an inserted value in the channel dimension in the target dimension template, and one can be selected from the product dimension and the region dimension as the current recursive dimension, until all dimensions in the target dimension template have dimension values, and the recursive loop ends.

[0059] Taking the current day t in Table 1 as an example, the dimension combination of product order volume includes channel dimension, model dimension and region dimension. The channel dimension includes mobile phone dimension value, web page dimension value and third-party dimension value. The model dimension includes dimension A value, dimension B value and dimension C value. The region dimension includes Beijing dimension value, Guangdong dimension value and Shanghai dimension value. On the current day t, the actual proportion corresponding to the mobile phone dimension value of the channel dimension is: The actual percentage of the webpage dimension value of the channel dimension is: The actual percentage of the third-party dimension value of the channel dimension is: Similarly, the values ​​of each dimension in other dimensions are calculated according to this method to obtain the corresponding actual proportion, as shown in Table 3:

[0060] Table 3. Actual proportion of each dimension value in each dimension

[0061]

[0062] Step S230: construct a kernel density model corresponding to each basic indicator according to the actual proportion of each basic indicator at each historical time point.

[0063] In this embodiment, a kernel density model corresponding to each basic indicator is constructed according to the actual proportion value of each basic indicator at each historical time point, that is, a kernel density model corresponding to each dimensional value is constructed according to all actual proportion values ​​corresponding to each dimensional value.

[0064] It should be noted that the kernel density model is composed of multiple kernel functions K (usually equal to the number of data points used for modeling). The shape of each kernel function is the kernel type. Take the more commonly used standard normal distribution function (mean 0, standard deviation 1) as an example:

[0065]

[0066] Assume that there is a set of data X=[x i ], the kernel density model constructs a kernel function on each data point, centered on the data point, and uses the bandwidth parameter h to adjust to control the width of each kernel function, such as Figure 3 As shown, the larger the bandwidth parameter h, the flatter the data distribution); note that at this time, the area under each kernel function is 1 (satisfactory for any probability density function). To ensure that the obtained kernel density model (the sum of each kernel function) satisfies this condition, define:

[0067]

[0068] in addition, Figure 4 The kernel density model is constructed using two data points. In this example, the kernel function corresponding to each data point has an equal weight in the kernel density model. In actual operation, you can assign any weight to the data point to achieve the desired effect.

[0069] The kernel density model f(x) defined by the above method is essentially a probability density function. Therefore, for any data point, a probability estimate (i.e., function output) can be directly obtained through this function. It should be noted that when there are many data points or the data is scattered, the output range of the probability density function may be low. Therefore, it is impossible to directly determine whether a data is an outlier (or abnormal point) through the absolute value of the probability estimate.

[0070] In this embodiment, for each dimension, there are n actual proportion values ​​within a preset time period, and kernel density modeling is performed based on the n actual proportion values. The kernel type in this embodiment selects the normal distribution function, and the bandwidth parameter is taken according to the thumb rule (Silverman's Rule) n is the number of data points, is the standard deviation; Yes, the bandwidth is 10^-3; the data weight decays at a rate of 0.9 for each data point.

[0071] For example, if the data in this embodiment is hourly, and the analysis is performed on a daily basis, assuming that there is data for the past 40 days, then n = 40. Calculated for 40 historical data points, the weight of the most recent day's data point is 1, the next most recent day is 0.9, ..., the most distant day is 0.9 39 .

[0072] Step S240: According to the kernel density model corresponding to each basic indicator, obtain the reference probability value and the current target probability value corresponding to each actual proportion value in each dimension value.

[0073] In this embodiment, the kernel density model corresponding to each basic indicator represents the kernel density model corresponding to each dimension value in each basic indicator, the reference probability value is the probability value corresponding to the actual proportion value in the historical data on the kernel density model, and the current target probability value is the probability value corresponding to the actual proportion value in the current data on the kernel density model; for example, if the kernel density model corresponding to a dimension value is Figure 5 As shown in the figure, taking x1~x7 as the actual proportion values, the ordinate values ​​corresponding to x1~x7 in the kernel density model are the reference probability values. Taking x5 as an example, the reference probability value corresponding to x5 is 0.62; assuming that the actual proportion value in the current data is 0.25, the corresponding current target probability value is 0.85.

[0074] Step S250: Calculate the predicted value corresponding to each basic indicator according to the reference probability value corresponding to each actual proportion value in each dimension value and the current target probability value.

[0075] like Figure 6 As shown, in this embodiment, according to the reference probability value corresponding to each actual proportion value in each dimension value and the current target probability value, calculating the predicted value corresponding to each basic indicator includes the following steps:

[0076] Step S251: Determine whether each dimension value needs to be recorded based on the comparison result of the current target probability value corresponding to each dimension value and all reference probability values ​​corresponding to each dimension value, and obtain the initial record array corresponding to each dimension.

[0077] In this embodiment, the step of comparing the current target probability value corresponding to each dimension value with all reference probability values ​​corresponding to each dimension value is:

[0078] First, the target reference value corresponding to all reference probability values ​​in the current dimension value is obtained; wherein the target reference value is a value that 95% of the reference probability values ​​in the current dimension value are greater than;

[0079] Secondly, compare the current target probability value with the target reference value. If the current target probability value is greater than or equal to the target reference value, it means that the current target probability value is the same as most of the historical data values, proving that there is no possibility of an abnormality in the current data point and there is no value in continuing to record it. On the contrary, if the current target probability value is less than the target reference value, it means that the current target probability value is a low-probability event and there is a high possibility of an abnormality. Therefore, the value of this dimension is recorded, and each dimension value under each dimension is looped through to obtain the corresponding initial record array under each dimension.

[0080] For example: taking the channel dimension as the current recursive dimension, if the current target probability value corresponding to the mobile phone dimension value is less than the target reference value, it is determined that the mobile phone dimension value needs to be recorded in the initial record array; if the current target probability value corresponding to the web page dimension value is greater than the target reference value, it is determined that the web page dimension value does not need to be recorded; if the current target probability value corresponding to the third-party dimension value is also less than the target reference value, it is determined that the third-party dimension value needs to be recorded; therefore, the initial record array corresponding to the channel dimension includes (mobile phone, -, -) and (third party, -, -).

[0081] It should also be noted that, for the dimensional combination of derived indicators, as long as the current target probability value corresponding to at least one basic indicator is less than the target reference value, the dimensional value corresponding to the derived indicator under this dimension must be recorded.

[0082] Step S252: Determine the predicted proportion value corresponding to each record value in the initial record array according to the kernel density model corresponding to each record value.

[0083] In this embodiment, the most likely value (i.e., the extreme point) in the kernel density model corresponding to each record value is used as the corresponding predicted proportion value; for example, Figure 5 In the kernel density model, the data point corresponding to the extreme point is 1.35, so the predicted proportion corresponding to the record value is 1.35; suppose the predicted proportions corresponding to (mobile phone, -, -) and (third party, -, -) are 0.7 and 0.8 respectively.

[0084] Step S253: Obtain the predicted value corresponding to each record value according to the predicted proportion value corresponding to each record value.

[0085] In this embodiment, the predicted proportion value is obtained according to the ratio of the predicted value of the dimension value to the predicted value of the dimension, and the actual data proportion is obtained according to the ratio of the actual data value of the dimension value to the total value of the dimension data. The calculation formulas are:

[0086]

[0087] Among them, Fd Indicates the predicted value of a certain dimension, F D A represents the sum of the predicted values ​​of all dimension values ​​under this dimension, and p represents the predicted proportion value corresponding to a certain dimension value, that is, the predicted proportion value corresponding to the recorded value; d Indicates the actual data value of a dimension. D It represents the sum of the actual data values ​​of all dimensions under this dimension, and q represents the actual data proportion of a certain dimension.

[0088] According to the above formula, F d =p×F D , P is the predicted proportion value obtained by the kernel density model, F D Represents the dimension prediction value of a certain dimension. In the first round of channel dimension recursion, F D is the predicted value of the total number of access orders, such as 1000; in the second round of product dimension recursion, F D It is the total number of orders for visits through mobile phones and the total number of orders for visits through third parties. At this time, p and F D All are known, and the predicted value F corresponding to each record value can be calculated d .

[0089] For example: Assume that the predicted proportions of (mobile phone, -, -) and (third party, -, -) are 0.7 and 0.8 respectively, F D =1000, then the predicted value corresponding to the recorded value (mobile phone, -, -) is 0.7×1000=700, and the predicted value corresponding to the recorded value (third party, -, -) is 0.8×1000=800.

[0090] In summary, the kernel density model is directly used to obtain predicted values ​​and determine whether a certain dimension combination is abnormal. The main reasons are as follows:

[0091] 1. The kernel density model is a nonparametric test method in probability theory that can reflect the distribution of historical data: (1) Its multi-kernel nature means that it can model discretely distributed data; (2) Its bandwidth (calculated by Silverman's Rule) can reflect the distribution of historical data in various value ranges; (3) Its kernel type is optional and can cope with different data types; among them, Gaussian distribution is the most common; (4) It allows data weighting to enhance the influence of recent data.

[0092] 2. The results after modeling are intuitive, as shown in the following: (1) After modeling the historical data, a probability density function is obtained; (2) This function can be used to obtain the probability that the current value conforms to the historical distribution; (3) By comparing the distribution of historical data with this, it is more scientific and credible than other methods with uncertain prediction accuracy.

[0093] 3. It can be used to obtain prediction values, specifically: (1) The value used for the kernel density model is the proportion of the values ​​of each dimension, strictly in the interval [0,1]; (2) The most likely value in the kernel density model is used as the prediction value, which can reflect the changes in historical data in real time; (3) When calculating the prediction value of the sub-dimension combination, the parent prediction value can be multiplied by the proportion;

[0094] 4. The calculation speed of the kernel density model has obvious advantages compared with other model methods.

[0095] Step S30: Calculate the partial derivative of the relational expression of the derived indicator based on the finite difference method to obtain the explanatory power relational expression of the derived indicator.

[0096] This embodiment uses explanatory power to evaluate the contribution of the change of dimension value d on a certain dimension D to the overall indicator abnormality, and its calculation formula is:

[0097]

[0098] Here A and F represent the predicted value and actual value of the original indicator as a whole.

[0099] Example: When traversing to (third party, -, Beijing):

[0100]

[0101] F (第三方，-，北京) =p×F (-，-，北京)

[0102]

[0103] In this embodiment, the calculation method of the explanatory power of the derived indicators adopts the algorithm of reference partial derivatives and finite difference calculus. For any derived indicator h(m1,…,m k ), that is, it is calculated by k basic indicators m. For a certain dimension combination d, its explanatory power is defined as the value after h normalization under the finite difference method.

[0104] Take the derived index of the division relationship as an example: The partial derivative with respect to d under the finite difference method is shown in formula (1):

[0105]

[0106] Referring to the definition of derivative, in the current context, the change Δ that needs to be evaluated is the difference between the expected value and the actual value, f and g are the numerator and denominator respectively. Therefore, the relationship expression of explanatory power is shown in formula (2):

[0107]

[0108] In formula (2), subscript 1 represents the basic indicator as the numerator, subscript 2 represents the basic indicator as the denominator, A and F are the actual value and the predicted value respectively; Δf is equivalent to A 1,d -F 1,d , Δg is equivalent to A 2,d -F 2,d ;therefore, It indicates the explanatory power of the derived indicator when the dimension value is d, A 1,d It represents the actual value of the basic indicator as a numerator when the dimension is d. 2,d Indicates the actual value of the basic indicator as the denominator when the dimension is d, F 1,d represents the predicted value of the basic indicator as a numerator in dimension d, F 2,d The basic indicator as the denominator is the predicted value when the dimension value is d. F1 represents the sum of the predicted values ​​corresponding to all the dimensional values ​​of the basic indicator as the numerator under this dimension. F2 represents the sum of the predicted values ​​corresponding to all the dimensional values ​​of the basic indicator as the denominator under this dimension.

[0109] Step S40: Obtain the explanatory power of the derived indicator according to the predicted value corresponding to each basic indicator and the explanatory power relationship.

[0110] It should be noted that in formula (2), F represents the predicted value corresponding to the dimension value of a certain dimension. 1,d 、F 2,d In step S20, it has been calculated by the kernel density model, indicating the actual value of A 1,d and A 2,d It is also known, so by substituting the predicted value into formula (2), the explanatory power of the derived indicator can be calculated; among them, the explanatory power of the derived indicator also means that each dimension value of each dimension corresponds to an explanatory power.

[0111] Step S50: Perform weight transformation on the explanatory power of the derived indicators to obtain the target explanatory power corresponding to each dimension combination in the derived indicators.

[0112] In this embodiment, the explanatory power of the derived indicators is weighted to obtain the target explanatory power corresponding to each dimensional combination in the derived indicators, including: obtaining the sum of the explanatory powers corresponding to the values ​​of each dimension under the current dimension; obtaining the weighted explanatory power corresponding to each dimensional combination according to the ratio of the explanatory power corresponding to the value of each dimension to the sum of the explanatory powers; multiplying the weighted explanatory power corresponding to each dimensional combination by the upper-level explanatory power to obtain the target explanatory power corresponding to each dimensional combination; wherein the upper-level explanatory power represents the explanatory power corresponding to the upper-level dimensional combination.

[0113] It should be noted that, referring to the definition of explanatory power, the sum of the global explanatory power of all possible complete combinations d should be 1, so only complete combinations are considered:

[0114]

[0115] The result obtained is the global explanatory power of d, that is, its contribution to the overall indicator change.

[0116] It should be noted that since the root causes are not always complete combinations in reality - for example, the dimensional combination (-, -, Beijing) may be a dimensional combination root cause that does not need to be further decomposed - in order to calculate the explanatory power of such root causes, and in order to avoid actually calculating the explanatory power of all complete combinations (which consumes a lot of computing power, as there are Cartesian products of all values ​​of all dimensions and different complete combinations), the global explanatory power in this embodiment is calculated step by step.

[0117] For example, if in the initial cycle, the dimension "channel" is being analyzed based on (-, -, -), then:

[0118] Explanatory power ( cell phone,-, -) +Explanatory power ( Web page,-,- ) +Explanatory power ( Third Party, -, - ) =1

[0119] Because the combination of these three dimensions constitutes a complete segmentation of the indicator, the sum of their explanatory power must be equal to the overall change. So for these three dimensions:

[0120]

[0121] When entering the next layer of loop, the global explanatory power needs to be multiplied by the value of the previous layer's explanatory power.

[0122] For example, in the above example, (mobile phone, -, -), the explanatory power is 0.8. In the next cycle, the three-dimensional combination of (mobile phone, A, -), (mobile phone, B, -), and (mobile phone, C, -) on the dimension of "model" is checked, and the calculation is

[0123] (Mobile phone, A, -) (Mobile phone, B, -) (Mobile phone, C, -) -0.3 0.8 1.5

[0124] It is necessary to normalize this layer first:

[0125] (Mobile phone, A, -) (Mobile phone, B, -) (Mobile phone, C, -) -0.15 0.4 0.75

[0126] The year-on-year changes of the three values ​​make the sum equal to 1; further, the global explanatory power d By multiplying the explanatory power of the upper layer by 0.8, we get:

[0127] (Mobile phone, A, -) (Mobile phone, B, -) (Mobile phone, C, -) -0.12 0.32 0.6

[0128] This essentially means allocating the 0.8 explanatory power of the upper-level dimension combination proportionally.

[0129] Step S60: Determine the root cause combination based on the surprise value and target explanatory power corresponding to each dimension combination.

[0130] like Figure 7 As shown, in this embodiment, based on the surprise value and target explanatory power corresponding to each dimension combination, determining the root cause combination specifically includes the following steps:

[0131] Step S610: Calculate the surprise value corresponding to each record value according to the predicted proportion value and the actual proportion value corresponding to each record value;

[0132] In this embodiment, the surprise value (i.e., Surprise value) is used to evaluate the difference between the actual value and the expected value of a dimension, and the calculation formula is:

[0133]

[0134] Where p and q in the formula represent the predicted proportion and the actual data proportion respectively. The surprise value in this embodiment can also be calculated between a certain incomplete dimension combination and all its sub-dimension combinations on a certain dimension, rather than being limited to the decomposition of the original indicator on a certain dimension as in the Adtributor algorithm.

[0135] Step S620: if the target explanatory power of the current record value is greater than the preset explanatory power, the current record value is recorded in the target record array;

[0136] It should be noted that the preset explanatory power is set according to the explanatory power threshold of the actual application scenario, for example 75%. If the target explanatory power of the record value is greater than 75%, the record value will be recorded in the target record array; according to the above example, if the global explanatory powers of (mobile phone, -, -) and (third party, -, -) are 78% and 80% respectively, then (mobile phone, -, -) and (third party, -, -) will both be recorded in the target record array.

[0137] Step S630: recursively loop all dimensions whose dimension values ​​are empty in the target dimension template to obtain a target record array;

[0138] According to the above steps, the product dimension and the regional dimension are traversed respectively. If the dimension combinations recorded in the target record array include: (-, A, -), (-, C, -) and (-, -, Beijing), plus the record combination of the channel dimension, the dimension combinations included in the target record array can be: (mobile phone, -, -), (third party, -, -), (-, A, -), (-, C, -) and (-, -, Beijing.

[0139] Step S640: According to the surprise value corresponding to each record value in the target record array, obtain the target dimension with the highest sum of surprise values ​​under the same dimension.

[0140] In this embodiment, each record value in the target record array corresponds to a surprise value, and the surprise values ​​under the same dimension are summed; for example: according to the above example, (mobile phone, -, -) and (third party, -, -) both belong to the channel dimension, and the surprise values ​​of the two are summed to obtain the sum of the surprise values ​​of the channel dimension; similarly, the sum of (-, A, -) and (-, C, -) is obtained by summing the surprise values ​​of the product dimension; the regional dimension has only one dimensional combination (-, -, Beijing), so the surprise value of (-, -, Beijing) is taken as the sum of the surprise values ​​of the regional dimension.

[0141] Furthermore, the dimension with the highest surprise value among the channel dimension, product dimension and region dimension is taken as the target dimension; in this embodiment, the surprise value and the highest value of the channel dimension are taken as an example.

[0142] Step S650: Combine all values ​​of the target dimension in the target record array with the target dimension template to obtain at least one target dimension combination.

[0143] In this example, the channel dimension is used as the target dimension. All values ​​of the target dimension in the target record array are (mobile phone, -, -) and (third party, -, -). The target dimension template is (-, -, -). The target dimension combination obtained by combining all values ​​of the target dimension in the target record array and the target dimension template is (mobile phone, -, -) and (third party, -, -).

[0144] Step S660: loop through the at least one target dimension combination to obtain the target sub-dimension combination with the highest surprise value under each target dimension combination.

[0145] It should be noted that the newly generated target dimension combination is used as the initialization target dimension template, and each target dimension combination is looped through according to the above steps S610 to S650 until all dimensions are exhausted or no dimension is recorded in a certain loop, so as to obtain the target sub-dimension combination with the highest surprise value under each target dimension combination.

[0146] For example: If the current target dimension combination is (-, -, Beijing), and in step S640 it is found that the "model" dimension records the two values ​​"A" and "C" and the total surprise is the largest, then continue to apply steps S610 to S650 to (-, A, Beijing) and (-, C, Beijing) to obtain the corresponding sub-dimension combination.

[0147] Step S670: store the at least one target dimension combination and the target sub-dimension combination corresponding to each target dimension combination into a root cause result set to obtain a root cause combination that affects the abnormality of the derived indicator.

[0148] In this embodiment, the multidimensional root causes recorded in the previous stage are recursively performed, which may cause dimension combinations with inclusion relationships to be listed as root causes in the result set at the same time. For example, (-, -, Beijing) and (-, Jia, Beijing) are recorded at the same time. At this time, it is necessary to determine whether to list the two as different root cause results. The specific steps are as follows:

[0149] Step S671: Obtain each incomplete dimension combination in the root cause result set.

[0150] Step S672: Obtain the sub-dimension combination corresponding to each incomplete combination from the root cause result set.

[0151] Step S673: Calculate the sum of the target explanatory powers of the sub-dimension combinations corresponding to each incomplete combination.

[0152] Step S674: If the sum of the target explanatory powers is greater than the target explanatory power of the incomplete dimension combination, and the difference between the sum of the target explanatory powers and the target explanatory power exceeds a preset threshold, the incomplete dimension combination is removed from the root cause result set.

[0153] Step S675: Take the dimension combination with the target explanatory power in the top N preset places in the current root cause result set as the root cause combination.

[0154] It should be noted that the check should start from the simplest dimension combination (the one with the least determined value), and for each incomplete dimension combination, all its sub-dimension combinations in the result set should be checked; for example: for (-, A, Beijing), it should be checked whether (mobile phone, A, Beijing)(webpage, A, Beijing)(third party, A, Beijing) are in the result set.

[0155] Furthermore, the sum of the explanatory power of the sub-dimension combinations in the result set is calculated. If it exceeds 75% of its own explanatory power, the dimension combination will be removed.

[0156] Optionally, if required, the TopN results can be retained as root cause combinations based on explanatory power.

[0157] It should be noted that this embodiment recursively discovers the root causes of dimensions through surprise value and explanatory power, which has the following advantages:

[0158] 1. Learn from the experience of some excellent algorithms in single-dimensional root cause analysis, specifically: (1) There are several known effective methods in single-dimensional root cause analysis, and the essence of them is selected; (2) Surprise value is an effective method to evaluate the abnormal amplitude of a certain dimension value; (3) Explanatory power is a measurement method that directly reflects the relationship between root cause and indicator abnormality; (4) When analyzing sub-dimension combinations, the upper-level dimension combination can be regarded as an indicator to apply a single indicator analysis method, and the transition is natural; (5) The expected value and explanatory power can be recursively passed down to ensure the consistency of the algorithm process.

[0159] 2. The advantages of recursive application in multi-dimensional root cause algorithms are as follows: (1) Each layer recursively selects a dimension with the largest surprise (i.e., anomaly) for analysis, which is in line with human thinking and ensures that the results are focused on significant root causes first; (2) Each dimension combination is analyzed only once, saving computing power; for example, (a, b) will not be analyzed twice from the two parent nodes (a, -) and (-, b) as in traditional multi-dimensional methods. This method only determines the magnitude of the anomaly in the two dimensions; (3) The recursive structure can naturally determine whether a root cause needs to be further decomposed, that is, by judging whether its sub-dimensional combination has an abnormal change that is sufficient to become a root cause. This can become a good early stopping condition to prevent wasting computing power on fragmented branches; (4) The recursive structure can naturally determine the upward connection of the sub-root cause, that is, if the current dimension combination change is used as a benchmark, its sub-dimensional combination can become the current dimension again. If the root cause of the sub-dimension combination is found, then this sub-dimension combination is the root cause of the overall change of the indicator, and the recursive algorithm can continue to go deeper along this logic: ① Example: If it is found that (-, -, Beijing) has increased by 20% as a possible root cause, and through the next level of recursion, it is found that one or more of its sub-dimensions, such as (-, Jia, Beijing) and (-, C, Beijing) fully explain the 20% increase, then (-, Jia, Beijing) and (-, C, Beijing) are the effective root causes worthy of being included in the result; ② Example: On the contrary, if it is found that (-, -, Beijing) has increased by 20% as a possible root cause, and the next level of recursion cannot explain the 20% change through the root cause, it proves that this dimension combination is sufficient to be included as an effective root cause as an independent result; ③ This point corresponds to the ripple effect of the existing method. It does not make too many assumptions about the data when the anomaly occurs, and only analyzes whether it is possible and necessary to continue to seek more fine-grained root causes based on the data itself.

[0160] (5) The recursive structure attempts to exhaust all dimensions, so the algorithm can find the true root even if it is a combination of all dimensions.

[0161] (6) The root causes discovered by the recursive structure have a natural order, and using this as an example makes the construction results more intuitive.

[0162] In addition, this embodiment modifies the prediction value and the surprise and explanatory power calculation formulas to ensure that the zero value at a finer granularity does not interfere with the calculation (all formulas are still valid when the zero value appears); the basic indicators and derived indicators will show the explanatory power for each root cause in the results, and the explanatory power in both scenarios intuitively reflects the contribution of the root cause to the indicator anomaly.

[0163] The technical solution provided in this embodiment has at least the following beneficial effects:

[0164] This application calculates the partial derivatives of the relationship formula of the derived indicators based on the finite difference method to obtain the explanatory power relationship formula of the derived indicators. The explanatory power corresponding to each dimensional combination in the derived indicators can be obtained through the predicted value and explanatory power relationship formula corresponding to each basic indicator. Finally, the root cause combination is determined through the surprise value and target explanatory power corresponding to each dimensional combination, thereby realizing the root cause analysis of the derived indicators.

[0165] Furthermore, the present application obtains the predicted values ​​of the basic indicators by constructing a kernel density model based on the historical data corresponding to the basic indicators, thereby improving the accuracy of the predicted values ​​and providing precise data support for subsequent root cause location, thereby improving the accuracy of root cause analysis.

[0166] Furthermore, the present application screens the dimension combinations in a cyclic recursive process through the surprise value and target explanatory power corresponding to each dimension combination, thereby reducing the interference of noise combinations and improving the recursive efficiency.

[0167] In another embodiment of the present application, the complete process of the root cause analysis method provided in this embodiment is as follows: Figure 8 As shown in the figure, it includes three stages: data preprocessing, recursive deepening and result convergence; the specific steps are:

[0168] 1. Data preprocessing stage

[0169] The original indicator data needs to be preprocessed in order to apply this embodiment, and the following effects should be achieved: there are no unprocessable error values ​​in the data, the derived indicator data is disassembled and the data periodicity is confirmed, and the data is sorted according to the periodicity; wherein the data preprocessing stage specifically includes the following steps:

[0170] (1) Basic data cleaning: read and check whether there are null values ​​or abnormal values ​​in the data;

[0171] (2) Indicator decomposition: If it is a derived indicator, prepare the data used to calculate the derived indicator (e.g. numerator and denominator) according to the actual situation;

[0172] (3) Confirm data periodicity and organize data: This step is not to actively discover data periodicity. In theory, data periodicity should be discovered during the anomaly discovery stage. This step is only to obtain known data periodicity; or when there is no periodicity, a default method is selected based on the timestamp of the incoming data: for example, if there is one data point per hour, daily year-on-year comparison can be used; if there is one data point per day, weekly year-on-year comparison can be tried. Based on the obtained period, the corresponding data points are extracted from the original data, and the indicator data is split according to all complete dimension combinations for subsequent analysis.

[0173] 2. Recursive Deepening Stage

[0174] (1) Start: Define an empty dimension combination as the target dimension combination as the starting point of the recursion;

[0175] Example: (-, -, -): There are no values ​​for the three dimensions. If there is no overall prediction value for each basic indicator, a total prediction value is calculated for each basic indicator at the same time, and kernel density modeling is performed according to the method (a) in the following steps (3), and the maximum value of the kernel density model is taken as the indicator prediction value.

[0176] It is important to note that you should not calculate the forecast value of the derived indicator itself, but calculate the forecast value for each basic indicator used for calculation. For example, the forecast value of product order volume is 500 and the product visit volume is 1500.

[0177] (2) Data reduction: Filter data according to the current target dimension combination.

[0178] Subsequent recursive loops will only deeply explore the sub-dimension combinations of the target dimension combination, so the data that does not conform to the current dimension combination can be directly removed to save computing resources; for example: if the current value is (-, -, Beijing): then all data where the region is not equal to Beijing will be removed.

[0179] (3) Traverse expandable dimensions: traverse all dimensions whose values ​​are not currently determined in the target dimension combination; for example, if the current value is (-, -, Beijing), you can select the dimension "channel" or "model".

[0180] During the traversal process, each basic indicator calculates the proportion of the values ​​of each dimension in the current dimension (all data points); for example: when traversing to the channel dimension, the proportion of (mobile phone, -, Beijing)(web page, -, Beijing)(third party, -, Beijing) in all data points of product order volume and product visit volume is calculated.

[0181] Traverse each dimension and take the value of each dimension separately:

[0182] (a) Kernel density modeling is performed on the historical data of the proportion of each basic indicator, and the value with the highest probability in the kernel density model after modeling is taken as the expected value of the proportion.

[0183] Kernel type: normal distribution; bandwidth: according to Silverman's Rule n is the number of data points, is the standard deviation; Yes, the bandwidth is 10^-3. Data weight: decay at a rate of 0.9 for each data point.

[0184] Example: If the data is at the hourly level, and the analysis is performed on a daily basis, assuming that there is data for the past 40 days,

[0185] Then n = 40, Calculated for 40 historical data points: the weight of the most recent day's data point is 1, the next most recent day is 0.9, ..., the most distant day is 0.9 39 .

[0186] (b) Calculate the estimated probability value of each basic indicator historical data point in the kernel density model;

[0187] (c) Calculate whether the estimated probability value of the current data point of each basic indicator in the kernel density model exceeds the 5% quantile of the historical value;

[0188] (d) If at least one basic indicator meets the conditions in (c), calculate the Surprise under the value of this dimension. For the Surprise of each basic indicator:

[0189] The q value is the proportion of the actual value, which has been calculated at the beginning of step (3); the p value is the maximum value of the probability estimate in the kernel density model, which is the proportion of the expected value.

[0190] Example: When traversing to (third party, -, Beijing), for the product order quantity:

[0191]

[0192] The Surprise value of a derived indicator is the sum of the Surprise values ​​of all the basic indicators used to calculate the derived indicator.

[0193] (e) Calculate the explanatory power of the dimension value: The calculation method of the explanatory power of the derived indicator adopts the algorithm of reference partial derivatives and finite difference calculus. For any derived indicator h(m1,…,m K ), that is, it is calculated by k basic indicators m, and for a certain dimension combination d, its explanatory power is defined as the value after h normalization under the finite difference method.

[0194] It should be noted that: for each basic indicator, the predicted value F 1,D =p1×F 1,D ..., subscript 1 represents the first basic indicator.

[0195] Example: When traversing to (third party, -, Beijing):

[0196] F 1,(第三方，-，北京) =p1×F 1,(-，-，北京)

[0197] Here, 1 refers to the molecular index.

[0198] (f) If the explanatory power is greater than a preset threshold, record the value of this dimension.

[0199] (4) Dimension selection: Evaluate the total surprise recorded in each dimension and select the dimension with the largest value.

[0200] (5) Combination expansion: Combine each recorded dimension value in this dimension with the current target dimension combination, and record the combined dimension combination in the result set.

[0201] (6) Then apply steps (2)-(6) with the newly generated target dimension combination until all dimensions are exhausted or no dimension is recorded in a certain cycle. Note that the prediction value and explanatory power of each basic indicator in the previous step need to be retained and passed to the next cycle for the subsequent prediction value calculation in (3) (d) and (e) and the global explanatory power calculation in (e).

[0202] For example, if the current value is (-, -, Beijing), and it is found from (3) that the model dimension records two values, A and C, and the total surprise is the largest, then apply steps (2) to (-, A, Beijing) and (-, C, Beijing).

[0203] 3. Result convergence stage

[0204] The multi-dimensional root causes recorded in the previous stage are recursive, which may cause dimension combinations with inclusion relationships to be listed as root causes in the result set at the same time. For example, (-, -, Beijing) and (-, Jia, Beijing) are recorded at the same time. At this time, it is necessary to determine whether to list the two as different root cause results. The method is as follows:

[0205] (1) Start checking from the simplest dimension combination (the one with the least certain value). For each incomplete dimension combination, check all its sub-dimension combinations in the result set. For example, for (-, A, Beijing), check whether (mobile phone, A, Beijing)(webpage, A, Beijing)(third party, A, Beijing) are in the result set.

[0206] (2) The sum of the explanatory power of the sub-dimension combinations in the result set is calculated. If it exceeds 75% of its own explanatory power, the dimension combination will be removed.

[0207] (3) If necessary, the TopN results can be retained based on explanatory power.

[0208] In summary, the root cause analysis method provided by this application has at least the following beneficial effects:

[0209] 1. Data compatibility

[0210] In the related technologies, it is not possible to effectively support the root cause analysis of derived indicators in multidimensional analysis scenarios. This application proposes a multidimensional root cause location method that is compatible with basic indicators and derived indicators, which has a wider range of application scenarios. In addition, other root cause analyses have many assumptions about data, including that the predicted / actual value cannot be 0, or that the ripple effect is established, etc. These assumptions often face challenges in multidimensional analysis scenarios, and the most fine-grained dimension combination often cannot maintain the above assumptions due to the small sample size. The method proposed in this application does not require these assumptions. Compared with similar Adtributor-like algorithms, this application improves the calculation caliber of Surprise and explanatory power, ensuring that the lack of the above assumptions will not affect the normal operation and numerical stability of the algorithm; in a wider comparison, this application can be compatible with more diverse data forms.

[0211] 2. Root cause location

[0212] In addition to the above points, this application uses a kernel density model for analysis when cutting the dimension values ​​in multidimensional analysis. This model can heuristically reflect the distribution of historical data and has good compatibility with discrete distribution. Using the kernel density analysis results as a method to determine whether a root cause exists is more scientific than other methods that simply use explanatory power or numerical difference as a criterion (these methods all need to be based on predicted values, but the acquisition of predicted values ​​itself is prone to errors), and has a lower misjudgment rate while maintaining recognition capabilities.

[0213] In addition, the results of kernel density modeling can also be used to better obtain prediction values. Obtaining prediction values ​​is a common pain point for almost all root cause algorithms. Compared with the rigid preset fixed value method or various unstable simple statistical methods (such as sliding average, etc.), kernel density analysis allows this algorithm to effectively analyze historical data, obtain more reasonable prediction values, and improve the overall effect of the algorithm.

[0214] The purpose of multidimensional root cause analysis is to efficiently obtain the dimension combinations that may be the root cause. The method proposed in this application essentially covers three loop stopping strategies to prevent the problem of search computing power consumption that is easy to occur in other methods: (1) recursive loop advancement, but only one dimension with the most obvious change is selected each time. The existence of the loop ensures that the real root cause will be touched, and only one dimension is selected to ensure that the path to locate the root cause will not be repeated; (2) any loop deepening will stop when all sub-dimension combinations are normal, preventing excessive disassembly of the discovered root cause; (3) each dimension combination is globally verified to prevent computing power from being wasted on locating overly fragmented dimension combinations.

[0215] 3. Result output

[0216] The method proposed in this application designs a convergence step before the result output, so as to ensure that the output result is the simplest form that retains the maximum information. The logic of convergence is as described above. If the abnormal explanatory power of the sub-dimension combination can fully cover the explanatory power of the super-dimension combination, then it is obvious that these sub-dimension combinations themselves constitute the root cause of the super-dimension combination, indicating that the decomposition of the super-dimension combination is still incomplete and should be removed from the result.

[0217] The output of the method of the present application not only locates the root cause as the conventional method does, and can give the expected value and actual value of the root cause, but also calculates the explanatory power value that has practical meaning in both the basic index and the derived index. This value has two advantages: (1) This value achieves the step-by-step decomposition of the root cause effectiveness, making the direct relationship and comparison of the root causes at different levels (fixed dimension value number) in the result set more intuitive; (2) The explanatory power assumes that the total anomaly of the current index is 1, and the contribution of each root cause to this anomaly can be intuitively reflected.

[0218] In the actual application scenario of the present application, since the process record of the recursive method is complete and conforms to intuitive thinking, it is easier to visualize the results (even the process), further improving the comprehensibility of the results.

[0219] Fig. 9 FIG. 1 is a schematic diagram of the structure of a root cause analysis device provided in an embodiment of the present application; Fig. 9 As shown, the device comprises:

[0220] An indicator decomposition module 910 is used to decompose the abnormal derivative indicator to obtain at least two basic indicators;

[0221] A prediction value acquisition module 920 is used to acquire a prediction value corresponding to each basic indicator according to a kernel density model corresponding to each basic indicator;

[0222] A relational expression acquisition module 930 is used to obtain a partial derivative of the relational expression of the derived indicator based on a finite difference method to obtain an explanatory power relational expression of the derived indicator;

[0223] An explanatory power acquisition module 940, configured to obtain the explanatory power of the derived indicator according to the predicted value corresponding to each basic indicator and the explanatory power relationship;

[0224] A weight conversion module 950 is used to perform weight conversion on the explanatory power of the derived indicators to obtain the target explanatory power corresponding to each dimension combination in the derived indicators;

[0225] The root cause determination module 960 is used to determine the root cause combination based on the surprise value and target explanatory power corresponding to each dimension combination.

[0226] Fig.10A schematic diagram of the structure of a computer system suitable for implementing an electronic device of an embodiment of the present application is shown.

[0227] It should be noted that Fig.10 The computer system 1000 of the electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0228] like Fig.10 As shown, the computer system 1000 includes a central processing unit (CPU) 1001, which can perform various appropriate actions and processes according to the program stored in the read-only memory (ROM) 1002 or the program loaded from the storage part 1008 to the random access memory (RAM) 1003, such as executing the method described in the above embodiment. In the RAM 1003, various programs and data required for system operation are also stored. The CPU 1001, the ROM 1002 and the RAM 1003 are connected to each other through the bus 1004. The input / output (I / O) interface 1005 is also connected to the bus 1004.

[0229] The following components are connected to the I / O interface 1005: an input section 1006 including a keyboard, a mouse, etc.; an output section 1007 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 1008 including a hard disk, etc.; and a communication section 1009 including a network interface card such as a LAN (Local Area Network) card, a modem, etc. The communication section 1009 performs communication processing via a network such as the Internet. A drive 1010 is also connected to the I / O interface 1005 as needed. A removable medium 1011, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 1010 as needed so that a computer program read therefrom is installed into the storage section 1008 as needed.

[0230] In particular, according to an embodiment of the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present application includes a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a computer program for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication section 1009, and / or installed from a removable medium 1011. When the computer program is executed by a central processing unit (CPU) 1001, various functions defined in the system of the present application are executed.

[0231] It should be noted that the computer-readable medium shown in the embodiment of the present application can be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium can be, for example, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media can include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM), a flash memory, an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, a computer-readable storage medium can be any tangible medium containing or storing a program, which can be used by an instruction execution system, device or device or used in combination with it. In the present application, a computer-readable signal medium can include a data signal propagated in a baseband or as a part of a carrier wave, wherein a computer-readable computer program is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, which may send, propagate, or transmit programs for use by or in conjunction with an instruction execution system, apparatus, or device. The computer program contained on the computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0232] The flowchart and block diagram in the accompanying drawings illustrate the possible architecture, functions and operations of the system, method and computer program product according to various embodiments of the present application. Wherein, each box in the flowchart or block diagram can represent a module, a program segment, or a part of the code, and the above-mentioned module, program segment, or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flowchart, and the combination of boxes in the block diagram or flowchart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0233] The units involved in the embodiments described in this application may be implemented by software or hardware, and the units described may also be set in a processor. The names of these units do not, in some cases, constitute limitations on the units themselves.

[0234] The above content is only a preferred exemplary embodiment of the present application and is not intended to limit the implementation scheme of the present application. A person skilled in the art can easily make corresponding changes or modifications based on the main concept and spirit of the present application. Therefore, the scope of protection of the present application shall be based on the scope of protection required by the claims.

Claims

1. A root cause analysis method, characterized in that: The method comprises: Decompose the abnormal derivative indicators to obtain at least two basic indicators; According to the kernel density model corresponding to each basic indicator, obtain the predicted value corresponding to each basic indicator; Based on the finite difference method, the partial derivative of the relational expression of the derived index is obtained to obtain the explanatory power relational expression of the derived index; According to the predicted value corresponding to each basic indicator and the explanatory power relationship, the explanatory power of the derived indicator is obtained; The explanatory power of the derived indicators is weighted and transformed to obtain the target explanatory power corresponding to each dimension combination in the derived indicators; Based on the surprise value and target explanatory power corresponding to each dimension combination, the root cause combination is determined.

2. The method according to claim 1, characterized in that According to the kernel density model corresponding to each basic indicator, the predicted value corresponding to each basic indicator is obtained, including: Obtain historical indicator data for each basic indicator within a preset time period; According to the historical indicator data, the actual proportion of each basic indicator at each historical time point is obtained; According to the actual proportion of each basic indicator at each historical time point, a kernel density model corresponding to each basic indicator is constructed; According to the kernel density model corresponding to each basic indicator, obtain the reference probability value and the current target probability value corresponding to each actual proportion value in each dimension value; wherein the reference probability value is the probability value corresponding to the actual proportion value in the historical data on the kernel density model, and the current target probability value is the probability value corresponding to the actual proportion value in the current data on the kernel density model; According to the reference probability value corresponding to each actual proportion value in each dimension value and the current target probability value, the predicted value corresponding to each basic indicator is calculated.

3. The method according to claim 2, characterized in that According to the reference probability value corresponding to each actual proportion value in each dimension value and the current target probability value, the predicted value corresponding to each basic indicator is calculated, including: According to the comparison result of the current target probability value corresponding to each dimension value and all reference probability values ​​corresponding to each dimension value, determine whether each dimension value needs to be recorded, and obtain the initial record array corresponding to each dimension; Determine the predicted proportion value corresponding to each record value in the initial record array according to the kernel density model corresponding to each record value; According to the predicted proportion value corresponding to each record value, the predicted value corresponding to each record value is obtained; wherein the predicted value corresponding to each basic indicator includes the predicted value corresponding to the corresponding record value.

4. The method according to claim 3, characterized in that According to the comparison results of the current target probability value corresponding to each dimension value and all reference probability values ​​corresponding to each dimension value, determine whether each dimension value needs to be recorded, including Obtaining a target reference value corresponding to all reference probability values ​​in the current dimension value; wherein the target reference value is a value that a preset percentage of reference probability values ​​in the current dimension value are greater than; The current target probability value is compared with the target reference value. If the current target probability value is less than the target reference value, it is determined that the current dimension value needs to be recorded.

5. The method according to claim 1, characterized in that When the explanatory power relationship of the derived indicator includes: in, It indicates the explanatory power of the derived indicator when the dimension value is d, A 1,d It represents the actual value of the basic indicator as a numerator when the dimension is d. 2,d Indicates the actual value of the basic indicator as the denominator when the dimension is d, F 1,d represents the predicted value of the basic indicator as a numerator in dimension d, F 2,d The basic indicator as the denominator is the predicted value when the dimension value is d. F1 represents the sum of the predicted values ​​corresponding to all the dimensional values ​​of the basic indicator as the numerator under this dimension. F2 represents the sum of the predicted values ​​corresponding to all the dimensional values ​​of the basic indicator as the denominator under this dimension.

6. The method according to claim 1, characterized in that The explanatory power of the derived indicators is transformed by weight to obtain the target explanatory power corresponding to each dimension combination in the derived indicators, including: Get the sum of the explanatory power corresponding to the value of each dimension under the current dimension; According to the ratio of the explanatory power corresponding to the value of each dimension to the sum of the explanatory powers, the weighted explanatory power corresponding to each dimension combination is obtained; The weighted explanatory power corresponding to each dimensional combination is multiplied by the upper-level explanatory power to obtain the target explanatory power corresponding to each dimensional combination; wherein the upper-level explanatory power represents the explanatory power corresponding to the upper-level dimensional combination.

7. The method according to claim 3, characterized in that Based on the surprise value and target explanatory power corresponding to each dimension combination, the root cause combination is determined, including: Calculate the surprise value corresponding to each record value according to the predicted proportion value and the actual proportion value corresponding to each record value; If the target explanatory power of the current record value is greater than the preset explanatory power, the current record value is recorded in the target record array; Recursively loop through all dimensions whose dimension values ​​are empty in the target dimension template to obtain the target record array; According to the surprise value corresponding to each record value in the target record array, obtaining the target dimension with the highest sum of surprise values ​​under the same dimension; Combine all values ​​of the target dimension in the target record array with the target dimension template to obtain at least one target dimension combination; Loop through the at least one target dimension combination to obtain the target sub-dimension combination with the highest surprise value under each target dimension combination; The at least one target dimension combination and the target sub-dimension combination corresponding to each target dimension combination are stored in a root cause result set to obtain a root cause combination that affects the abnormality of the derived indicator.

8. The method according to claim 7, characterized in that The at least one target dimension combination and the target sub-dimension combination corresponding to each target dimension combination are stored in a root cause result set to obtain a root cause combination that affects the abnormality of the derived indicator, including: Obtain each incomplete dimension combination in the root cause result set; Acquire a sub-dimension combination corresponding to each incomplete combination from the root cause result set; Calculate the sum of the target explanatory power of the sub-dimension combination corresponding to each incomplete combination; If the sum of the target explanatory powers is greater than the target explanatory power of the incomplete dimension combination, and the difference between the sum of the target explanatory powers and the target explanatory power exceeds a preset threshold, the incomplete dimension combination is removed from the root cause result set; The dimension combination with the target explanatory power in the preset top N in the current root cause result set is taken as the root cause combination.

9. A root cause analysis device, characterized in that: The device comprises: The indicator disassembly module is used to disassemble the abnormal derivative indicator to obtain at least two basic indicators; A prediction value acquisition module is used to obtain the prediction value corresponding to each basic indicator according to the kernel density model corresponding to each basic indicator; A relational expression acquisition module is used to obtain partial derivatives of the relational expression of the derived indicator based on the finite difference method to obtain the explanatory power relational expression of the derived indicator; An explanatory power acquisition module, used to obtain the explanatory power of the derived indicator according to the predicted value corresponding to each basic indicator and the explanatory power relationship; The weight conversion module is used to perform weight conversion on the explanatory power of the derived indicators to obtain the target explanatory power corresponding to each dimension combination in the derived indicators; The root cause determination module is used to determine the root cause combination based on the surprise value and target explanatory power corresponding to each dimension combination.

10. An electronic device, characterized in that: include: processor; as well as A memory for storing executable instructions of the processor; wherein the processor is configured to execute the executable instructions to enable the electronic device to implement the root cause analysis method as described in any one of claims 1 to 8.

Images