Abnormality monitoring method, device, equipment, and computer-readable storage medium

Abstract

The embodiments of the present disclosure provide a method, apparatus, device, and computer-readable storage medium for abnormal monitoring. The method includes: receiving monitoring indicator information, the monitoring indicator information indicating the target data to be monitored in the database; determining data monitoring rules based on the monitoring indicator information, the data monitoring rules are used to perform query and monitoring operations on the target data in the database; configuring data anomaly rules for the target data, the data anomaly rules are used to determine whether the queried target data is in an abnormal state; and performing an abnormal monitoring operation on the target data based on the data monitoring rules and the data anomaly rules. According to the scheme of the present disclosure, the target data to be detected is determined based on the monitoring indicator information, and the abnormal monitoring operation is performed based on the data monitoring rules and the data anomaly rules, so that the data to be monitored can be flexibly selected and there is no need to redevelop the monitoring logic according to different data.

Description

Technical Field

[0001] Example embodiments of the present disclosure generally relate to the field of computer technology, and more particularly, to a method, apparatus, device, and computer-readable storage medium for abnormality monitoring. Background Art

[0002] With the increasing popularity of using business intelligence reports for data analysis, the data size and complexity of report data are gradually increasing, and enterprises' demand for data anomaly monitoring is also increasing. In related technologies, some data anomaly monitoring solutions require developers to manually write monitoring alarm rules according to monitoring requirements, which consumes a lot of time and human resources. Other solutions are to uniformly configure anomaly monitoring rules for existing data indicators in the report according to agreed rules, but this solution cannot be flexibly adjusted and modified according to actual needs, and lacks flexibility and applicability. Therefore, a more flexible and efficient anomaly detection solution is needed to deal with these problems. Summary of the invention

[0003] In a first aspect of the present disclosure, a method for abnormal monitoring is provided. The method includes: receiving monitoring indicator information, the monitoring indicator information indicating target data to be monitored in a database; determining data monitoring rules based on the monitoring indicator information, the data monitoring rules being used to perform query and monitoring operations on the target data in the database; configuring data anomaly rules for the target data, the data anomaly rules being used to determine whether the queried target data is in an abnormal state; and performing an abnormal monitoring operation on the target data based on the data monitoring rules and the data anomaly rules.

[0004] In a second aspect of the present disclosure, a device for abnormal monitoring is provided. The device includes: a receiving module configured to receive monitoring indicator information, the monitoring indicator information indicating the target data to be monitored in the database; a monitoring module configured to determine a data monitoring rule based on the monitoring indicator information, the data monitoring rule is used to perform query and monitoring operations on the target data in the database; an abnormal module configured to configure a data abnormality rule for the target data, the data abnormality rule is used to determine whether the queried target data is in an abnormal state; and an execution module configured to perform an abnormal monitoring operation on the target data based on the data monitoring rule and the data abnormality rule.

[0005] In a third aspect of the present disclosure, an electronic device is provided. The electronic device includes at least one processing unit; and at least one memory, the at least one memory is coupled to the at least one processing unit and stores instructions for execution by the at least one processing unit, and when the instructions are executed by the at least one processing unit, the electronic device executes the method of the first aspect of the present disclosure.

[0006] In a fourth aspect of the present disclosure, a computer-readable storage medium is provided, wherein a computer program is stored on the computer-readable storage medium, and the computer program can be executed by a processor to perform the method according to the first aspect of the present disclosure.

[0007] It should be understood that the contents described in the summary of the invention are not intended to limit the key features or important features of the embodiments of the present disclosure, nor are they intended to limit the scope of the present disclosure. Other features of the present disclosure will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0008] In the following, in conjunction with the accompanying drawings and with reference to the following detailed description, the above and other features, advantages and aspects of various implementations of the present disclosure will become more apparent. In the accompanying drawings, the same or similar reference numerals represent the same or similar elements, wherein:

[0009] Figure 1 A schematic diagram showing an example environment in which embodiments of the present disclosure can be implemented;

[0010] Figure 2 A flowchart showing a process for anomaly monitoring according to some embodiments of the present disclosure is shown;

[0011] Figure 3A A flowchart showing a process of determining data monitoring rules according to some embodiments of the present disclosure;

[0012] Figure 3B A flowchart showing a process of performing anomaly monitoring according to some embodiments of the present disclosure is shown;

[0013] Figure 3C A flowchart showing a process of performing anomaly monitoring according to some embodiments of the present disclosure is shown;

[0014] Figure 3D A flowchart showing a process of performing anomaly monitoring based on data anomaly rules according to some embodiments of the present disclosure is shown;

[0015] Figure 4 A block diagram showing an apparatus for interface creation according to some embodiments of the present disclosure; and

[0016] Figure 5 A block diagram of an electronic device is shown in which one or more embodiments of the present disclosure may be implemented. DETAILED DESCRIPTION

[0017] Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although some embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be construed as being limited to the embodiments described herein. On the contrary, these embodiments are provided to provide a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are only for exemplary purposes and are not intended to limit the scope of protection of the present disclosure.

[0018] In the description of the embodiments of the present disclosure, the term "including" and similar terms should be understood as open inclusion, that is, "including but not limited to". The term "based on" should be understood as "based at least in part on". The term "one embodiment" or "the embodiment" should be understood as "at least one embodiment". The term "some embodiments" should be understood as "at least some embodiments". Other explicit and implicit definitions may also be included below.

[0019] It should be noted that the acquisition, storage and application of user personal information involved in the technical solution of the present disclosure are in compliance with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0020] It is understandable that before using the technical solutions disclosed in the embodiments of the present disclosure, the types, scope of use, usage scenarios, etc. of the personal information involved in the present disclosure should be informed to the user and the user's authorization should be obtained in an appropriate manner in accordance with relevant laws and regulations.

[0021] For example, in response to receiving an active request from a user, a prompt message is sent to the user to clearly prompt the user that the operation requested to be performed will require obtaining and using the user's personal information, so that the user can independently choose whether to provide personal information to software or hardware such as electronic devices, applications, servers or storage media that execute operations of the technical solution of the present disclosure based on the prompt message.

[0022] As an optional but non-limiting implementation, in response to receiving an active request from the user, the prompt information is sent to the user in a manner such as a pop-up window, in which the prompt information can be presented in text form. In addition, the pop-up window can also carry a selection control for the user to choose "agree" or "disagree" to provide personal information to the electronic device.

[0023] Business Intelligence (BI) reports are a kind of business intelligence tool used in enterprises to display and analyze data. They are processes and technologies that help enterprises make more informed decisions by collecting, organizing and analyzing internal and external data. Dashboards that display data and information in a graphical form after obtaining report data present data through charts, tables and other visual elements, allowing users to intuitively understand business conditions and trends.

[0024] With the widespread application of BI reports in various fields and the increase in data size and complexity, the possibility of data anomalies is gradually increasing, such as data fluctuations, abnormal peaks, etc. These abnormal data may affect the business operations and decision-making effects of enterprises. Therefore, the demand for data anomaly monitoring is also increasing.

[0025] In related technologies, some solutions need to be reconnected with monitoring requirements, and the anomaly detection of report indicators needs to be redeveloped each time, which poses a certain risk to system stability. Other solutions are based on the design and development of tables and fields based on agreed rules, and then uniformly configure anomaly monitoring according to the agreed rules. However, this method must rely on the existing data indicators of the report and cannot perform anomaly detection on data indicators that do not meet the agreed rules but need to be monitored. It has a high degree of coupling with the original report system. Therefore, a more flexible and efficient anomaly detection solution is needed to deal with these problems in order to meet the needs of data anomaly monitoring.

[0026] In view of this, an improved scheme for anomaly detection is proposed in an embodiment of the present disclosure. According to an embodiment of the present disclosure, monitoring indicator information is received, and the monitoring indicator information indicates the target data to be monitored in the database; based on the monitoring indicator information, data monitoring rules are determined, and the data monitoring rules are used to perform query and monitoring operations on the target data in the database; data anomaly rules for the target data are configured, and the data anomaly rules are used to determine whether the queried target data is in an abnormal state; and based on the data monitoring rules and the data anomaly rules, an abnormal monitoring operation for the target data is performed. Therefore, by determining the data monitoring rules based on the monitoring indicator information, the user can choose to monitor the original data indicators in the system and other data indicators that the user considers important according to their own business needs, thereby adapting to different business scenarios. And based on the data monitoring rules and the data anomaly rules, the abnormal monitoring operation is performed, which reduces the time for manually writing monitoring events for different indicators, thereby improving the overall data anomaly monitoring efficiency.

[0027] Hereinafter, exemplary embodiments of the present disclosure will be described in detail with reference to the accompanying drawings.

[0028] Figure 11 is a schematic diagram of an example environment 100 in which embodiments of the present disclosure can be implemented. Figure 1 In the environment 100, the electronic device 110 can receive monitoring indicator information 120. According to an embodiment of the present disclosure, the monitoring indicator information 120 can indicate the target data to be monitored in the database. For example, the user can interact on the interface, such as entering text, clicking a button, selecting an option, or dragging an element, etc., to send the monitoring indicator information 120 used to determine the target data to be monitored to the electronic device 110. Based on the monitoring indicator information 120, the electronic device 110 can determine the data monitoring rules 130. The electronic device 110 can also configure data anomaly rules 140 for the target data. In some embodiments, the electronic device 110 can perform anomaly monitoring operations 150 for the target data based on the monitoring rules 130 and the data anomaly rules 140.

[0029] exist Figure 1 In the embodiment, the electronic device 110 may include any computing system with computing capabilities, such as various computing devices / systems, terminal devices, servers, etc. The terminal device may involve any type of mobile terminal, fixed terminal or portable terminal, including a mobile phone, a desktop computer, a laptop computer, a notebook computer, a netbook computer, a tablet computer, a media computer, a multimedia tablet, or any combination of the foregoing, including accessories and peripherals of these devices or any combination thereof. The server includes but is not limited to a mainframe, an edge computing node, a computing device in a cloud environment, and the like.

[0030] It should be understood that Figure 1 The components and arrangements in the environment 100 shown are merely examples, and a computing system suitable for implementing the exemplary implementation described in the present disclosure may include one or more different components, other components, and / or different arrangements. The implementation of the present disclosure is not limited in this respect.

[0031] Figure 2 A flowchart of a process 200 for abnormality monitoring according to some embodiments of the present disclosure is shown. The process 200 may be implemented in the environment 100, for example, the process 200 may be implemented at the electronic device 110.

[0032] In box 210, the electronic device 110 receives monitoring indicator information.

[0033] In some embodiments, the report data is stored in a database for the user to view the corresponding report. The electronic device 110 receives the monitoring indicator information configured by the user. The monitoring indicator information indicates the target data to be monitored in the database. The target data may be a data indicator displayed in the created report, or a data indicator that is not displayed in the created report and needs to be monitored separately.

[0034] In some embodiments, the monitoring indicator information includes at least one of the following: data indicators, screening conditions, and data granularity.

[0035] The data indicators include pre-set data indicators and user-defined data indicators for the target data, the filtering conditions indicate the data range for filtering the target data, and the data granularity indicates the data level for querying the target data.

[0036] In some embodiments, the electronic device 110 may create data tables for data indicators, filter conditions, and data granularity, respectively, to manage report data in a database. Among them, the data indicator may indicate the data indicator that needs to be monitored, such as sales, number of orders, number of visits, conversion rate, etc. The data indicator may be a data indicator displayed in the created report, or it may be a data indicator that is not displayed in the created report and needs to be monitored separately. The filter condition is a filter condition that limits the data indicator, such as data channel, time range, product type, region, etc. The data granularity may be the aggregation level of the data indicator, such as monitoring by granularity such as data channel and data owner.

[0037] As an example, the user can interact on the interface, such as entering text, clicking a button, selecting an option, or dragging an element, etc., to determine data indicators, screening conditions, and data granularity, and transmit these monitoring indicator information to the electronic device 110. Among them, the monitoring indicator information can be in the form of a structured query language (SQL) script. For example, the data indicator screening conditions and data granularity to be monitored can be associated and maintained in an SQL field manner, thereby determining the target data to be monitored in the database.

[0038] In the disclosed embodiment, the electronic device 110 can use data indicators, screening conditions and data granularity as monitoring indicator information, and determine the target data to be monitored by receiving the monitoring indicator information. In this way, the monitoring and data display functions of report data can be separated so that they can be configured and managed independently. In this way, users can freely select and configure the target data to be monitored according to their needs without having to rely on existing reports. This method can decouple the functions of data monitoring and report display, so that the system can also configure related data anomaly monitoring functions for more complex data indicators.

[0039] In box 220, the electronic device 110 determines data monitoring rules based on the monitoring indicator information.

[0040] In some embodiments, after receiving the monitoring indicator information, the electronic device 110 may determine a data monitoring rule based on the monitoring indicator information, wherein the data monitoring rule may be used to perform query and monitoring operations on target data in a database.

[0041] For example, please refer to Figure 3A , Figure 3A A flowchart of a process 300A for determining data monitoring rules according to some embodiments of the present disclosure is shown. The process 300A may be implemented at the electronic device 110 .

[0042] In box 311, the electronic device 110 generates a first query statement based on the monitoring indicator information.

[0043] In some embodiments, the electronic device 110 may generate a first query statement for querying the target data in the database based on the monitoring indicator information. For example, the electronic device 110 generates a corresponding basic SQL statement for each data indicator to be monitored based on the data indicator, screening condition and data granularity configured by the user to retrieve the target data from the database.

[0044] In block 312 , the electronic device 110 obtains monitoring information for target data.

[0045] In some embodiments, the electronic device 110 may obtain monitoring information for target data, wherein the monitoring information includes at least one of the following: monitoring range, monitoring time, and monitoring dimension.

[0046] In block 313 , the electronic device 110 determines a data monitoring rule based on the first query statement and the monitoring information.

[0047] In some embodiments, the electronic device 110 may concatenate the first query statement and the acquired monitoring information to determine a data monitoring rule for performing query and monitoring operations on the target data in the database.

[0048] As an example, after the user configures the monitoring indicator information through the page and determines the target data to be monitored, the electronic device 110 generates a corresponding basic SQL statement for the target data. Then, the electronic device 110 can obtain the relevant monitoring information to be monitored for the target data. For example, the monitoring information may include the monitoring time. The monitoring time indicates the time interval or time point for monitoring the target data. The monitoring information may also include a monitoring dimension, such as a monitoring dimension indicating that the sales data is grouped according to different regions, and the sales volume of each region is calculated separately. Finally, the electronic device 110 can splice the basic SQL statement and the acquired monitoring information through a data access framework for managing the interaction between the application and the database, thereby determining the data monitoring rules. For example, by dynamically splicing MyBatis scripts, a dynamic SQL script for data query and monitoring is obtained.

[0049] In the disclosed embodiment, the electronic device 110 can determine the data monitoring rules based on the first query statement and the monitoring information. This method allows the user to define the target data to be monitored according to their needs and flexibly configure the monitoring conditions. The target data and monitoring information can be flexibly adjusted according to actual needs, which can more accurately meet the user's query needs and improve the query efficiency and accuracy. In addition, the dynamic splicing of the first query statement and the monitoring information avoids manually writing a large amount of repeated query code, reducing the cost of development and maintenance.

[0050] Continue to refer Figure 2 , in box 230 , the electronic device 110 configures data anomaly rules for the target data.

[0051] In some embodiments, after determining the data monitoring rules for query and monitoring operations, the electronic device 110 can configure different data anomaly rules for different data indicators to determine whether the queried target data is in an abnormal state, so as to promptly issue an alarm and process when abnormal changes in the indicators are monitored.

[0052] In some embodiments, the data anomaly rule may include information such as conditions for determining anomalies, thresholds for determining anomalies, etc. For example, it may be defined that when a certain indicator drops by more than a certain percentage or exceeds a certain threshold, the data is determined to be in an abnormal state.

[0053] As an example, the delivery conversion rate is used as the target data to be monitored. The electronic device 110 can configure a data anomaly rule for the delivery conversion rate data. The data anomaly rule can be configured in the system in advance, or can be configured for the electronic device 110 by the user through the interactive interface. For example, the data anomaly rule can be configured such that when the average delivery conversion rate of the current month decreases by more than 10% compared with the previous month, the delivery conversion rate data is confirmed to be in an abnormal state.

[0054] In the disclosed embodiment, the electronic device 110 can configure data anomaly rules to help users promptly identify abnormal conditions and take corresponding measures when data fluctuates abnormally or exceeds the expected range. This eliminates the need for manual intervention, reduces manual errors and costs, and improves work efficiency.

[0055] Continue to refer Figure 2 , in box 240, the electronic device 110 performs an anomaly monitoring operation on the target data based on the data monitoring rule and the data anomaly rule.

[0056] In some embodiments, the electronic device 110 may perform an anomaly monitoring operation based on the data monitoring rule and the data anomaly rule after determining the data monitoring rule and the data anomaly rule.

[0057] For example, please refer to Figure 3B , Figure 3B A flow chart of a process 300B for performing anomaly monitoring according to some embodiments of the present disclosure is shown.

[0058] In block 321 , the electronic device 110 may query the database for target data based on the data monitoring rule.

[0059] In some embodiments, the electronic device 110 can obtain a dynamic SQL script according to the data monitoring rules to query the target data in the database. This dynamic SQL script can be dynamically generated according to the user-defined data indicators, screening conditions and data granularity and monitoring information, and is used to obtain the target data that meets the conditions from the database.

[0060] In some embodiments, the electronic device 110 may query the target data in the database periodically at certain time intervals based on data monitoring rules.

[0061] In box 322, the electronic device 110 can perform an anomaly detection operation on the queried target data based on the data anomaly rule.

[0062] In some embodiments, after the target data is queried, the electronic device 110 can judge and analyze the data according to the data anomaly rules. The data anomaly rules define the conditions under which the data is abnormal, such as exceeding a threshold, changing too much compared to historical data, etc. The electronic device 110 can compare the queried data with these rules to determine whether the abnormal conditions are met.

[0063] In the disclosed embodiment, the electronic device 110 can realize real-time monitoring and abnormality detection of target data. Among them, based on the data monitoring rules, the step of querying the target data in the database ensures that the electronic device 110 can obtain the latest data in a timely manner. The step of judging whether the target data is in an abnormal state according to the data abnormality rules helps to find the data abnormality in a timely manner, so as to take corresponding countermeasures.

[0064] For example, please refer to Figure 3C , Figure 3C A flow chart of a process 300C for performing anomaly monitoring according to some embodiments of the present disclosure is shown.

[0065] In block 331 , the electronic device 110 may determine whether the target data meets the determination condition of the abnormal state by analyzing the data abnormality rule.

[0066] In some embodiments, the electronic device 110 may first analyze the data anomaly rule to determine whether the target data meets the determination conditions of the abnormal state. For example, the value of the target data exceeds a preset threshold, the value of the target data suddenly changes or jumps significantly, exceeds the normal fluctuation range, the proportion or ratio of the target data exceeds the expected range, or multiple target data are combined to meet certain conditions, etc.

[0067] In block 332 , if the target data meets the determination condition, the electronic device 110 may perform an alarm operation.

[0068] In box 333 , if the target data does not meet the determination condition, the electronic device 110 may end the abnormality monitoring operation.

[0069] As an example, the electronic device 110 compares and judges the acquired target data with the conditions defined in the data anomaly rule to determine whether the data meets the determination conditions of the abnormal state. If the target data meets the determination conditions, it is determined that the data is in an abnormal state, and the electronic device 110 will perform corresponding alarm operations, such as sending emails, SMS notifications to relevant personnel, recording logs, etc., to promptly remind the user to find data anomalies. After the abnormal determination process is completed, the electronic device 110 can also record monitoring logs, update monitoring status, etc. as needed, and end this abnormal monitoring operation. If the target data does not meet the determination conditions, it is determined that the data is not in an abnormal state, and the electronic device 110 can also directly end this data anomaly monitoring operation at this time.

[0070] In the disclosed embodiment, the electronic device 110 can make an abnormal determination on the target data and perform corresponding alarm operations when the determination conditions are met, so as to help the user to timely discover and deal with data abnormalities. In this way, the need for manual intervention is reduced, work efficiency is improved, and the data abnormality monitoring process is made more intelligent and automated.

[0071] For example, please refer to Figure 3D , Figure 3D A flowchart of a process 300D for performing anomaly monitoring based on data anomaly rules according to some embodiments of the present disclosure is shown.

[0072] At block 341 , the electronic device 110 may configure alert information.

[0073] In some embodiments, the alarm information may indicate the person who alarms and the alarm method, and the alarm information is used to perform an alarm operation on target data in an abnormal state.

[0074] At block 332 , if the result of the anomaly detection operation indicates that the target data is in an abnormal state, the electronic device 110 may provide an alarm notification based on the alarm information.

[0075] As an example, the alarm information can be configured in the system in advance and displayed in a list form for the user to select the alarm person and alarm method corresponding to the target data. For example, the alarm information can include the contact information of the alarm response personnel such as email address, phone number, etc., and the alarm notification method such as email, SMS, phone, etc.

[0076] In the disclosed embodiment, the electronic device 110 can ensure that relevant personnel are notified in a timely manner when data anomalies are detected by configuring the alarm information, so that they can respond in a timely manner and take necessary measures, thereby minimizing potential losses. This approach reduces the need for manual intervention and manual operation, improves work efficiency, and makes monitoring and handling of abnormal events more efficient.

[0077] In some embodiments, the electronic device 110 may send the alarm notification to the alarm person in an alarm manner, where the alarm person is the recipient of the alarm notification and the alarm manner is the notification manner of the alarm notification.

[0078] In the embodiment of the present disclosure, when the target data is monitored and determined to be in an abnormal state, the electronic device 110 can perform an alarm operation according to the configured alarm person and alarm method, and notify relevant personnel to handle the abnormal situation in a timely manner.

[0079] Figure 4 A block diagram of a device 400 for creating an interface according to some embodiments of the present disclosure is shown. The device 400 may be implemented as or included in the electronic device 110.

[0080] The device 400 includes a receiving module 410, which is configured to receive monitoring indicator information, where the monitoring indicator information indicates the target data to be monitored in the database; a monitoring module 420, which is configured to determine data monitoring rules based on the monitoring indicator information, where the data monitoring rules are used to perform query and monitoring operations on the target data in the database; an exception module 430, which is configured to configure data anomaly rules for the target data, where the data anomaly rules are used to determine whether the queried target data is in an abnormal state; and an execution module 440, which is configured to perform an abnormal monitoring operation on the target data based on the data monitoring rules and the data anomaly rules.

[0081] In some embodiments, the monitoring indicator information includes at least one of the following: data indicators, filtering conditions and data granularity, wherein the data indicators include pre-set data indicators and customized data indicators for the target data, the filtering conditions indicate the data range for filtering the target data, and the data granularity indicates the data level for querying the target data.

[0082] In some embodiments, the monitoring module 420 is further configured to generate a first query statement based on the monitoring indicator information, the first query statement is used to query the target data in the database; obtain monitoring information for the target data, the monitoring information includes at least one of the following: monitoring range, monitoring time and monitoring dimension; and determine data monitoring rules based on the first query statement and the monitoring information.

[0083] In some embodiments, the execution module 440 is further configured to query the target data in the database based on the data monitoring rules; and perform anomaly detection operations on the queried target data based on the data anomaly rules.

[0084] In some embodiments, the execution module 440 is further configured to determine whether the target data meets the judgment conditions of the abnormal state by parsing the data anomaly rules; if the target data meets the judgment conditions, an alarm operation is performed; and if the target data does not meet the judgment conditions, the abnormal monitoring operation is terminated.

[0085] In some embodiments, the exception module 430 is further configured to configure alarm information, the alarm information indicates the alarm person and the alarm method, the alarm information is used to perform an alarm operation on the target data in an abnormal state; and if the result of the abnormality detection operation indicates that the target data is in an abnormal state, an alarm notification is provided based on the alarm information.

[0086] In some embodiments, the abnormal module 430 is further configured to send the alarm notification to the alarm person in an alarm manner, where the alarm person is the recipient of the alarm notification and the alarm manner is the notification manner of the alarm notification.

[0087] The modules included in the device 400 can be implemented in various ways, including software, hardware, firmware, or any combination thereof. In some embodiments, one or more units can be implemented using software and / or firmware, such as machine executable instructions stored on a storage medium. In addition to or as an alternative to machine executable instructions, some or all of the units in the device 400 can be implemented at least in part by one or more hardware logic components. As an example and not limitation, exemplary types of hardware logic components that can be used include field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and the like.

[0088] Figure 5 1 shows a block diagram of an electronic device 500 in which one or more embodiments of the present disclosure may be implemented. It should be understood that Figure 5 The electronic device 500 shown is merely exemplary and should not constitute any limitation on the functionality and scope of the embodiments described herein. The electronic device 500 may be implemented as or included in Figure 1 Electronic device 110 or Figure 4 In the device 400.

[0089] like Figure 5 As shown, the electronic device 500 is in the form of a general electronic device. The components of the electronic device 500 may include, but are not limited to, one or more processors or processing units 510, a memory 520, a storage device 530, one or more communication units 540, one or more input devices 550, and one or more output devices 560. The processing unit 510 may be an actual or virtual processor and is capable of performing various processes according to a program stored in the memory 520. In a multi-processor system, multiple processing units execute computer executable instructions in parallel to improve the parallel processing capability of the electronic device 500.

[0090] The electronic device 500 typically includes a plurality of computer storage media. Such media may be any available media accessible to the electronic device 500, including but not limited to volatile and non-volatile media, removable and non-removable media. The memory 520 may be a volatile memory (e.g., registers, caches, random access memory (RAM)), a non-volatile memory (e.g., a read-only memory (ROM), an electrically erasable programmable read-only memory (EEPROM), flash memory), or some combination thereof. The storage device 530 may be a removable or non-removable medium, and may include a machine-readable medium, such as a flash drive, a disk, or any other medium, which may be capable of being used to store information and / or data and may be accessed within the electronic device 500.

[0091] The electronic device 500 may further include additional removable / non-removable, volatile / non-volatile storage media. Figure 5 As shown in , a disk drive for reading or writing from a removable, non-volatile disk (e.g., a "floppy disk") and an optical drive for reading or writing from a removable, non-volatile optical disk may be provided. In these cases, each drive may be connected to the bus (not shown) by one or more data media interfaces. The memory 520 may include a computer program product 525 having one or more program modules that are configured to perform various methods or actions of various embodiments of the present disclosure.

[0092] The communication unit 540 implements communication with other electronic devices through a communication medium. Additionally, the functions of the components of the electronic device 500 can be implemented in a single computing cluster or multiple computing machines that can communicate through a communication connection. Therefore, the electronic device 500 can operate in a networked environment using a logical connection with one or more other servers, a network personal computer (PC), or another network node.

[0093] The input device 550 may be one or more input devices, such as a mouse, a keyboard, a tracking ball, etc. The output device 560 may be one or more output devices, such as a display, a speaker, a printer, etc. The electronic device 500 may also communicate with one or more external devices (not shown) through the communication unit 540 as needed, such as a storage device, a display device, etc., communicate with one or more devices that allow a user to interact with the electronic device 500, or communicate with any device that allows the electronic device 500 to communicate with one or more other electronic devices (e.g., a network card, a modem, etc.). Such communication may be performed via an input / output (I / O) interface (not shown).

[0094] According to an exemplary implementation of the present disclosure, a computer-readable storage medium is provided, on which one or more computer instructions are stored, wherein the one or more computer instructions are executed by a processor to implement the method described above. According to an exemplary implementation of the present disclosure, a computer program product is also provided, which is tangibly stored on a non-transitory computer-readable medium and includes computer-executable instructions, and the computer-executable instructions are executed by a processor to implement the method described above.

[0095] Various aspects of the present disclosure are described herein with reference to the flowcharts and / or block diagrams of the methods, devices (systems) and computer program products implemented according to the present disclosure. It should be understood that each box in the flowchart and / or block diagram and the combination of each box in the flowchart and / or block diagram can be implemented by computer-readable program instructions.

[0096] These computer-readable program instructions can be provided to a processing unit of a general-purpose computer, a special-purpose computer, or other programmable data processing device, thereby producing a machine, so that when these instructions are executed by the processing unit of the computer or other programmable data processing device, a device that implements the functions / actions specified in one or more boxes in the flowchart and / or block diagram is generated. These computer-readable program instructions can also be stored in a computer-readable storage medium, and these instructions cause the computer, programmable data processing device, and / or other equipment to work in a specific manner, so that the computer-readable medium storing the instructions includes a manufactured product, which includes instructions for implementing various aspects of the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0097] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device so that a series of operating steps are performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, thereby causing the instructions executed on the computer, other programmable data processing apparatus, or other device to implement the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0098] The flow chart and block diagram in the accompanying drawings show the possible architecture, function and operation of the system, method and computer program product according to multiple implementations of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a part of a module, program segment or instruction, and a part of a module, program segment or instruction includes one or more executable instructions for realizing the logical function of the specification. In some implementations as replacements, the function marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two continuous square boxes can actually be executed substantially in parallel, and they can sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be realized by a special hardware-based system that performs the function or action of the specification, or can be realized by a combination of special hardware and computer instructions.

[0099] The above descriptions of various implementations of the present disclosure are exemplary, non-exhaustive, and not limited to the disclosed implementations. Many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described implementations. The selection of terms used herein is intended to best explain the principles of the implementations, practical applications, or improvements to the technology in the marketplace, or to enable other persons of ordinary skill in the art to understand the implementations disclosed herein.

Claims

1. A method for abnormality monitoring, comprising: Receiving monitoring indicator information, wherein the monitoring indicator information indicates target data to be monitored in a database; Based on the monitoring indicator information, determine a data monitoring rule, wherein the data monitoring rule is used to perform query and monitoring operations on the target data in the database; Configuring a data anomaly rule for the target data, wherein the data anomaly rule is used to determine whether the queried target data is in an abnormal state; as well as Based on the data monitoring rule and the data anomaly rule, an anomaly monitoring operation is performed on the target data.

2. The method according to claim 1, wherein the monitoring indicator information includes at least one of the following: data indicator, screening condition and data granularity, The data indicators include pre-set data indicators and user-defined data indicators for the target data, the filtering condition indicates the data range for filtering the target data, and the data granularity indicates the data level for querying the target data.

3. The method according to claim 1, wherein determining data monitoring rules based on the monitoring indicator information comprises: Based on the monitoring indicator information, generating a first query statement, wherein the first query statement is used to query the target data in the database; Acquire monitoring information for the target data, the monitoring information including at least one of the following: monitoring scope, monitoring time, and monitoring dimension; as well as The data monitoring rule is determined based on the first query statement and the monitoring information.

4. The method according to claim 1, wherein the performing an anomaly monitoring operation on the target data based on the data monitoring rule and the data anomaly rule comprises: Based on the data monitoring rule, querying the target data in the database; Based on the data anomaly rule, an anomaly detection operation is performed on the queried target data.

5. The method according to claim 4, wherein the performing anomaly detection operation on the queried target data based on the data anomaly rule comprises: By analyzing the data anomaly rule, determining whether the target data meets the determination condition of the abnormal state; If the target data meets the determination condition, an alarm operation is performed; as well as If the target data does not meet the determination condition, the abnormal monitoring operation is terminated.

6. The method according to claim 1, wherein the performing anomaly detection operation on the queried target data based on the data anomaly rule comprises: Configure alarm information, the alarm information indicating an alarm person and an alarm method, and the alarm information is used to perform an alarm operation on the target data in an abnormal state; as well as If the result of the abnormality detection operation indicates that the target data is in an abnormal state, an alarm notification is provided based on the alarm information.

7. The method of claim 6, wherein providing the warning notification comprises: The alarm notification is sent to the alarm person in the alarm mode. The alarm person is the recipient of the alarm notification. The alarm mode is the notification mode of the alarm notification.

8. An abnormality monitoring device, comprising: A receiving module, configured to receive monitoring indicator information, wherein the monitoring indicator information indicates target data to be monitored in a database; A monitoring module, configured to determine a data monitoring rule based on the monitoring indicator information, wherein the data monitoring rule is used to perform query and monitoring operations on the target data in the database; An exception module is configured to configure a data exception rule for the target data, wherein the data exception rule is used to determine whether the queried target data is in an abnormal state; as well as The execution module is configured to execute an anomaly monitoring operation on the target data based on the data monitoring rule and the data anomaly rule.

9. An electronic device, comprising: at least one processing unit; as well as At least one memory, the at least one memory being coupled to the at least one processing unit and storing instructions for execution by the at least one processing unit, the instructions causing the electronic device to perform the method according to any one of claims 1 to 7 when executed by the at least one processing unit.

10. A computer-readable storage medium having a computer program stored thereon, wherein the computer program can be executed by a processor to implement the method according to any one of claims 1 to 7.

Images