Business exception root cause analysis method and system, electronic equipment and storage medium

Abstract

The embodiment of the invention provides a service exception root cause analysis method and system, electronic equipment and a storage medium, and belongs to the technical field of computers. According to the method, future time index prediction is carried out according to the service data set of each dimension index to obtain the second index value of the dimension index in the future time, then anomaly detection is carried out according to the second index value to judge whether the dimension index is abnormal or not, and root cause analysis is carried out under the condition that the dimension index is abnormal, so that the timeliness of root cause analysis is improved. The root cause analysis is to calculate an accident difference value and an abnormal capability explanation value of each element in the business data set under a corresponding dimension index, and determine an abnormal contribution degree of the dimension index according to the accident difference value and the abnormal capability explanation value of each element under the corresponding dimension index; according to the abnormal contribution degree of each dimension index, a service abnormal root cause analysis result is determined, and the comprehensiveness of service abnormal root cause analysis can be improved by performing abnormal analysis on each dimension index.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a method, system, electronic device and storage medium for analyzing the root cause of a business anomaly. Background Art

[0002] With the advancement of digital life, real-time monitoring of various key indicators in the process of business development is particularly important. These key indicators (such as the number of new product installations, the number of new user installations, the number of user churn, the number of user migrations, etc.) can directly reflect the business operation status and help quickly identify potential anomalies. In actual applications, business operation anomalies are often the result of the combined effect of multi-dimensional factors, such as data date, region, product and other dimensions. Therefore, when a key indicator (such as the number of product sales in a certain month) is abnormal, it is particularly necessary to locate the anomaly and perform root cause analysis (RCA).

[0003] In related technologies, when a business anomaly occurs, linear regression or basic statistical models are usually used to analyze whether a certain indicator is abnormal. This method has a lag and cannot effectively process multi-dimensional data, and cannot identify the cause of the anomaly in a timely and accurate manner. Summary of the invention

[0004] The main purpose of the embodiments of the present application is to propose a business anomaly root cause analysis method, system, electronic device and storage medium, aiming to improve the timeliness and comprehensiveness of business anomaly root cause analysis.

[0005] To achieve the above object, an embodiment of the present application provides a method for analyzing the root cause of a service anomaly, comprising the following steps:

[0006] Acquire a business data set of multiple dimensional indicators, wherein an element of the business data set of each dimensional indicator represents a first indicator value at different historical times;

[0007] Perform future time index prediction based on the business data set of each dimensional index to obtain a second index value of the dimensional index in the future time;

[0008] Perform anomaly detection according to the second indicator value to determine whether the dimension indicator is abnormal;

[0009] When the dimension indicator is abnormal, the unexpected difference value and abnormal capability explanation value of each element in the business data set under the corresponding dimension indicator are calculated;

[0010] Determine the abnormal contribution degree of the dimensional indicator according to the unexpected difference value and abnormal ability explanation value of each element under the corresponding dimensional indicator;

[0011] The business anomaly root cause analysis results are determined based on the degree of abnormal contribution of each of the dimensional indicators.

[0012] In some embodiments, performing future time indicator prediction based on the business data set of each dimensional indicator to obtain a second indicator value of the dimensional indicator at the future time includes the following steps:

[0013] Determine a prediction model algorithm for the dimensional indicator according to the time regularity attribute of the dimensional indicator;

[0014] Using the prediction model algorithm, predicting the future time index according to the business data set of the dimensional index, and obtaining the second index value of the dimensional index;

[0015] Among them, the prediction model algorithm corresponding to the time regularity attribute of seasonal periodic fluctuations is the seasonal autoregressive integrated moving average time series model, the preset model algorithm corresponding to the time regularity attribute of seasonal periodic fluctuations and the influence of preset time events is the Prophet prediction algorithm; the prediction model algorithm corresponding to the time regularity attribute of linear time is the autoregressive integrated moving average model.

[0016] In some embodiments, performing anomaly detection according to the second indicator value to determine whether the dimension indicator is abnormal includes the following steps:

[0017] Obtaining actual observed indicator values ​​of the dimension indicators;

[0018] The second indicator value is compared with the actually observed indicator value to obtain a comparison result of the dimensional indicator, wherein the comparison result is used to determine whether the dimensional indicator is abnormal.

[0019] In some embodiments, the unexpected difference value of each element in the business data set under the corresponding dimension index is calculated by the following steps:

[0020] Determining the probability distribution of the dimensional indicator according to the business data set;

[0021] Determine a first probability value of the element and a second probability value of an actual observed index value of a corresponding dimensional index according to the probability distribution;

[0022] An unexpected difference value for the element is determined based on the first probability value and the second probability value.

[0023] In some embodiments, the abnormal capability explanation value of each element in the business data set under the corresponding dimension index is obtained by the following steps:

[0024] Calculate the difference between each element in the business data set and the actual observed index value of the corresponding dimension index;

[0025] The difference value of the element is divided by the sum of the difference values ​​of all elements in the business data set to obtain the abnormal capability explanation value of the element.

[0026] In some embodiments, determining the abnormal contribution degree of the dimensional index according to the unexpected difference value and the abnormal ability explanation value of each element under the corresponding dimensional index includes the following steps:

[0027] Adding the element whose abnormal capability explanation value is greater than the first threshold to the root cause set of the corresponding dimension indicator;

[0028] Calculating the sum of the abnormal ability explanation values ​​of the elements in the root cause set to obtain the total explanation value of the dimension indicator;

[0029] Calculating the sum of the unexpected difference values ​​of all elements of the dimensional index to obtain a total unexpected value of the dimensional index;

[0030] The degree of abnormal contribution of the dimensional indicator is determined based on the total explanation value and the total unexpected value of the dimensional indicator.

[0031] In some embodiments, the service abnormality root cause analysis method further includes the following steps:

[0032] Determining the associated index of the abnormal dimensional index through the dependency relationship between the dimensional indexes, wherein the dependency relationship is constructed through a Bayesian structure learning algorithm;

[0033] The data changes in the business data set of the associated indicator are analyzed to determine whether the associated indicator is a root cause of the business anomaly.

[0034] To achieve the above object, another aspect of the embodiment of the present application provides a service abnormality root cause analysis system, including:

[0035] The first module is used to obtain a business data set of multiple dimensional indicators, wherein the elements of the business data set of each dimensional indicator represent the first indicator value at different historical times;

[0036] The second module uses the business data set according to each dimensional indicator to predict the future time indicator to obtain the second indicator value of the dimensional indicator in the future time;

[0037] A third module is used to perform anomaly detection according to the second indicator value to determine whether the dimension indicator is abnormal;

[0038] The fourth module is used to calculate the unexpected difference value and abnormal capability explanation value of each element in the business data set under the corresponding dimensional indicator when the dimensional indicator is abnormal;

[0039] A fifth module is used to determine the abnormal contribution degree of the dimensional indicator according to the unexpected difference value and abnormal ability explanation value of each element under the corresponding dimensional indicator;

[0040] The sixth module is used to determine the business anomaly root cause analysis results based on the degree of abnormal contribution of each of the dimensional indicators.

[0041] To achieve the above-mentioned purpose, another aspect of an embodiment of the present application proposes an electronic device, which includes a memory, a processor, a program stored in the memory and executable on the processor, and a data bus for realizing connection and communication between the processor and the memory, and the program implements the method described in the above embodiment when executed by the processor.

[0042] To achieve the above-mentioned purpose, another aspect of an embodiment of the present application proposes a storage medium, which is a computer-readable storage medium used for computer-readable storage, and the storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the method described in the above embodiment.

[0043] The business anomaly root cause analysis method, system, electronic device and storage medium proposed in the present application predict future time indicators based on the business data set of each dimensional indicator, obtain a second indicator value of the dimensional indicator in the future time, and then perform anomaly detection based on the second indicator value to determine whether the dimensional indicator is abnormal, and perform root cause analysis when the dimensional indicator is abnormal, thereby improving the timeliness of the root cause analysis. The root cause analysis is to calculate the unexpected difference value and abnormal ability explanation value of each element in the business data set under the corresponding dimensional indicator, determine the abnormal contribution degree of the dimensional indicator according to the unexpected difference value and abnormal ability explanation value of each element under the corresponding dimensional indicator, and determine the business anomaly root cause analysis result according to the abnormal contribution degree of each dimensional indicator. By performing anomaly analysis on each dimensional indicator, the comprehensiveness of the business anomaly root cause analysis can be improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Figure 1 is a flow chart of a method for analyzing root causes of business anomalies provided by an embodiment of the present application;

[0045] Figure 2 yes Figure 1 Flow chart of step S102 in FIG.

[0046] Figure 3 yes Figure 1 Flow chart of step S103 in FIG.

[0047] Figure 4 yes Figure 1 Flow chart of the unexpected difference value calculation method of step S104;

[0048] Figure 5 yes Figure 1 Flow chart of abnormal capability interpretation value of step S104 in;

[0049] Figure 6 yes Figure 1 Flow chart of step S105 in FIG.

[0050] Figure 7 is a flow chart of a method for analyzing root causes of business anomalies provided by another embodiment of the present application;

[0051] Figure 8 Schematic diagram of a system for analyzing root causes of business anomalies provided in an embodiment of the present application;

[0052] Fig. 9 is a schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present application;

[0053] Fig.10 It is a schematic diagram of the application process of the business anomaly root cause analysis method provided in an embodiment of the present application. DETAILED DESCRIPTION

[0054] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0055] It should be noted that, although the functional modules are divided in the system and the logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than the module division in the system or the order in the flowchart. The terms "first", "second", etc. in the specification, claims and the above drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0056] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used herein are only for the purpose of describing the embodiments of this application and are not intended to limit this application.

[0057] The embodiments of the present application provide a business anomaly root cause analysis method, system, electronic device and storage medium, aiming to improve the timeliness and comprehensiveness of business anomaly root cause analysis.

[0058] The service anomaly root cause analysis method, system, electronic device and storage medium provided in the embodiments of the present application are specifically described through the following embodiments. First, the service anomaly root cause analysis method in the embodiments of the present application is described.

[0059] The business anomaly root cause analysis method provided in the embodiment of the present application relates to the field of computer technology. The business anomaly root cause analysis method provided in the embodiment of the present application can be applied to a terminal, can also be applied to a server side, and can also be software running in a terminal or a server side. In some embodiments, the terminal can be a smart phone, a tablet computer, a laptop computer, a desktop computer, etc.; the server side can be configured as an independent physical server, or can be configured as a server cluster or a distributed system composed of multiple physical servers, and can also be configured as a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms; the software can be an application that implements the business anomaly root cause analysis method, etc., but is not limited to the above forms.

[0060] The present application can be used in many general or special computer system environments or configurations. For example: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, distributed computing environments including any of the above systems or devices, etc. The present application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. The present application can also be practiced in distributed computing environments, in which tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules can be located in local and remote computer storage media including storage devices.

[0061] It should be noted that in each specific implementation of the present application, when it comes to the need to perform relevant processing based on data related to user identity or characteristics such as user information, user behavior data, user historical data, and user location information, the user's permission or consent will be obtained first, and the collection, use, and processing of these data will comply with relevant laws, regulations, and standards. In addition, when the embodiment of the present application needs to obtain the user's sensitive personal information, the user's separate permission or consent will be obtained through a pop-up window or by jumping to a confirmation page. After clearly obtaining the user's separate permission or consent, the necessary user-related data for the normal operation of the embodiment of the present application will be obtained.

[0062] Figure 1 is an optional flowchart of the service anomaly root cause analysis method provided in an embodiment of the present application. Figure 1 The method may include but is not limited to steps S101 to S106.

[0063] Step S101, obtaining a business data set of multiple dimensional indicators, wherein an element of the business data set of each dimensional indicator represents a first indicator value at different historical times;

[0064] Step S102, performing a future time indicator prediction based on the business data set of each dimensional indicator to obtain a second indicator value of the dimensional indicator in the future time;

[0065] Step S103, performing anomaly detection according to the second indicator value to determine whether the dimension indicator is abnormal;

[0066] Step S104, when the dimension index is abnormal, the unexpected difference value and abnormal capability explanation value of each element in the business data set under the corresponding dimension index are calculated;

[0067] Step S105, determining the abnormal contribution degree of the dimensional indicator according to the unexpected difference value and abnormal ability explanation value of each element under the corresponding dimensional indicator;

[0068] Step S106, determining the business anomaly root cause analysis result according to the degree of abnormal contribution of each dimensional indicator.

[0069] Steps S101 to S106 shown in the embodiment of the present application predict the future time index based on the business data set of each dimensional index, obtain the second index value of the dimensional index in the future time, and then perform anomaly detection based on the second index value to determine whether the dimensional index is abnormal, and perform root cause analysis when the dimensional index is abnormal, thereby improving the timeliness of the root cause analysis. The root cause analysis is to calculate the unexpected difference value and abnormal capability explanation value of each element in the business data set under the corresponding dimensional index, determine the abnormal contribution degree of the dimensional index based on the unexpected difference value and abnormal capability explanation value of each element under the corresponding dimensional index, and determine the business abnormality root cause analysis result based on the abnormal contribution degree of each dimensional index. By performing abnormal analysis on each dimensional index, the comprehensiveness of the business abnormality root cause analysis can be improved.

[0070] In step S101 of some embodiments, different business fields contain different dimensional indicators, and users can collect corresponding dimensional indicators according to their own business needs. For example, the dimensional indicators can be region, time, product, user behavior, etc. The business data set of the dimensional indicators stores the indicator values ​​of the corresponding dimensions in historical time, for example, the monthly sales volume of a product in the past 12 months.

[0071] In some embodiments, the collection of business data can be carried out in real time by collecting business data of multi-dimensional indicators from the business system in a flexible configuration manner, or the data source to be integrated can be selected through check boxes, and the data source to be collected can be selected by adding or removing data sources (such as business systems, APIs, third-party services, etc.). Furthermore, the data collected by the data source can be filtered according to user-configured indicator dimensions (such as sales volume, customer satisfaction, churn rate, etc.) so that the business data sets of various dimensional indicators obtained meet user needs.

[0072] In some embodiments, the business data collected under the dimension indicators can be automatically calculated according to the indicator calculation method configured by the user, so as to form a suitable business data set. The indicator calculation method configured by the user can be to calculate the sum, average value or growth rate of the business data collected under the corresponding indicator dimension. Exemplarily, the indicator calculation method of the product sales volume configured by the user is to calculate the total monthly sales volume. After the system collects the product sales volume of each day in the historical time, it can calculate the product sales volume in a month according to the indicator calculation method configured by the user, so as to form a business data set, wherein each element in the business data set represents the product sales volume of each month. Furthermore, after the business data set is analyzed and obtained, the content in the business data set can be displayed, so as to provide the user with a real-time preview function, and the user can also customize the data collection frequency through the visual interface.

[0073] In some embodiments, users can also configure the data preprocessing method of dimensional indicators. After collecting business data, they can first perform corresponding preprocessing operations on the business data, such as missing value filling, data denoising, time series smoothing, etc., to improve the quality and consistency of the data.

[0074] In step S102 of some embodiments, the future time index is predicted according to the business data set of each dimensional index to obtain the second index value of the future time of the dimensional index. Specifically, the business data set of each dimensional index can be input into the prediction model of the corresponding dimensional index for prediction, and the model outputs the index value of the future time. The prediction model can be obtained by machine learning or deep learning, or by other time series prediction methods, such as time series decomposition method, simple time series average method, weighted time series average method, seasonal trend prediction method, etc. The machine learning method mainly constructs a sample data set, adopts the method of "time feature" to "sample value", and learns the association between features and labels through supervised learning, so as to realize time series prediction. The machine learning method includes support vector machine (SVM), random forest (RF), XGBoost, etc. The deep learning method can fit the time series curve, capture the time sequence relationship and long-term dependence, and perform feature learning and prediction. The deep learning model includes long short-term memory network, gated recurrent unit (GRU), etc. The index prediction model is trained for each dimensional index, and the historical business data is used for fitting, and the future business index is predicted based on the trained model. During the prediction model training process, it is necessary to prepare business data of dimensional indicators. After preprocessing the business data, it is divided into a training set and a test set. The training set is used to train the prediction model, and the test set is used to verify the prediction model.

[0075] See also Figure 2 In some embodiments, step S102 may include but is not limited to steps S201 to S202.

[0076] Step S201, determining a prediction model algorithm for a dimensional indicator according to a time regularity attribute of the dimensional indicator;

[0077] Step S202, using a prediction model algorithm, predicts future time indicators based on the business data set of the dimensional indicator to obtain a second indicator value of the dimensional indicator.

[0078] In this embodiment, each dimensional indicator in the system is configured with a corresponding time regularity attribute, which characterizes the temporal regularity of the business data of the dimensional indicator, for example, the change of business data is related to seasons or holidays. The time regularity attributes include attributes such as seasonal periodic fluctuations, seasonal periodic fluctuations and the influence of preset time events, and linear time. In this embodiment, if the business data of the dimensional indicator does not have an obvious time regularity, for example, the time regularity attribute of the dimensional indicator that does not have a seasonal periodicity or a preset event (such as weekends or holidays) regularity can be configured as a linear time attribute.

[0079] In this embodiment, for dimensional indicators whose time regularity attributes are seasonal periodic fluctuations, the seasonal autoregressive integrated moving average time series model can be selected for indicator prediction; for dimensional indicators whose time regularity attributes are seasonal periodic fluctuations and the influence of preset time events, the Prophet prediction algorithm can be selected for indicator prediction; for dimensional indicators whose time regularity attributes are linear time, the autoregressive integrated moving average model can be selected for indicator prediction.

[0080] In this embodiment, the AutoRegressive Integrated Moving Average model (ARIMA), also known as the AutoRegressive Integrated Moving Average, is a classic model in time series prediction, which combines three parts: autoregression (AR), difference (I) and moving average (MA). Autoregression (AR) is used to predict future values ​​using past values, difference (I) is used to eliminate trends in time series and make them stable, and moving average (MA) is used to predict future values ​​using a linear combination of past prediction errors. ARIMA is suitable for time series data without seasonality, that is, it is suitable for linear time series. It can find out the data change model (moving average, periodic component) according to the change law of historical data, so as to realize future prediction and can better handle trend data.

[0081] In this embodiment, the seasonal autoregressive integrated moving average time series model (Seasonal Autoregressive Integrated Moving Average, SARIMA) is an extension of the ARIMA model. A seasonal factor is added on the basis of ARIMA to process time series with periodic fluctuations. The SARIMA model is a combination of an autoregressive model (AR), a moving average model (MA) and a seasonal model, wherein the seasonal model is used to capture the seasonal trend of time series data. Common seasonal models include seasonal autoregressive model (SAR), seasonal moving average model (SMA), etc.

[0082] In this embodiment, Prophet is a time series forecasting tool developed by Facebook. It is an extensible framework based on additive models for forecasting time series data with characteristics such as seasonality, trend, and holiday effects. It models the time series by decomposing it into three parts: trend, seasonality, and holiday effects, and uses an additive model for forecasting. Prophet is suitable for data with significant trends and seasonal fluctuations, and can consider the impact of special events (such as holidays) on business indicators.

[0083] This embodiment can improve the accuracy of the prediction of each dimensional indicator by selecting a suitable prediction algorithm to predict future indicators according to the time-explicit rules of the dimensional indicator data.

[0084] According to some embodiments of the present application, for dimensional indicators with frequent fluctuations, the weight of historical fluctuation data is increased in the time series model to reduce false positives.

[0085] In step S103 of some embodiments, after predicting the future second indicator value of the dimensional indicator, it can be determined whether the dimensional indicator has a trend of abnormal change based on the second indicator value, so that the root cause analysis of the business anomaly can be performed in a timely manner.

[0086] See also Figure 3 In some embodiments, step S103 may include but is not limited to steps S301 to S302:

[0087] Step S301, obtaining the actual observed index value of the dimension index;

[0088] Step S302, compare the second indicator value with the actual observed indicator value to obtain a comparison result of the dimensional indicator, wherein the comparison result is used to determine whether the dimensional indicator is abnormal.

[0089] In this embodiment, the difference between the future second indicator value of the dimension indicator and the actual observed indicator value of the dimension indicator is used to determine whether the dimension indicator is abnormal. The actual observed indicator value is the indicator value of the corresponding dimension indicator under normal business system conditions. The actual observed indicator value of the dimension indicator can be obtained by counting the average value of the business data of the dimension indicator under normal business system conditions. For example, when the sales of telephone card traffic packages are normal, the average value of the user satisfaction indicator can be counted to obtain the actual observed indicator value of the user satisfaction indicator.

[0090] In some embodiments, if the difference between the second indicator value and the actual observed indicator value exceeds an abnormal threshold, it is determined that the dimension indicator is abnormal.

[0091] In another embodiment, if the difference between the second indicator value and the actual observed indicator value exceeds a preset ratio of the second indicator value, it is determined that the dimension indicator is abnormal.

[0092] In step S104 of some embodiments, after determining that a certain dimension indicator is abnormal, the root cause analysis operation of the business abnormality is triggered. Root Cause Analysis (RCA) is a structured problem-solving method that aims to gradually find the root cause of the problem and solve it, rather than just focusing on the manifestation of the problem. This analysis technology collects a wide range of subjective and objective scientific evidence through a retrospective investigation process, distinguishes between proximal and distal causes, and then understands the process and causes of the error, conducts a systematic review, and develops improvement strategies to reduce the occurrence of errors.

[0093] In the process of root cause analysis, it is necessary to first calculate the unexpected difference value and abnormal ability explanation value of each element in the business data set under the corresponding dimension indicator, and then analyze the dimension indicator as a whole based on the unexpected difference value and abnormal ability explanation value of the element, so as to determine the root cause of the business anomaly. The unexpected difference value is the S value (Surprise). For each dimension indicator, the element S value under each dimension is calculated to indicate the unexpectedness of a certain element under that dimension. The abnormal ability explanation value is the EP value (Explanatory Power), which refers to the ability of an element or a group of elements to explain the changes in the overall indicator. The greater the proportion of the fluctuation of an element or a group of elements in the fluctuation of the overall dimension indicator, the stronger the explanatory power of the element or element group for the abnormality of the dimension indicator.

[0094] See also Figure 4 In some embodiments, in step S104, the unexpected difference value of each element in the business data set under the corresponding dimension index can be calculated through steps S401 to S403:

[0095] Step S401, determining the probability distribution of the dimension index according to the business data set;

[0096] Step S402, determining a first probability value of the element and a second probability value of the actual observed index value of the corresponding dimensional index according to the probability distribution;

[0097] Step S403: determining the unexpected difference value of the element according to the first probability value and the second probability value.

[0098] In this embodiment, the probability distribution describes the probability law of the dimension index value, reflecting the probability of the dimension index taking each value within its possible value range. The value of the dimension index can be discrete or continuous. For discrete dimension indicators, all possible values ​​and their corresponding probabilities constitute a discrete probability distribution, which is usually represented by a table or formula. For continuous dimension indicators, their values ​​can be infinitely subdivided within a certain interval, so their probability distribution is usually described by a probability density function (PDF).

[0099] The S value uses the JSD divergence (Jensen-Shannon Divergence) to measure the difference between the probability distribution of the element (i.e., the first indicator value) in the business data set and the probability distribution of the actual observed indicator value. The S value formula of the element is as follows:

[0100] S ij =JSD(P ij ||Q i );

[0101] Among them, S ij represents the S value of the jth element of the i-th dimension index, P ij represents the probability value of the jth element of the i-th dimension indicator, Q i Represents the probability value of the actual observed indicator value of the ith dimension indicator. JSD divergence (Jensen-Shannon Divergence) is a metric used to measure the difference between two probability distributions. It is a symmetric version of Kullback-Leibler Divergence (KL divergence) designed to solve the asymmetry of KL divergence and the possible infinite size problem. JS divergence is always non-negative and equal to 0 when the two distributions are exactly the same, which makes it more stable and reliable when comparing distributions.

[0102] See also Figure 5 In some embodiments, in step S104, the abnormal capability explanation value of each element in the business data set under the corresponding dimension index can be calculated through steps S501 to S502:

[0103] Step S501, calculating the difference between each element in the business data set and the actual observed index value of the corresponding dimension index;

[0104] Step S502: Divide the difference value of the element by the sum of the difference values ​​of all elements in the business data set to obtain the abnormal capability explanation value of the element.

[0105] In this embodiment, the abnormal capability explanation value can be calculated by the following formula:

[0106] EP ij =(A i -F ij ) / ∑(A i -F ij );

[0107] Among them, EP ij represents the EP value of the jth element of the i-th dimension indicator, F ij A represents the index value corresponding to the jth element of the i-th dimension index. iRepresents the actual observed indicator value of the i-th dimension indicator. A positive EP value indicates that the element may be the root cause of the anomaly, while a negative value indicates that the element is not related to the anomaly.

[0108] In step S105 of some embodiments, after obtaining the unexpected difference value and abnormal capability explanation value of each element in the business data set of the dimensional data, the abnormal contribution degree of the dimensional indicator can be determined by comprehensively analyzing the S value and EP value of all elements in the business data set. The abnormal contribution degree of the dimensional indicator is used to characterize the contribution degree of the dimensional indicator to the overall business abnormality.

[0109] See also Figure 6 In some embodiments, step S105 may include but is not limited to steps S601 to S604:

[0110] Step S601, adding elements whose abnormal capability explanation values ​​are greater than a first threshold value to a root cause set of corresponding dimension indicators;

[0111] Step S602, calculating the sum of the abnormal capability explanation values ​​of the elements in the root cause set to obtain the total explanation value of the dimension indicator;

[0112] Step S603, calculating the sum of the unexpected difference values ​​of all elements of the dimension index to obtain the total unexpected value of the dimension index;

[0113] Step S604, determining the abnormal contribution degree of the dimensional indicator according to the total explanation value and the total unexpected value of the dimensional indicator.

[0114] In this embodiment, the elements under each dimension indicator are sorted according to the S value and the EP value. When the EP value of an element is greater than a set threshold (such as 1%), it is considered to be a potential root cause of the abnormality and is added to the root cause set of the dimension indicator. When the sum of the EP values ​​of the elements in the root cause set of a dimension indicator (i.e., the total EP value) is greater than the set threshold (such as 90%), it is considered that the abnormal root cause of the dimension has been fully explained, and the dimension indicator can be determined to be one of the reasons for the business abnormality. Then the total S value of each dimension indicator is calculated, and the total EP value and the total S value are combined to sort the various dimension indicators to identify the most unexpected and most likely dimension indicators. Exemplarily, the dimension indicators greater than the set threshold (such as 90%) can be screened out according to the total EP value of the root cause set of the dimension indicator, and then the total EP value and the total S value of the screened dimension indicators are weighted to obtain the abnormal contribution degree of the dimension indicator. In another example, the total EP value and the total S value of each dimension indicator can also be directly weighted to obtain the abnormal contribution degree of the dimension indicator.

[0115] In step S106 of some embodiments, the business anomaly root cause analysis result is determined according to the abnormal contribution degree of each dimensional indicator, and the abnormal root cause analysis result includes the abnormal contribution degree of each dimensional indicator. A business anomaly analysis report is generated based on the business anomaly root cause analysis result, and the analysis report includes information such as abnormal indicator dimensions, possible root cause dimensions, S values, EP values ​​and abnormal contribution degree rankings of each dimensional indicator.

[0116] In some embodiments, the system provides a graphical interface display to help users more intuitively view the historical trends of business indicators, anomaly location results, and details of root cause analysis. For simpler business scenarios, the system can output root cause analysis results of all dimensions; for scenarios with more dimensions and complex data, only the top N root causes are output for users to quickly analyze and make decisions.

[0117] In some embodiments, this embodiment can also implement root cause analysis of development indicators. When a user queries a specific indicator (such as "monthly new product installations"), the system can display detailed information about the indicator, including an overall overview, change trends, regional distribution details, multi-regional comparisons, etc. The analysis results automatically generated by the system can help users quickly identify multi-dimensional information such as regional differences, year-on-year growth rates, month-on-month growth rates, and further support business decisions.

[0118] See also Figure 7 In some embodiments, the service abnormality root cause analysis method of the embodiment of the present application may also include but is not limited to steps S701 to S702:

[0119] Step S701, determining the associated index of the abnormal dimensional index through the dependency relationship between the dimensional indexes, wherein the dependency relationship is constructed by a Bayesian structure learning algorithm;

[0120] Step S702: Analyze the data changes in the business data set of the associated indicator to determine whether the associated indicator is a root cause of the business anomaly.

[0121] In this embodiment, the structure of the Bayesian network is represented by a directed acyclic graph (DAG), in which nodes represent dimensional indicators and edges represent dependencies between dimensional indicators. The goal of the structural learning algorithm is to determine which dimensional indicators have dependencies by learning the joint probability distribution in the data, and then build a reasonable Bayesian network. Specifically, a data set containing multiple dimensional indicators is collected. Select a suitable structural learning algorithm to apply to the data set, for example, use a search and scoring algorithm to define a scoring function and a search strategy; use a constraint-based learning algorithm to perform independence tests and graph searches; use a learning algorithm based on Bayesian theory to determine the prior probability distribution. According to the output of the algorithm, analyze the dependencies between multiple indicators, including identifying which indicators have direct dependencies, and the strength and direction of these dependencies.

[0122] In this embodiment, considering the situation that the required collection dimensional indicators configured in step S101 are mainly key indicators considered by the user, resulting in incomplete subsequent root cause analysis, after determining the abnormal dimensional indicators from the configured dimensional indicators, this embodiment determines the associated indicators of the abnormal dimensional indicators by constructing the dependency relationship between the dimensional indicators, and analyzes the data changes in the business data set of the associated indicators. The specific analysis process is as follows, such as steps S102 to S105, to determine whether the associated indicators belong to the root cause of the business anomaly, so as to locate the root cause more comprehensively.

[0123] According to some embodiments of the present application, the business anomaly root cause analysis method of the embodiment of the present application can be applied to various business scenarios, for example, product user growth anomaly analysis, multi-package business indicator anomaly positioning analysis, customer churn rate analysis, new product or package marketing analysis, etc. For example, an enterprise finds that the customer churn rate of a certain product has risen sharply in the past few months. By deeply analyzing the user's usage data, satisfaction feedback, market competition and other data, the root cause of the customer churn rate can be understood, and improvements can be made based on the cause to retain customers. New business products launched by the enterprise for online ordering. Through data root cause analysis, A / B testing can be implemented to evaluate the impact of different promotion channels on user conversion rates. Identifying effective promotion methods can improve return on investment, quickly adjust and optimize marketing strategies, and thus improve customer engagement and satisfaction.

[0124] According to some embodiments of the present application, the business anomaly root cause analysis method of the embodiment of the present application is applied to the abnormal analysis of product user growth, and is specifically described as follows:

[0125] Data collection: collect relevant business indicator data from the company's business system, such as user behavior data, marketing activity data, product performance data, regional user distribution data, time series data, etc., and classify them by multiple dimensions such as region (such as province, city, district), time, and package type.

[0126] Data preprocessing: cleaning and preprocessing the collected multi-dimensional data, including removing outliers, filling missing values ​​and standardization.

[0127] Anomaly detection uses time series prediction algorithms (such as the SARIMA model) to predict the indicator dimension of product user growth (such as the number of new installed users per month). The difference between the actual observed value and the predicted indicator value is calculated. When the difference exceeds the preset threshold, it is determined to be an abnormal indicator dimension.

[0128] Root cause analysis: After detecting an anomaly, the system automatically screens out elements under multiple dimensions through S value and EP value calculations, sorts them according to their contribution to the anomaly, and outputs the most likely root cause set.

[0129] Visualization display module: The analysis results are displayed through a visualization interface, and users can view the trend chart of abnormal indicators, multi-dimensional data comparison charts, and specific root cause analysis results.

[0130] The normal data (i.e. the actual observed index value) and abnormal data of each dimension indicator are explained as follows:

[0131] User behavior data

[0132] Normal data:

[0133] Number of daily active users: Steady growth or fluctuations within the expected range, such as 3,000-3,500 users.

[0134] User login frequency: Users log in 3-5 times per week on average.

[0135] User retention rate: The first week retention rate reached 80%.

[0136] Abnormal data:

[0137] Daily active users: suddenly dropped to 1,500 users, a fluctuation of more than 30%.

[0138] User login frequency: Some users did not log in for a week, resulting in a significant drop in the DAU of the entire platform.

[0139] User Retention Rate: There is a 30% drop in retention rate, especially in a certain time period.

[0140] Marketing campaign data

[0141] Normal data:

[0142] Marketing investment: Monthly marketing expenditure is maintained at 10,000-15,000 yuan.

[0143] Activity conversion rate: The conversion rate of effective activities remains between 15%-20%.

[0144] Abnormal data:

[0145] Marketing activity investment: The amount of a certain activity suddenly increased to 50,000 yuan, but there was no obvious increase in users.

[0146] Activity conversion rate: The conversion rate of a certain activity drops sharply to below 5%, indicating that users have low interest in the activity.

[0147] Product Performance Data

[0148] Normal data:

[0149] Average loading time: Normal range is 2-3 seconds.

[0150] Error rate: The in-app error rate is stable at less than 1%.

[0151] Abnormal data:

[0152] Average loading time: The loading time was extended to 10 seconds during a certain period, resulting in a poor user experience.

[0153] Error rate: The error rate suddenly increased to 5%, and users frequently encountered app crashes.

[0154] Regional user distribution data

[0155] Normal data:

[0156] Users in specific regions are evenly distributed and maintain steady growth.

[0157] Abnormal data:

[0158] A user decline of more than 40% in a certain region may be due to insufficient regional market strategies or actual events (such as policy changes).

[0159] Time Series Data

[0160] Normal data:

[0161] The number of user registrations grows normally during holidays and promotions and there are no abnormalities.

[0162] Abnormal data:

[0163] User registrations suddenly drop significantly after data is imported in a particular month (for example, late in the third quarter).

[0164] The specific implementation process is as follows:

[0165] Data collection and preprocessing: The system regularly obtains user-related data from different business databases, classifies and preprocesses it by dimensions such as region, time, and package to improve the cleanliness and consistency of the data.

[0166] Time Series Forecasting and Anomaly Detection:

[0167] The system selects the number of new product users in the past 12 months as time series data and uses the SARIMA model for prediction.

[0168] The system calculates the predicted index value of new user installations in the next month (for example, the number of new product installation users is 100,000), and compares it with the actual observed index value in real time (for example, the actual value is 80,000).

[0169] When the actual observed index value is lower than the set threshold value (such as 10%) of the predicted index value, the system determines that the growth of product users in the province is abnormal.

[0170] Root cause mining and analysis:

[0171] The system calculates the total S value and total EP value under all dimensions. Assuming that the system detects that the total S value is significantly higher in the dimensions of "Nanjing City" and "a certain product package A", and the EP value also reaches the positive threshold, the system identifies these two dimensional indicators as candidate root causes.

[0172] After further screening, the system identified that the abnormal changes in Product Package A in Nanjing and Suzhou were the most obvious, which can be considered as the root cause of the abnormal growth of product users in the province.

[0173] Root cause output and report generation:

[0174] The system generates a root cause analysis report that lists in detail the key dimensions of the anomaly, abnormal elements, S value and EP value rankings, and other information.

[0175] In the visualization interface, users can see the abnormal performance of Nanjing and Suzhou in Package A, historical growth trend charts, and other possible abnormal reasons. In this way, managers can quickly locate the problem and take corresponding measures.

[0176] This embodiment can help enterprises monitor and predict abnormal business indicators in real time during product user development and quickly locate the root cause. When the system detects abnormal user growth in a certain area, it can promptly discover and trace the root cause to avoid user loss and market share loss. The system's visual report improves the decision-making efficiency of managers and shortens the time to discover and solve problems.

[0177] According to some embodiments of this application, please refer to Fig.10The service anomaly root cause analysis method of the embodiment of the present application is applied to the abnormal location analysis of multi-package service indicators. The specific description is as follows:

[0178] Data collection: collect user data of different packages from the business system, including user package ordering data, user feedback and satisfaction data, marketing activity data, user usage, regional market and other multi-dimensional indicators.

[0179] Time series analysis, using the Prophet model to predict future user subscription trends for each package.

[0180] Root cause analysis module: Calculate the root cause of abnormal packages through EP value, further analyze the dependencies between different packages through Bayesian structural learning model, and output possible related anomalies.

[0181] The normal data (i.e. the actual observed index value) and abnormal data of each dimension indicator are explained as follows:

[0182] Package sales data

[0183] Normal data:

[0184] The monthly sales of different packages remain stable, with Package A selling 1,000 units per month and Package B selling 800 units per month.

[0185] The transaction conversion rate of each package remains between 10% and 15%.

[0186] Abnormal data:

[0187] The sales volume of a certain package dropped suddenly. For example, only 300 packages of Package A were sold in a certain month, a drop of more than 70%.

[0188] The conversion rate for a particular package plummeted to below 3%, clearly showing an increase in page visits without a corresponding increase in sales.

[0189] User feedback and satisfaction data

[0190] Normal data:

[0191] In the user satisfaction survey, the satisfaction scores of the packages were all above 4 points (out of 5 points).

[0192] The complaint rate was less than 2% and the feedback was mainly positive.

[0193] Abnormal data:

[0194] The satisfaction score of a certain package dropped sharply to 2.5 points due to users' cognitive bias towards the package content.

[0195] The complaint rate rose to 8%, with users expressing strong dissatisfaction with the mismatch between package prices and performance.

[0196] Marketing activity data

[0197] Normal data:

[0198] The number of participants in marketing activities remains stable, with between 300-500 people per event.

[0199] During the event, package sales increased by an average of 20%.

[0200] Abnormal data:

[0201] The number of participants in a certain marketing campaign suddenly dropped to 50 people, failing to increase sales, and the campaign effect was extremely poor.

[0202] After the marketing campaign, there was no increase in package sales, with sales volume remaining flat or declining.

[0203] User usage data

[0204] Normal data:

[0205] The frequency of package usage is stable, with users using the package at least 4 times per month on average.

[0206] The user renewal rate is as high as 70%, and more users are satisfied with the package content.

[0207] Abnormal data:

[0208] The frequency of package usage has dropped to only once a month, and users have reported that the functions and content are not attractive.

[0209] The renewal rate dropped sharply to 30%, and a large number of users did not renew their contracts after their packages expired.

[0210] Regional Market Data

[0211] Normal data:

[0212] The sales of packages in different regions are well balanced, with sales volumes roughly the same, and consumers in major cities have a high acceptance of packages.

[0213] Abnormal data:

[0214] Sales of packages in some areas are obviously insufficient, and users living in these areas have reported the packages as "insignificant".

[0215] Multiple promotional activities in a certain area were ineffective and sales were far below expectations.

[0216] Other key business indicator (KPI) data

[0217] Normal data:

[0218] The package life cycle management and key performance indicators (KPIs) performed well, such as the Net Promoter Score (NPS) remained above 60.

[0219] Abnormal data:

[0220] The cross-sell rate of users after adding more packages dropped sharply to below 1%, failing to activate customers' potential demand.

[0221] The user churn rate rose to over 5%, out of line with the expected value.

[0222] The specific implementation process is as follows:

[0223] Multi-dimensional data collection and preprocessing: The system collects user data of each package (such as Package A, Package B) and classifies it by time and region.

[0224] Time series prediction and anomaly detection: The Prophet algorithm is used to predict the package ordering volume. The system finds that the ordering volume of package A in a certain place (such as Nanjing) is significantly lower than the predicted value.

[0225] Root cause analysis and screening: The system calculated the S value and EP value and determined that there was an abnormal correlation between Package A and Package B in Nanjing and Suzhou. The decrease in the order volume of Package A in Nanjing became the root cause of the abnormality.

[0226] Report output and visual display: The system generates multiple analysis reports to help users locate multiple root causes (such as root cause A, root cause B, and root cause C) and take countermeasures.

[0227] This system can quickly analyze the complex dependencies between different packages, effectively locate the abnormal reasons for user ordering behavior, and help with product optimization and business adjustments.

[0228] See also Figure 8 The present application also provides a system for analyzing root causes of business anomalies, including:

[0229] The first module is used to obtain a business data set of multiple dimensional indicators, wherein the elements of the business data set of each dimensional indicator represent the first indicator value at different historical times;

[0230] The second module uses the business data set according to each dimension indicator to predict the future time indicator and obtain the second indicator value of the dimension indicator in the future time;

[0231] The third module is used to perform anomaly detection based on the second indicator value to determine whether the dimension indicator is abnormal;

[0232] The fourth module is used to calculate the unexpected difference value and abnormal ability explanation value of each element in the business data set under the corresponding dimension indicator when the dimension indicator is abnormal;

[0233] The fifth module is used to determine the abnormal contribution degree of the dimension indicator according to the unexpected difference value and abnormal ability explanation value of each element under the corresponding dimension indicator;

[0234] The sixth module is used to determine the results of the business anomaly root cause analysis based on the degree of abnormal contribution of each dimensional indicator.

[0235] It can be understood that the contents of the above-mentioned business anomaly root cause analysis method embodiment are all applicable to the present system embodiment, the functions specifically implemented by the present system embodiment are the same as those in the above-mentioned business anomaly root cause analysis method embodiment, and the beneficial effects achieved are also the same as those achieved by the above-mentioned business anomaly root cause analysis method embodiment.

[0236] The embodiment of the present application also provides an electronic device, the electronic device comprising: a memory, a processor, a program stored in the memory and executable on the processor, and a data bus for realizing connection and communication between the processor and the memory, and the program is executed by the processor to realize the above-mentioned service abnormality root cause analysis method. The electronic device can be any intelligent terminal including a tablet computer, a vehicle-mounted computer, etc.

[0237] See also Fig. 9 , Fig. 9 The hardware structure of an electronic device of another embodiment is illustrated, and the electronic device includes:

[0238] The processor 901 may be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (Application Specific Integrated Circuit, ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of the present application;

[0239] The memory 902 can be implemented in the form of a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 902 can store an operating system and other application programs. When the technical solution provided in the embodiment of this specification is implemented by software or firmware, the relevant program code is stored in the memory 902, and the processor 901 calls and executes the service abnormality root cause analysis method of the embodiment of this application;

[0240] Input / output interface 903, used to implement information input and output;

[0241] Communication interface 904, used to realize communication interaction between the device and other devices, which can be realized by wired mode (such as USB, network cable, etc.) or wireless mode (such as mobile network, WIFI, Bluetooth, etc.);

[0242] A bus 905 that transmits information between various components of the device (e.g., the processor 901, the memory 902, the input / output interface 903, and the communication interface 904);

[0243] The processor 901 , the memory 902 , the input / output interface 903 and the communication interface 904 are connected to each other in communication within the device via a bus 905 .

[0244] An embodiment of the present application also provides a storage medium, which is a computer-readable storage medium used for computer-readable storage. The storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the above-mentioned business anomaly root cause analysis method.

[0245] The memory, as a non-transient computer-readable storage medium, can be used to store non-transient software programs and non-transient computer executable programs. In addition, the memory may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory may optionally include a memory remotely disposed relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0246] The business anomaly root cause analysis method, device, electronic device and storage medium provided in the embodiments of the present application predict future time indicators based on the business data set of each dimensional indicator, obtain a second indicator value of the dimensional indicator in the future time, and then perform anomaly detection based on the second indicator value to determine whether the dimensional indicator is abnormal, and perform root cause analysis when the dimensional indicator is abnormal, thereby improving the timeliness of the root cause analysis. The root cause analysis is to calculate the unexpected difference value and abnormal capability explanation value of each element in the business data set under the corresponding dimensional indicator, determine the abnormal contribution degree of the dimensional indicator according to the unexpected difference value and abnormal capability explanation value of each element under the corresponding dimensional indicator, and determine the business anomaly root cause analysis result according to the abnormal contribution degree of each dimensional indicator. By performing anomaly analysis on each dimensional indicator, the comprehensiveness of the business anomaly root cause analysis can be improved.

[0247] The embodiments described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application and do not constitute a limitation on the technical solutions provided in the embodiments of the present application. Those skilled in the art will appreciate that with the evolution of technology and the emergence of new application scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0248] Those skilled in the art will appreciate that the technical solutions shown in the figures do not constitute a limitation on the embodiments of the present application, and may include more or fewer steps than shown in the figures, or a combination of certain steps, or different steps.

[0249] The system embodiments described above are merely illustrative, and the units described as separate components may or may not be physically separated, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the present embodiment.

[0250] Those skilled in the art will appreciate that all or some of the steps in the methods disclosed above, and the functional modules / units in the systems and devices may be implemented as software, firmware, hardware, or a suitable combination thereof.

[0251] The terms "first", "second", "third", "fourth", etc. (if any) in the specification of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0252] It should be understood that in the present application, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the objects associated before and after are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0253] In the several embodiments provided in the present application, it should be understood that the disclosed systems and methods can be implemented in other ways. For example, the system embodiments described above are only schematic. For example, the division of the above units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of systems or units, which can be electrical, mechanical or other forms.

[0254] The units described above as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0255] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0256] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including multiple instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, referred to as ROM), random access memory (Random Access Memory, referred to as RAM), disk or optical disk and other media that can store programs.

[0257] The preferred embodiments of the present invention are described above with reference to the accompanying drawings, but the scope of the rights of the present invention is not limited thereto. Any modification, equivalent substitution and improvement made by a person skilled in the art without departing from the scope and essence of the present invention should be within the scope of the rights of the present invention.

Claims

1. A method for analyzing the root cause of business anomalies, characterized in that: The following steps are involved: Acquire a business data set of multiple dimensional indicators, wherein an element of the business data set of each dimensional indicator represents a first indicator value at different historical times; Perform future time index prediction based on the business data set of each dimensional index to obtain a second index value of the dimensional index in the future time; Perform anomaly detection according to the second indicator value to determine whether the dimension indicator is abnormal; When the dimension indicator is abnormal, the unexpected difference value and abnormal capability explanation value of each element in the business data set under the corresponding dimension indicator are calculated; Determine the abnormal contribution degree of the dimensional indicator according to the unexpected difference value and abnormal ability explanation value of each element under the corresponding dimensional indicator; The business anomaly root cause analysis results are determined based on the degree of abnormal contribution of each of the dimensional indicators.

2. The method for analyzing the root cause of business anomalies according to claim 1, characterized in that: The step of performing future time index prediction according to the business data set of each dimensional index to obtain a second index value of the dimensional index at the future time includes the following steps: Determine a prediction model algorithm for the dimensional indicator according to the time regularity attribute of the dimensional indicator; Using the prediction model algorithm, predicting the future time index according to the business data set of the dimensional index, and obtaining the second index value of the dimensional index; Among them, the prediction model algorithm corresponding to the time regularity attribute of seasonal periodic fluctuations is the seasonal autoregressive integrated moving average time series model, the preset model algorithm corresponding to the time regularity attribute of seasonal periodic fluctuations and the influence of preset time events is the Prophet prediction algorithm; the prediction model algorithm corresponding to the time regularity attribute of linear time is the autoregressive integrated moving average model.

3. The method for analyzing the root cause of business anomalies according to claim 1, characterized in that: The performing anomaly detection according to the second indicator value to determine whether the dimension indicator is abnormal includes the following steps: Obtaining actual observed indicator values ​​of the dimension indicators; The second indicator value is compared with the actually observed indicator value to obtain a comparison result of the dimensional indicator, wherein the comparison result is used to determine whether the dimensional indicator is abnormal.

4. The method for analyzing the root cause of business anomalies according to claim 1, characterized in that: The unexpected difference value of each element in the business data set under the corresponding dimension index is calculated by the following steps: Determining the probability distribution of the dimensional indicator according to the business data set; Determine a first probability value of the element and a second probability value of an actual observed index value of a corresponding dimensional index according to the probability distribution; An unexpected difference value for the element is determined based on the first probability value and the second probability value.

5. The method for analyzing the root cause of business anomalies according to claim 1, characterized in that: The abnormal capability explanation value of each element in the business data set under the corresponding dimension indicator is obtained by the following steps: Calculate the difference between each element in the business data set and the actual observed index value of the corresponding dimension index; The difference value of the element is divided by the sum of the difference values ​​of all elements in the business data set to obtain the abnormal capability explanation value of the element.

6. The method for analyzing the root cause of business anomalies according to claim 1, characterized in that: Determining the abnormal contribution degree of the dimensional index according to the unexpected difference value and abnormal ability explanation value of each element under the corresponding dimensional index includes the following steps: Adding the element whose abnormal capability explanation value is greater than the first threshold to the root cause set of the corresponding dimension indicator; Calculating the sum of the abnormal ability explanation values ​​of the elements in the root cause set to obtain the total explanation value of the dimension indicator; Calculating the sum of the unexpected difference values ​​of all elements of the dimensional index to obtain a total unexpected value of the dimensional index; The degree of abnormal contribution of the dimensional indicator is determined based on the total explanation value and the total unexpected value of the dimensional indicator.

7. The method for analyzing the root cause of business anomalies according to claim 1, characterized in that: The business abnormality root cause analysis method further includes the following steps: Determining the associated index of the abnormal dimensional index through the dependency relationship between the dimensional indexes, wherein the dependency relationship is constructed through a Bayesian structure learning algorithm; The data changes in the business data set of the associated indicator are analyzed to determine whether the associated indicator is a root cause of the business anomaly.

8. A business abnormality root cause analysis system, characterized in that: include: The first module is used to obtain a business data set of multiple dimensional indicators, wherein the elements of the business data set of each dimensional indicator represent the first indicator value at different historical times; The second module uses the business data set according to each dimensional indicator to predict the future time indicator to obtain the second indicator value of the dimensional indicator in the future time; A third module is used to perform anomaly detection according to the second indicator value to determine whether the dimension indicator is abnormal; The fourth module is used to calculate the unexpected difference value and abnormal capability explanation value of each element in the business data set under the corresponding dimensional indicator when the dimensional indicator is abnormal; A fifth module is used to determine the abnormal contribution degree of the dimensional indicator according to the unexpected difference value and abnormal ability explanation value of each element under the corresponding dimensional indicator; The sixth module is used to determine the business anomaly root cause analysis results based on the degree of abnormal contribution of each of the dimensional indicators.

9. An electronic device, characterized in that: The electronic device includes a memory, a processor, a program stored in the memory and executable on the processor, and a data bus for realizing connection and communication between the processor and the memory. When the program is executed by the processor, the steps of the method described in any one of claims 1 to 7 are realized.

10. A storage medium, the storage medium being a computer-readable storage medium, used for computer-readable storage, characterized in that: The storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the steps of any one of claims 1 to 7.

Images