Application service reliability anomaly detection method and related equipment

Abstract

The embodiment of the invention belongs to the technical field of artificial intelligence, and relates to an application service reliability anomaly detection method and related equipment, and the method comprises the steps: receiving an anomaly detection request of a target application service sent by a user terminal; calling a system database, and obtaining historical index data corresponding to the target application service in the system database; performing association representation operation on the historical index data according to a graph neural network algorithm to obtain an index association representation vector; preprocessing the historical index data to obtain index feature data; constructing an anomaly detection feature set according to the index association representation vector, the index feature data and a feature engineering technology; training an anomaly detection model according to an isolated forest algorithm and the anomaly detection feature set; performing anomaly detection operation on the target application service in real time according to the trained anomaly detection model to obtain an anomaly detection result; and outputting an anomaly detection result to the user terminal. According to the invention, real-time anomaly detection of the target application service can be realized.

Description

Technical Field

[0001] The present application relates to the field of artificial intelligence technology, and in particular to an anomaly detection method for application service reliability and related equipment. Background Art

[0002] Application service reliability is a measure of whether an application service can provide its expected functions continuously, stably and without failure. This reliability is crucial to ensuring user experience, business continuity and data security.

[0003] In the traditional application service reliability detection mechanism, the health detection of the application server is implemented based on the option heartbeat mechanism.

[0004] However, the applicant found that the traditional option heartbeat mechanism cannot guarantee the normal operation of the business. The time taken from discovering an abnormality in the application server to restoring it to normal is relatively long. This shows that the traditional application service reliability detection mechanism has the problem of low detection efficiency. Summary of the invention

[0005] The purpose of the embodiments of the present application is to provide an anomaly detection method and related equipment for application service reliability, so as to solve the problem of low detection efficiency of the traditional application service reliability detection mechanism.

[0006] In order to solve the above technical problems, the embodiment of the present application provides an abnormality detection method for application service reliability, which adopts the following technical solution:

[0007] Receiving an anomaly detection request for a target application service sent by a user terminal;

[0008] Calling a system database, and obtaining historical indicator data corresponding to the target application service in the system database;

[0009] Performing an association representation operation on the historical indicator data according to a graph neural network algorithm to obtain an indicator association representation vector;

[0010] Performing a preprocessing operation on the historical indicator data to obtain indicator characteristic data;

[0011] Constructing an anomaly detection feature set according to the indicator association representation vector, the indicator feature data and feature engineering technology;

[0012] Calling an initial anomaly detection model, and training the initial anomaly detection model according to an isolation forest algorithm and the anomaly detection feature set to obtain a trained anomaly detection model;

[0013] Perform an anomaly detection operation on the target application service in real time according to the trained anomaly detection model to obtain an anomaly detection result;

[0014] The abnormality detection result is output to the user terminal.

[0015] Furthermore, the indicator characteristic data includes first indicator characteristic data and second indicator characteristic data, and the step of performing a preprocessing operation on the historical indicator data to obtain the indicator characteristic data specifically includes the following steps:

[0016] Performing a first preprocessing operation on the continuous numerical index of the historical index data according to a normalization method to obtain the first index characteristic data;

[0017] A second preprocessing operation is performed on the discrete counting indicators of the historical indicator data according to the one-hot encoding technology to obtain the second indicator feature data.

[0018] Furthermore, the step of calling the system database and obtaining the historical indicator data corresponding to the target application service in the system database specifically includes the following steps:

[0019] The multi-source heterogeneous indicator data of the target application service are aggregated and cleaned in real time according to a distributed stream computing framework to obtain the historical indicator data.

[0020] Furthermore, the aggregation and cleaning operations are optimized based on in-memory computation and incremental updates.

[0021] Furthermore, after the step of calling the system database and acquiring the historical indicator data corresponding to the target application service in the system database, the following step is also included:

[0022] Obtaining the time decay law of the historical data of the target application service;

[0023] Performing a weight distribution operation on the historical indicator data according to the time decay law to obtain the historical indicator data after weight distribution;

[0024] The step of performing an association characterization operation on the historical indicator data according to the graph neural network algorithm to obtain an indicator association characterization vector specifically includes the following steps:

[0025] According to the graph neural network algorithm, an association representation operation is performed on the historical indicator data after the weight allocation to obtain an indicator association representation vector.

[0026] Furthermore, after the step of training the anomaly detection model according to the isolation forest algorithm and the anomaly detection feature set, the following steps are also included:

[0027] Acquire a service scenario corresponding to the target application service;

[0028] According to the service scenario, a corresponding anomaly detection threshold and rule are set for the anomaly detection model to obtain a target anomaly detection model;

[0029] The step of performing an anomaly detection operation on the target application service in real time according to the anomaly detection model to obtain an anomaly detection result specifically includes the following steps:

[0030] An anomaly detection operation is performed on the target application service in real time according to the target anomaly detection model to obtain an anomaly detection result.

[0031] In order to solve the above technical problems, the embodiment of the present application also provides an abnormality detection device for application service reliability, which adopts the following technical solution:

[0032] A request acquisition module, used to receive an anomaly detection request for a target application service sent by a user terminal;

[0033] A historical data acquisition module, used to call a system database and acquire historical indicator data corresponding to the target application service in the system database;

[0034] An association representation module is used to perform an association representation operation on the historical indicator data according to a graph neural network algorithm to obtain an indicator association representation vector;

[0035] A preprocessing module, used to perform preprocessing operations on the historical indicator data to obtain indicator feature data;

[0036] A feature set construction module, used to construct an anomaly detection feature set based on the indicator association characterization vector, the indicator feature data and feature engineering technology;

[0037] A detection model training module, used to call an initial anomaly detection model, and train the initial anomaly detection model according to an isolation forest algorithm and the anomaly detection feature set to obtain a trained anomaly detection model;

[0038] An anomaly detection module, used to perform an anomaly detection operation on the target application service in real time according to the trained anomaly detection model to obtain an anomaly detection result;

[0039] A result output module is used to output the abnormality detection result to the user terminal.

[0040] Further, the indicator characteristic data includes first indicator characteristic data and second indicator characteristic data, and the preprocessing module includes:

[0041] A first preprocessing submodule, configured to perform a first preprocessing operation on the continuous numerical index of the historical index data according to a normalization method to obtain the first index characteristic data;

[0042] The second preprocessing submodule is used to perform a second preprocessing operation on the discrete counting indicators of the historical indicator data according to the one-hot encoding technology to obtain the second indicator feature data.

[0043] In order to solve the above technical problems, the embodiment of the present application further provides a computer device, which adopts the following technical solution:

[0044] The invention comprises a memory and a processor, wherein the memory stores computer-readable instructions, and the processor implements the steps of the above-mentioned anomaly detection method for application service reliability when executing the computer-readable instructions.

[0045] In order to solve the above technical problems, the embodiment of the present application further provides a computer-readable storage medium, which adopts the following technical solution:

[0046] The computer-readable storage medium stores computer-readable instructions, and when the computer-readable instructions are executed by the processor, the steps of the anomaly detection method for application service reliability as described above are implemented.

[0047] The present application provides an anomaly detection method for application service reliability, including: receiving an anomaly detection request for a target application service sent by a user terminal; calling a system database, and obtaining historical indicator data corresponding to the target application service in the system database; performing an association characterization operation on the historical indicator data according to a graph neural network algorithm to obtain an indicator association characterization vector; performing a preprocessing operation on the historical indicator data to obtain indicator feature data; constructing an anomaly detection feature set according to the indicator association characterization vector, the indicator feature data, and feature engineering technology; calling an initial anomaly detection model, and training the initial anomaly detection model according to an isolation forest algorithm and the anomaly detection feature set to obtain a trained anomaly detection model; performing an anomaly detection operation on the target application service in real time according to the trained anomaly detection model to obtain an anomaly detection result; and outputting the anomaly detection result to the user terminal. Compared with the prior art, the present application can realize real-time anomaly detection of the target application service, and effectively improve the efficiency of anomaly detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] In order to more clearly illustrate the scheme in the present application, a brief introduction is given below to the drawings required for use in the description of the embodiments of the present application. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0049] Figure 1 is an exemplary system architecture diagram to which the present application may be applied;

[0050] Figure 2 It is a flow chart of an implementation method of anomaly detection of application service reliability provided by an embodiment of the present application;

[0051] Figure 3 It is a structural diagram of an anomaly detection device for application service reliability provided in an embodiment of the present application;

[0052] Figure 4 It is a structural diagram of an embodiment of a computer device according to the present application. DETAILED DESCRIPTION

[0053] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by technicians in the technical field of the present application; the terms used in the specification of the application herein are only for the purpose of describing specific embodiments and are not intended to limit the present application; the terms "including" and "having" and any variations thereof in the specification and claims of the present application and the above-mentioned drawings are intended to cover non-exclusive inclusions. The terms "first", "second", etc. in the specification and claims of the present application or the above-mentioned drawings are used to distinguish different objects, not to describe a specific order.

[0054] Reference to "embodiments" herein means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0055] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the accompanying drawings.

[0056] like Figure 1 As shown, the system architecture 100 may include a terminal device 101, a network 102 and a server 103. The terminal device 101 may be a laptop 1011, a tablet computer 1012 or a mobile phone 1013. The network 102 is used to provide a medium for a communication link between the terminal device 101 and the server 103. The network 102 may include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0057] The user can use the terminal device 101 to interact with the server 103 through the network 102 to receive or send messages, etc. Various communication client applications can be installed on the terminal device 101, such as web browser applications, shopping applications, search applications, instant messaging tools, email clients, social platform software, etc.

[0058] The terminal device 101 can be any electronic device with a display screen and supporting web browsing. In addition to the laptop computer 1011, tablet computer 1012 or mobile phone 1013, the terminal device 101 can also be an e-book reader, an MP3 player (Moving Picture Experts Group Audio Layer III), an MP4 (Moving Picture Experts Group Audio Layer IV), a laptop computer, a desktop computer, etc.

[0059] The server 103 may be a server that provides various services, such as a background server that provides support for web pages displayed on the terminal device 101 .

[0060] It should be noted that the anomaly detection method for application service reliability provided in the embodiment of the present application is generally executed by a server / terminal device, and accordingly, the anomaly detection device for application service reliability is generally arranged in a server / terminal device.

[0061] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0062] Continue to refer Figure 2 , shows a flow chart of an embodiment of an abnormality detection method for application service reliability according to the present application. The abnormality detection method for application service reliability includes: step S201, step S202, step S203, step S204, step S205, step S206, step S207 and step S208.

[0063] In step S201, an abnormality detection request for a target application service sent by a user terminal is received.

[0064] In the embodiment of the present application, when a user finds that the application service he uses (such as the order processing service of the e-commerce platform, the transaction settlement service of the financial system, etc.) has abnormal behavior, he can send an abnormal detection request to the system through the user terminal (such as a mobile phone, computer, etc.). This request usually contains the identification information of the target application service so that the system can accurately locate the service that needs to be detected.

[0065] In step S202, the system database is called to obtain historical indicator data corresponding to the target application service in the system database.

[0066] In the embodiment of the present application, after receiving the anomaly detection request, the system will first access its internal system database. This database stores the historical operation data of each application service, including various performance indicators (such as response time, throughput, error rate, etc.). The system will retrieve the historical indicator data related to the service from the database based on the identification information of the target application service.

[0067] In step S203, an association representation operation is performed on the historical indicator data according to the graph neural network algorithm to obtain an indicator association representation vector.

[0068] In an embodiment of the present application, the system uses a graph neural network (GNN) algorithm to process historical indicator data. GNN is a neural network specifically used to process graph structure data, which can capture complex correlations between data. Through the GNN algorithm, the system can treat each indicator point in the historical indicator data as a node in the graph, and generate an indicator correlation representation vector by learning the connection relationship between the nodes. This vector can reflect the intrinsic connection between the indicators and provide useful information for subsequent anomaly detection.

[0069] In an embodiment of the present application, an indicator association graph is constructed based on the correlation relationship of multi-dimensional historical indicator data, and the complex interaction patterns between indicators are learned through a graph neural network algorithm to explore the implicit relationships between the indicators and form an indicator association representation vector.

[0070] In step S204, a preprocessing operation is performed on the historical indicator data to obtain indicator feature data.

[0071] In the embodiment of the present application, before performing anomaly detection, a series of preprocessing operations are required on the historical indicator data. These operations include data cleaning (removing invalid or outliers), data normalization (converting data of different dimensions to the same dimension), feature selection (selecting the most useful features for anomaly detection from the original data), etc. After preprocessing, the system will obtain a set of cleaner and more standardized indicator feature data.

[0072] In step S205, an anomaly detection feature set is constructed based on the indicator association characterization vector, indicator feature data, and feature engineering technology.

[0073] In the embodiment of the present application, after obtaining the indicator association characterization vector and the indicator feature data, the system will combine them using feature engineering technology to construct a feature set for anomaly detection. This feature set not only contains the feature information of the original indicator data, but also incorporates the association relationship information between indicators, thereby improving the accuracy and robustness of anomaly detection.

[0074] In the embodiment of the present application, based on the indicator association characterization vector, the original features of the indicators are integrated, and feature engineering methods such as feature selection and combination are used to construct an anomaly detection feature set that can comprehensively characterize the service status.

[0075] In step S206, the initial anomaly detection model is called, and the initial anomaly detection model is trained according to the isolation forest algorithm and the anomaly detection feature set to obtain a trained anomaly detection model.

[0076] In an embodiment of the present application, the system uses an isolation forest algorithm to train an anomaly detection model. Isolation forest is an unsupervised learning algorithm based on random forests, which divides data points by randomly selecting a feature and a feature value until all data points are isolated. Since abnormal data is usually easier to isolate, the isolation forest algorithm can effectively identify abnormal data. Through the training process, the system will obtain a model that can determine whether the data is abnormal based on the input feature set.

[0077] In step S207, an anomaly detection operation is performed on the target application service in real time according to the trained anomaly detection model to obtain an anomaly detection result.

[0078] In the embodiment of the present application, by setting an abnormal score threshold, it is determined whether the service is currently in an abnormal state.

[0079] In step S208, the abnormality detection result is output to the user terminal.

[0080] In an embodiment of the present application, a method for detecting anomalies of application service reliability is provided, including: receiving an anomaly detection request for a target application service sent by a user terminal; calling a system database, and obtaining historical indicator data corresponding to the target application service in the system database; performing an association characterization operation on the historical indicator data according to a graph neural network algorithm to obtain an indicator association characterization vector; performing a preprocessing operation on the historical indicator data to obtain indicator feature data; constructing an anomaly detection feature set according to the indicator association characterization vector, the indicator feature data, and feature engineering technology; training an anomaly detection model according to an isolation forest algorithm and anomaly detection feature set; performing an anomaly detection operation on the target application service in real time according to the anomaly detection model to obtain an anomaly detection result; and outputting the anomaly detection result to the user terminal. Compared with the prior art, the present application can realize real-time anomaly detection of the target application service, and effectively improve the efficiency of anomaly detection.

[0081] In some optional implementations of the embodiments of the present application, the above-mentioned indicator characteristic data includes first indicator characteristic data and second indicator characteristic data, and the above-mentioned step of performing a preprocessing operation on the historical indicator data to obtain the indicator characteristic data specifically includes the following steps:

[0082] Performing a first preprocessing operation on the continuous numerical indicators of the historical indicator data according to a normalization method to obtain first indicator characteristic data;

[0083] A second preprocessing operation is performed on the discrete counting indicators of the historical indicator data according to the one-hot encoding technology to obtain second indicator feature data.

[0084] In an embodiment of the present application, in the data preprocessing stage, for continuous numerical indicators (such as response time, throughput, CPU usage, etc.) in historical indicator data, since they usually have different dimensions and value ranges, being directly used for model training will cause the model to prefer certain features, thereby affecting the accuracy and stability of the model. Therefore, it is necessary to normalize these continuous numerical indicators, wherein normalization is a technique for scaling data to a specific range (usually 0 to 1 or -1 to 1). Through normalization, indicator data of different dimensions can be converted into data with the same scale, so that the model can treat each feature equally during the training process.

[0085] In the embodiment of the present application, the normalization method includes Min-Max Scaling and Z-Score Normalization. Min-Max Normalization is to scale the data between a specified minimum and maximum value, while Z-Score Normalization is to convert the data into a distribution with a mean of 0 and a standard deviation of 1. In this process, the system applies the normalization method to each continuous numerical indicator in the historical indicator data to obtain the normalized first indicator feature data. These data will serve as the basis for subsequent feature engineering and model training.

[0086] In the embodiment of the present application, in addition to continuous numerical indicators, the historical indicator data also includes discrete counting indicators (such as error type, user status, system status, etc.) These indicators usually appear in the form of categories or labels, and each category has a unique meaning.

[0087] In the embodiments of the present application, when processing such indicators, if their values ​​are directly input into the model as features, the model will misunderstand the numerical relationship between categories (for example, the numerical value "1" of category "error type 1" and the numerical value "2" of category "error type 2" are considered to have a certain order relationship). In order to avoid this situation, it is necessary to use a technology that can convert categories into numerical forms that the model can understand, namely, One-Hot Encoding.

[0088] In the embodiment of the present application, one-hot encoding is a method of converting a categorical variable into a binary vector. For each category, one-hot encoding creates a new binary feature that takes a value of 1 when the corresponding category appears and takes a value of 0 when other categories appear. In this way, each category will be converted into a unique binary vector, thereby avoiding numerical misunderstandings between categories. In this process, the system will apply one-hot encoding technology to each discrete counting indicator in the historical indicator data to obtain the second indicator feature data after one-hot encoding. These data will be used together with the normalized first indicator feature data for subsequent feature engineering and model training.

[0089] In the embodiments of the present application, normalization method and one-hot encoding technology are used to process continuous numerical indicators and discrete counting indicators, respectively. They together constitute an important part of the data preprocessing stage and provide high-quality input data for subsequent feature engineering and model training.

[0090] In some optional implementations of the embodiments of the present application, the above step of calling the system database to obtain historical indicator data corresponding to the target application service in the system database specifically includes the following steps:

[0091] Based on the distributed stream computing framework, multi-source heterogeneous indicator data of the target application service is aggregated and cleaned in real time to obtain historical indicator data.

[0092] In some optional implementations of the embodiments of the present application, aggregation and cleaning operations are optimized based on memory calculations and incremental updates.

[0093] In the embodiments of the present application, in order to meet the real-time processing requirements of massive monitoring data, a distributed stream computing framework is adopted to aggregate and clean multi-source heterogeneous indicator data in real time. In addition, through optimization methods such as in-memory computing and incremental updates, the throughput of real-time computing is improved and the latency is reduced.

[0094] In some optional implementations of the embodiments of the present application, after the step of calling the system database and obtaining the historical indicator data corresponding to the target application service in the system database, the following steps are also included:

[0095] Obtain the time decay law of historical data of the target application service;

[0096] Perform a weight distribution operation on the historical indicator data according to the time decay law to obtain the historical indicator data after weight distribution;

[0097] The steps of performing association representation operations on historical indicator data according to the graph neural network algorithm to obtain the indicator association representation vector specifically include the following steps:

[0098] According to the graph neural network algorithm, the historical indicator data after weight allocation is associated with the representation operation to obtain the indicator association representation vector.

[0099] In an embodiment of the present application, when making anomaly judgments, different weights are assigned to historical data of different periods according to the time decay law of historical data, and the reference historical time range is dynamically updated through a sliding window mechanism to balance the timeliness and comprehensiveness of the data.

[0100] In some optional implementations of the embodiments of the present application, after the step of calling the initial anomaly detection model and training the initial anomaly detection model according to the isolation forest algorithm and the anomaly detection feature set to obtain the trained anomaly detection model, the following steps are also included:

[0101] Obtain the service scenario corresponding to the target application service;

[0102] Set the corresponding anomaly detection threshold and rules for the anomaly detection model according to the service scenario to obtain the target anomaly detection model;

[0103] The step of performing anomaly detection operations on the target application service in real time according to the anomaly detection model to obtain anomaly detection results specifically includes the following steps:

[0104] According to the target anomaly detection model, anomaly detection operations are performed on the target application service in real time to obtain anomaly detection results.

[0105] In the embodiment of the present application, multiple sets of anomaly detection thresholds and rules are pre-defined to meet the differentiated needs of different service scenarios. According to the SLA level and business characteristics of the specific service, the anomaly judgment strategy is dynamically selected and adjusted to improve the scenario adaptability of the detection results.

[0106] The embodiments of the present application can acquire and process relevant data based on artificial intelligence technology. Among them, artificial intelligence (AI) is the theory, method, technology and application system that uses digital computers or machines controlled by digital computers to simulate, extend and expand human intelligence, perceive the environment, acquire knowledge and use knowledge to obtain the best results.

[0107] AI basic technologies generally include sensors, dedicated AI chips, cloud computing, distributed storage, big data processing technology, operation / interaction systems, mechatronics, etc. AI software technologies mainly include computer vision technology, robotics technology, biometrics technology, speech processing technology, natural language processing technology, and machine learning / deep learning.

[0108] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through computer-readable instructions, and the computer-readable instructions can be stored in a computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, the aforementioned storage medium can be a non-volatile storage medium such as a disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM).

[0109] It should be understood that, although the steps in the flowchart of the accompanying drawings are displayed in sequence as indicated by the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least a part of the steps in the flowchart of the accompanying drawings may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and their execution order is not necessarily sequential, but can be executed in turn or alternately with other steps or at least a part of the sub-steps or stages of other steps.

[0110] Further references Figure 3 , as a response to the above Figure 2 The present application provides an embodiment of an abnormality detection device for application service reliability. Figure 2 Corresponding to the method embodiment shown, the device can be specifically applied to various electronic devices.

[0111] like Figure 3 As shown, the anomaly detection device 200 for application service reliability in the embodiment of the present application includes:

[0112] The request acquisition module 210 is used to receive an anomaly detection request of a target application service sent by a user terminal;

[0113] The historical data acquisition module 220 is used to call the system database and obtain the historical indicator data corresponding to the target application service in the system database;

[0114] The association representation module 230 is used to perform an association representation operation on the historical indicator data according to the graph neural network algorithm to obtain an indicator association representation vector;

[0115] A preprocessing module 240 is used to perform preprocessing operations on historical indicator data to obtain indicator characteristic data;

[0116] A feature set construction module 250 is used to construct an anomaly detection feature set based on the indicator association characterization vector, the indicator feature data and the feature engineering technology;

[0117] The detection model training module 260 is used to call the initial anomaly detection model and train the initial anomaly detection model according to the isolation forest algorithm and the anomaly detection feature set to obtain a trained anomaly detection model;

[0118] Anomaly detection module 270, used to perform anomaly detection operations on target application services in real time according to the trained anomaly detection model to obtain anomaly detection results;

[0119] The result output module 280 is used to output the abnormality detection result to the user terminal.

[0120] In an embodiment of the present application, an anomaly detection device 200 for application service reliability is provided, including: a request acquisition module 210, which is used to receive an anomaly detection request for a target application service sent by a user terminal; a historical data acquisition module 220, which is used to call a system database and obtain historical indicator data corresponding to the target application service in the system database; an association representation module 230, which is used to perform an association representation operation on the historical indicator data according to a graph neural network algorithm to obtain an indicator association representation vector; a preprocessing module 240, which is used to perform a preprocessing operation on the historical indicator data to obtain indicator feature data; a feature set construction module 250, which is used to construct an anomaly detection feature set according to the indicator association representation vector, the indicator feature data and feature engineering technology; a detection model training module 260, which is used to call an initial anomaly detection model, and train the initial anomaly detection model according to an isolation forest algorithm and an anomaly detection feature set to obtain a trained anomaly detection model; an anomaly detection module 270, which is used to perform an anomaly detection operation on the target application service in real time according to the trained anomaly detection model to obtain an anomaly detection result; and a result output module 280, which is used to output the anomaly detection result to the user terminal. Compared with the prior art, the present invention can realize real-time anomaly detection of target application services and effectively improve the efficiency of anomaly detection.

[0121] In some optional implementations of the embodiments of the present application, the above-mentioned indicator feature data includes first indicator feature data and second indicator feature data, and the preprocessing module includes:

[0122] A first preprocessing submodule, configured to perform a first preprocessing operation on the continuous numerical index of the historical index data according to a normalization method to obtain first index characteristic data;

[0123] The second preprocessing submodule is used to perform a second preprocessing operation on the discrete counting indicators of the historical indicator data according to the one-hot encoding technology to obtain second indicator feature data.

[0124] To solve the above technical problems, the present application also provides a computer device. Figure 4 , Figure 4 This is a basic structural block diagram of a computer device according to an embodiment of the present application.

[0125] The computer device 300 includes a memory 310, a processor 320, and a network interface 330 that are interconnected and communicated through a system bus. It should be noted that the figure only shows a computer device 300 having components 310-330, but it should be understood that it is not required to implement all the components shown, and more or fewer components can be implemented instead. Among them, those skilled in the art can understand that the computer device here is a device that can automatically perform numerical calculations and / or information processing according to pre-set or stored instructions, and its hardware includes but is not limited to microprocessors, application specific integrated circuits (Application Specific Integrated Circuit, ASIC), programmable gate arrays (Field-Programmable Gate Array, FPGA), digital processors (Digital Signal Processor, DSP), embedded devices, etc.

[0126] The computer device may be a computing device such as a desktop computer, a notebook, a PDA, a cloud server, etc. The computer device may interact with a user through a keyboard, a mouse, a remote controller, a touch pad, or a voice control device.

[0127] The memory 310 includes at least one type of readable storage medium, and the readable storage medium includes flash memory, hard disk, multimedia card, card-type memory (for example, SD or DX memory, etc.), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic memory, magnetic disk, optical disk, etc. In some embodiments, the memory 310 can be an internal storage unit of the computer device 300, such as a hard disk or memory of the computer device 300. In other embodiments, the memory 310 can also be an external storage device of the computer device 300, such as a plug-in hard disk equipped on the computer device 300, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card, etc. Of course, the memory 310 can also include both the internal storage unit of the computer device 300 and its external storage device. In the embodiment of the present application, the memory 310 is generally used to store the operating system and various application software installed on the computer device 300, such as computer-readable instructions of an abnormality detection method for application service reliability, etc. In addition, the memory 310 can also be used to temporarily store various data that have been output or are to be output.

[0128] The processor 320 may be a central processing unit (CPU), a controller, a microcontroller, a microprocessor, or other data processing chip in some embodiments. The processor 320 is generally used to control the overall operation of the computer device 300. In the embodiment of the present application, the processor 320 is used to run the computer-readable instructions stored in the memory 310 or process data, such as computer-readable instructions for running the anomaly detection method for the reliability of the application service.

[0129] The network interface 330 may include a wireless network interface or a wired network interface. The network interface 330 is generally used to establish a communication connection between the computer device 300 and other electronic devices.

[0130] The computer device provided in this application can realize real-time anomaly detection of target application services and effectively improve the efficiency of anomaly detection.

[0131] The present application also provides another implementation, namely, providing a computer-readable storage medium, wherein the computer-readable storage medium stores computer-readable instructions, and the computer-readable instructions can be executed by at least one processor to enable the at least one processor to perform the steps of the anomaly detection method for application service reliability as described above.

[0132] The computer-readable storage medium provided in this application can realize real-time anomaly detection of target application services and effectively improve the efficiency of anomaly detection.

[0133] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in each embodiment of the present application.

[0134] Obviously, the embodiments described above are only some embodiments of the present application, rather than all embodiments. The preferred embodiments of the present application are given in the accompanying drawings, but they do not limit the patent scope of the present application. The present application can be implemented in many different forms. On the contrary, the purpose of providing these embodiments is to make the understanding of the disclosure of the present application more thorough and comprehensive. Although the present application is described in detail with reference to the aforementioned embodiments, for those skilled in the art, it is still possible to modify the technical solutions recorded in the aforementioned specific implementation methods, or to perform equivalent replacement of some of the technical features therein. Any equivalent structure made using the contents of the specification and drawings of this application, directly or indirectly used in other related technical fields, is similarly within the scope of patent protection of this application.

Claims

1. A method for detecting anomalies in application service reliability, characterized in that: The steps include: Receiving an anomaly detection request for a target application service sent by a user terminal; Calling a system database, and obtaining historical indicator data corresponding to the target application service in the system database; Performing an association representation operation on the historical indicator data according to a graph neural network algorithm to obtain an indicator association representation vector; Performing a preprocessing operation on the historical indicator data to obtain indicator characteristic data; Constructing an anomaly detection feature set according to the indicator association representation vector, the indicator feature data and feature engineering technology; Calling an initial anomaly detection model, and training the initial anomaly detection model according to an isolation forest algorithm and the anomaly detection feature set to obtain a trained anomaly detection model; Perform an anomaly detection operation on the target application service in real time according to the trained anomaly detection model to obtain an anomaly detection result; The abnormality detection result is output to the user terminal.

2. The method for detecting anomalies of application service reliability according to claim 1, characterized in that: The indicator characteristic data includes first indicator characteristic data and second indicator characteristic data. The step of performing a preprocessing operation on the historical indicator data to obtain the indicator characteristic data specifically includes the following steps: Performing a first preprocessing operation on the continuous numerical index of the historical index data according to a normalization method to obtain the first index characteristic data; A second preprocessing operation is performed on the discrete counting indicators of the historical indicator data according to the one-hot encoding technology to obtain the second indicator feature data.

3. The method for detecting anomalies of application service reliability according to claim 1, characterized in that: The step of calling the system database and obtaining the historical indicator data corresponding to the target application service in the system database specifically includes the following steps: The multi-source heterogeneous indicator data of the target application service are aggregated and cleaned in real time according to a distributed stream computing framework to obtain the historical indicator data.

4. The method for detecting anomalies in application service reliability according to claim 3, characterized in that: The aggregation and cleaning operations are optimized based on in-memory computation and incremental updates.

5. The method for detecting anomalies in application service reliability according to claim 1, characterized in that: After the step of calling the system database and acquiring the historical indicator data corresponding to the target application service in the system database, the following step is also included: Obtaining the time decay law of the historical data of the target application service; Performing a weight distribution operation on the historical indicator data according to the time decay law to obtain the historical indicator data after weight distribution; The step of performing an association characterization operation on the historical indicator data according to the graph neural network algorithm to obtain an indicator association characterization vector specifically includes the following steps: According to the graph neural network algorithm, an association representation operation is performed on the historical indicator data after the weight allocation to obtain an indicator association representation vector.

6. The method for detecting anomalies in application service reliability according to claim 1, characterized in that: After the step of calling the initial anomaly detection model and training the initial anomaly detection model according to the isolation forest algorithm and the anomaly detection feature set to obtain a trained anomaly detection model, the following steps are also included: Acquire a service scenario corresponding to the target application service; According to the service scenario, a corresponding anomaly detection threshold and rule are set for the anomaly detection model to obtain a target anomaly detection model; The step of performing an anomaly detection operation on the target application service in real time according to the anomaly detection model to obtain an anomaly detection result specifically includes the following steps: An anomaly detection operation is performed on the target application service in real time according to the target anomaly detection model to obtain an anomaly detection result.

7. An abnormality detection device for application service reliability, characterized in that: include: A request acquisition module, used to receive an anomaly detection request for a target application service sent by a user terminal; A historical data acquisition module, used to call a system database and acquire historical indicator data corresponding to the target application service in the system database; An association representation module is used to perform an association representation operation on the historical indicator data according to a graph neural network algorithm to obtain an indicator association representation vector; A preprocessing module, used to perform preprocessing operations on the historical indicator data to obtain indicator feature data; A feature set construction module, used to construct an anomaly detection feature set based on the indicator association characterization vector, the indicator feature data and feature engineering technology; A detection model training module, used to call an initial anomaly detection model, and train the initial anomaly detection model according to an isolation forest algorithm and the anomaly detection feature set to obtain a trained anomaly detection model; An anomaly detection module, used to perform an anomaly detection operation on the target application service in real time according to the trained anomaly detection model to obtain an anomaly detection result; A result output module is used to output the abnormality detection result to the user terminal.

8. The device for detecting anomalies of application service reliability according to claim 7, characterized in that: The indicator feature data includes first indicator feature data and second indicator feature data, and the preprocessing module includes: A first preprocessing submodule, configured to perform a first preprocessing operation on the continuous numerical index of the historical index data according to a normalization method to obtain the first index characteristic data; The second preprocessing submodule is used to perform a second preprocessing operation on the discrete counting indicators of the historical indicator data according to the one-hot encoding technology to obtain the second indicator feature data.

9. A computer device comprising a memory and a processor, characterized in that: The memory stores computer-readable instructions, and when the processor executes the computer-readable instructions, the steps of the anomaly detection method for application service reliability according to any one of claims 1 to 6 are implemented.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-readable instructions, and when the computer-readable instructions are executed by a processor, the steps of the anomaly detection method for application service reliability according to any one of claims 1 to 6 are implemented.

Images