Multi-dimensional index root cause positioning method and electronic equipment

Abstract

The invention provides a multi-dimensional index root cause positioning method and electronic equipment, and belongs to the technical field of root cause positioning. According to the method, abnormal candidate dimension factor combinations are filtered out through an adaptive residual filtering algorithm, and then the candidate dimension factor combinations are clustered based on a density clustering algorithm, so that the candidate dimension factor combinations influenced by the same root cause are clustered into a cluster, and a plurality of clustering families are obtained. And determining at least one candidate dimension factor combination as a root cause according to the abnormal fluctuation degree, the consistency ratio and the noise ratio of each candidate dimension factor combination in the cluster family. According to the root cause positioning method and device, the influence of multiple aspects of the abnormal fluctuation degree, the consistency ratio and / or the noise ratio corresponding to each candidate dimension factor combination is comprehensively considered, and the accuracy of root cause positioning can be improved.

Description

Technical Field

[0001] The present application relates to the field of root cause positioning technology, and in particular to a multi-dimensional indicator root cause positioning method and electronic equipment. Background Art

[0002] Although the existing Adtributor algorithm can identify the root cause of a single dimension, in the actual production environment, the problem often involves the complex interaction of multi-dimensional factors. The existing algorithm cannot meet the needs of accurately locating the root cause of the combination of multi-dimensional factors. Summary of the invention

[0003] The main purpose of the embodiments of the present application is to provide a multi-dimensional indicator root cause location method and electronic device, so as to realize multi-dimensional indicator root cause location and improve the accuracy of root cause location.

[0004] To achieve the above-mentioned purpose, a first aspect of an embodiment of the present application proposes a multi-dimensional indicator root cause location method, the method comprising:

[0005] Filter out abnormal candidate dimension factor combinations through adaptive residual filtering algorithm;

[0006] Clustering the candidate dimensional factor combinations based on a density clustering algorithm to cluster the candidate dimensional factor combinations affected by the same root cause into one cluster to obtain a plurality of cluster families;

[0007] According to the abnormal fluctuation degree, consistency ratio and noise ratio of each candidate dimensional factor combination in the clustering family, a first weighted abnormal impact score corresponding to each clustering family is calculated, and a target clustering family with the largest first weighted abnormal impact score is obtained;

[0008] Calculating a second weighted abnormal impact score corresponding to each candidate dimensional factor combination in the target cluster family according to the abnormal fluctuation degree and consistency ratio of each candidate dimensional factor combination in the target cluster family;

[0009] According to the second weighted abnormal impact score corresponding to each candidate dimensional factor combination in the target cluster family, at least one candidate dimensional factor combination is determined from the target cluster family as a root cause.

[0010] In one embodiment of the present application, filtering out abnormal dimensional factor combinations by an adaptive residual filtering algorithm includes:

[0011] According to the expected value and observed value corresponding to the dimensional factor combination, the residual value corresponding to each dimensional factor combination is calculated;

[0012] The residual values ​​of each of the dimensional factor combinations are sorted in order of size, and a cumulative distribution function is constructed to calculate the cumulative frequency value corresponding to each of the residual values;

[0013] Determining a target residual value corresponding to a significant change in the cumulative frequency value according to a correspondence between the residual value and the cumulative frequency value;

[0014] The dimensionality factor combinations whose residual values ​​are greater than the target residual value in the dimensionality factor combinations are taken as abnormal candidate dimensionality factor combinations.

[0015] In one embodiment of the present application, the density-based clustering algorithm is used to cluster the candidate dimensional factor combinations to cluster the candidate dimensional factor combinations affected by the same root cause into one cluster, thereby obtaining a plurality of cluster families, including:

[0016] According to the expected value and the observed value corresponding to each of the candidate dimensional factor combinations, the deviation score corresponding to each of the candidate dimensional factor combinations is calculated;

[0017] Calculate the mean and variance of the deviation scores corresponding to each of the candidate dimensional factor combinations, and calculate the probability density value corresponding to each of the candidate dimensional factor combinations based on the mean and the variance;

[0018] The relative distance threshold of each of the probability density values ​​is calculated, and the candidate dimension factors with similar deviation scores are clustered into one cluster according to the relative distance threshold to obtain a plurality of cluster families.

[0019] In one embodiment of the present application, the calculating the relative distance threshold of each probability density value includes:

[0020] Obtaining the minimum probability density value from the probability density values ​​corresponding to each of the candidate dimensional factor combinations;

[0021] The relative density distances between the minimum probability density value and other probability density values ​​are calculated, and the median of the relative density distances between the minimum probability density value and other probability density values ​​is used as the relative distance threshold.

[0022] In one embodiment of the present application, clustering candidate dimension factors with similar deviation scores into a cluster according to the relative distance threshold to obtain multiple cluster families includes:

[0023] Sort the probability density values ​​corresponding to each of the candidate dimensional factor combinations in ascending order;

[0024] Selecting the candidate dimensional factor combination with the highest ranking from the ranking as the starting point, and calculating the relative density distances between other candidate dimensional factor combinations in the ranking and the starting point in order of ranking;

[0025] If the calculated relative density distance is less than or equal to the relative distance threshold, the corresponding candidate dimensional factor combination and the candidate dimensional factor combination corresponding to the starting point are classified into the same clustering family;

[0026] If the calculated density relative distance is greater than the relative distance threshold, the corresponding candidate dimensional factor combination is updated as the starting point, and the step of calculating the density relative distances of other candidate dimensional factor combinations in the sorting order and the starting point is returned to in sequence, until all candidate dimensional factor combinations are clustered into corresponding clustering families.

[0027] In one embodiment of the present application, the first weighted abnormal impact score corresponding to each clustering group is calculated according to the abnormal fluctuation degree, consistency ratio and noise ratio of each candidate dimensional factor combination in the clustering group, including:

[0028] Calculate the ratio of the absolute value of the difference between the observed value and the expected value corresponding to each candidate dimensional factor combination in the cluster family to the expected value, obtain the abnormal fluctuation degree of each candidate dimensional factor combination in the cluster family, and perform weighted summation on the abnormal fluctuation degree of each candidate dimensional factor combination in the cluster family to obtain a first abnormal impact score;

[0029] Calculate the ratio of the absolute value of the difference between the deviation score corresponding to each candidate dimensional factor combination in the cluster family and the mean of the deviation scores corresponding to all candidate dimensional factor combinations in the cluster family to the mean of the deviation scores corresponding to all candidate dimensional factor combinations in the cluster family, obtain the consistency ratio of each candidate dimensional factor combination in the cluster family, and perform weighted summation on the consistency ratios of each candidate dimensional factor combination in the cluster family to obtain the second abnormal impact score;

[0030] Calculate 1 minus the ratio of the deviation scores corresponding to each candidate dimensional factor combination in the cluster family to the maximum deviation score corresponding to the candidate dimensional factor combination in the cluster family to obtain the noise ratio of each candidate dimensional factor combination in the cluster family, and perform weighted summation on the noise ratios of each candidate dimensional factor combination in the cluster family to obtain the third abnormal impact score;

[0031] The first abnormality impact score, the second abnormality impact score, and the third abnormality impact score respectively corresponding to each of the cluster groups are weighted to obtain a first weighted abnormality impact score respectively corresponding to each of the cluster groups.

[0032] In one embodiment of the present application, the step of calculating the second weighted abnormal impact score corresponding to each candidate dimensional factor combination in the target cluster family according to the abnormal fluctuation degree and consistency ratio of each candidate dimensional factor combination in the target cluster family includes:

[0033] Calculate the ratio of the absolute value of the difference between the observed value and the expected value corresponding to each candidate dimensional factor combination in the target cluster family to the expected value, and obtain the abnormal fluctuation degree corresponding to each candidate dimensional factor combination in the target cluster family;

[0034] Calculate the ratio of the absolute value of the difference between the deviation score corresponding to each candidate dimensional factor combination in the target cluster family and the mean of the deviation scores corresponding to all candidate dimensional factor combinations in the target cluster family to the mean of the deviation scores corresponding to all candidate dimensional factor combinations in the target cluster family, and obtain the consistency ratio corresponding to each candidate dimensional factor combination in the target cluster family;

[0035] The abnormal fluctuation degree and the consistency ratio respectively corresponding to each of the candidate dimensional factor combinations in the target cluster family are weighted to obtain a second weighted abnormal impact score respectively corresponding to each of the candidate dimensional factor combinations in the target cluster family.

[0036] In one embodiment of the present application, determining at least one candidate dimensional factor combination as a root cause from the target cluster family according to the second weighted abnormal impact score corresponding to each candidate dimensional factor combination in the target cluster family includes:

[0037] Taking the candidate dimensional factor combination corresponding to the largest second weighted abnormal impact score in the target cluster group as a common root cause;

[0038] or,

[0039] Sorting each candidate dimensional factor combination in the target cluster family in descending order according to the second weighted abnormal impact score;

[0040] A plurality of candidate dimension factors ranked before N numbers are combined as the root cause, where N is a positive integer greater than 1.

[0041] In one embodiment of the present application, after combining multiple candidate dimension factors ranked before the N numbers as a common root cause, the method further includes:

[0042] The attributes of the common root causes are analyzed to determine a final root cause.

[0043] To achieve the above-mentioned purpose, the second aspect of an embodiment of the present application proposes an electronic device, which includes a memory and a processor, the memory stores a computer program, and the processor implements the method described in any embodiment of the present application when executing the computer program.

[0044] In the technical solution provided by the embodiment of the present application, the abnormal candidate dimensional factor combination is first filtered out by an adaptive residual filtering algorithm, which can narrow the dimension range of the abnormal indicator to be located for the root cause and reduce the complexity of the algorithm. Then, the candidate dimensional factor combination is clustered based on the density clustering algorithm to cluster the candidate dimensional factor combination affected by the same root cause into a cluster, and multiple cluster families are obtained, which can decompose the abnormal root cause into simpler sub-problems (i.e., a single root cause) and reduce the search space, which can effectively control the complexity of the algorithm. Then, according to the abnormal fluctuation degree, consistency ratio and noise ratio of each candidate dimensional factor combination in the cluster family, the first weighted abnormal impact score corresponding to each of the cluster families can be calculated, and the target cluster family with the largest first weighted abnormal impact score can be obtained; then, according to the abnormal fluctuation degree and consistency ratio of each candidate dimensional factor combination in the target cluster family, the second weighted abnormal impact score corresponding to each candidate dimensional factor combination in the target cluster family is calculated, so that according to the second weighted abnormal impact score corresponding to each candidate dimensional factor combination in the target cluster family, at least one candidate dimensional factor combination can be determined from the target cluster family as the root cause. In the process of calculating the first weighted anomaly impact score and the second weighted anomaly impact score, the influence of multiple aspects such as the degree of abnormal fluctuation, consistency ratio and / or noise ratio corresponding to each candidate dimensional factor combination is comprehensively considered, which can improve the accuracy of root cause location. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] Figure 1 It is a flowchart of a multi-dimensional indicator root cause location method provided by an embodiment of the present application;

[0046] Figure 2 It is a flowchart of the steps of filtering out abnormal dimensional factor combinations through an adaptive residual filtering algorithm provided by an embodiment of the present application;

[0047] Figure 3 is an example diagram of a CDF curve provided by an embodiment of the present application;

[0048] Figure 4 A flow chart of steps for clustering candidate dimensional factor combinations based on a density clustering algorithm provided in an embodiment of the present application, so as to cluster candidate dimensional factor combinations affected by the same root cause into one cluster, and obtain multiple cluster families;

[0049] Figure 5is a flowchart of the steps for calculating the relative distance threshold of each probability density value provided by an embodiment of the present application;

[0050] Figure 6 A flowchart of the steps of clustering candidate dimension factors with similar deviation scores into a cluster according to a relative distance threshold to obtain multiple cluster families provided by an embodiment of the present application;

[0051] Figure 7 It is a flowchart of the steps of calculating the first weighted abnormal impact score corresponding to each cluster group according to the abnormal fluctuation degree, consistency ratio and noise ratio of each candidate dimensional factor combination in the cluster group provided by an embodiment of the present application;

[0052] Figure 8 It is a flowchart of the steps of calculating the second weighted abnormal impact score corresponding to each candidate dimensional factor combination in the target cluster family according to the abnormal fluctuation degree and consistency ratio of each candidate dimensional factor combination in the target cluster family provided by an embodiment of the present application;

[0053] Fig. 9 It is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0054] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0055] It should be noted that, although the functional modules are divided in the device schematic diagram and the logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than the module division in the device or the order in the flowchart. The terms "first", "second", etc. in the specification, claims and the above drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0056] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used herein are only for the purpose of describing the embodiments of this application and are not intended to limit this application.

[0057] Terminology explanation:

[0058] Multidimensional indicators: Multidimensional indicators are a method of comprehensively evaluating and analyzing a phenomenon or problem by combining multiple characteristics of an object or phenomenon in the fields of data analysis, statistical evaluation, business measurement, etc. These indicators can describe and evaluate the research object from different angles or levels to obtain a more comprehensive and in-depth understanding.

[0059] Root cause location: Root cause location in multi-dimensional indicators refers to the use of specific methods or algorithms to identify and determine the root cause of a problem when faced with a complex problem with multiple dimensions and indicators.

[0060] Expected value (Base Period Value): Expected value is a reference point or starting value for comparison and analysis. It is usually used in financial analysis, statistical analysis, scientific research and other fields to facilitate the evaluation of changes, trends and performance. It is the data value at a specific time point as a comparison benchmark, which is used to compare with the data of subsequent periods to measure changes or growth. In the field of root cause location, the expected value is usually provided by anomaly detection that identifies indicator anomalies. It is not within the scope of this invention, so this invention will not elaborate on this aspect.

[0061] Observed Value: Observed value refers to the data actually obtained during the experiment, measurement or data analysis process, reflecting the actual performance or results under specific conditions. It is a direct measurement or record of real-world phenomena, as opposed to the theoretically expected value or expectation.

[0062] The Cumulative Distribution Function (CDF) is a function of a probability distribution that describes the probability that a random variable is less than or equal to a certain value. For a continuous random variable, the CDF is a non-decreasing function from 0 to 1, which represents the probability that the random variable takes a value less than or equal to a certain value x.

[0063] The probability density function (PDF) is a function that describes the probability density of a continuous random variable within a certain interval of values. For a continuous random variable, the probability density function can provide the probability that the random variable falls within a certain interval, which is calculated by integration.

[0064] In complex financial business, there is often a massive amount of user data. In business scenarios, it is often necessary to conduct statistical monitoring and quick judgment of user data, such as the number of customer loan applications in the past two hours, anti-fraud rejection rate, human review pass rate, transfer interface response time, etc. When these indicators change, we need to quickly locate the cause of the abnormality and analyze the key factors that cause the abnormality, which will help to concentrate resources and energy to solve the problem. However, since indicators usually have multiple dimensional attributes, their combination may grow exponentially, leading to the so-called "dimensional explosion" problem, which is particularly prominent when analyzing and locating specific factor combinations. For example, the [number of loan applications per minute] of Weilidai suddenly increases, and the operation and maintenance staff need to quickly locate the cause of the indicator change. However, the bank's online services are deployed in a distributed manner, and the arrival of a service request may come from different paths. The multi-dimensional attribute information includes: "NetWork": {"3G", "4G", "5G"}, "Platform": {"APP", "Mini Program", "WEB"}, "ISP": {"China Telecom", "China Unicom", "China Mobile"}, "Version": {"8.0", "8.1", "8.2"}, "City": {"Shenzhen", "Guangzhou", "Shanghai"}, etc.

[0065] In order to locate the cause of the indicator change, we need to consider all its dimension attributes and their combinations. For example, the above indicator has 5 dimensions, each dimension has 3 attribute values, then the factor combination of this indicator has 3 5 In actual application scenarios, some indicators may have more dimensions and dimension attribute values, which will bring challenges to the consumption of computing resources.

[0066] To address the above issues, the industry has proposed a solution called the Adtributor algorithm. The implementation steps of the algorithm are as follows:

[0067] 1. Use the ARMA model for anomaly detection to obtain the predicted values ​​of different indicator dimensions;

[0068] 2. Calculate the EP and Sur of the specific value elements of each dimension;

[0069] p ij (m) = F ij (m) / F(m);

[0070] q ij (m) = A ij (m) / A(m);

[0071]

[0072] EP ij (m)=(A ij (m)-F ij(m)) / (A(m)-F(m));

[0073] Where m is an index metric value, such as the interface success rate metric, i represents a dimension, and j represents a specific factor under the dimension. represents the expected value of the number of interface requests where the response time corresponding to factor j under dimension i is greater than 2s. For example, then F 12 (m) represents the expected value of the number of interface requests with a response time greater than 2s when the dimension is "NETWORK" and the dimension value is "4G"; F(m) represents the expected value of the total number of interface requests with a response time greater than 2s. A(m) represents the observed value of the total number of interface requests with a response time greater than 2s. Sur ij (m) represents the Surprise (outlier) of the interface requests with a response time greater than 2s when the dimension i takes the value j, EP ij (m) represents the Explanatory (reason) of the interface requests with a response time greater than 2s when the dimension i takes the value j.

[0074] Filter out the candidate dimension set according to the Explanatory and threshold of each dimension factor, and finally calculate the Surprise of each dimension, and output the root cause dimension after summarizing and sorting.

[0075] The Adtributor algorithm assumes that the root cause can only be a problem with one attribute. For example, only a problem with a certain city or a certain operator, rather than a problem with a certain province and a certain operator. That is, (city = Shenzhen, ISP = *, NetWork = *, Platform = *, Version = *) and (city = *, ISP = Telecom, NetWork = *, Platform = *, Version = *) are both legal root causes, while (city = Shenzhen, ISP = Telecom, NetWork = *, Platform = *, Version = *) will not appear. This assumption greatly simplifies the problem, enabling only single-dimension factors to be calculated and searched, reducing the computational complexity from O(m n ) to O(mn), but obviously it cannot cover the actual requirements. In actual production, the root cause of the fluctuation of a certain indicator is often caused by a combination of multiple factors.

[0076] That is to say, although the existing Adtributor algorithm can identify the root cause of a single dimension, in the actual production environment, the problem often involves complex interactions of multi-dimension factors, and the existing algorithm cannot meet the need to accurately locate the root cause of multi-factor combinations.

[0077] Existing technologies such as the Adtributor algorithm usually focus on single-dimensional data analysis, which is effective when faced with a single factor with significant impact. However, in actual production environments, problems are often the result of multi-factor and multi-dimensional interactions, which goes beyond the scope of single-dimensional analysis. On this basis, some scholars further proposed an improved version of the Adtributor algorithm, the Recursive Adtributor (R-Adtributor) algorithm, which is a recursive version of the Adtributor algorithm and is designed to handle root cause location problems under multi-dimensional attributes. However, its recursive termination condition is difficult to set correctly, which may lead to inaccurate root cause sets returned, and may also time out when processing data with a large number of attributes and dimensions. With the increase of dimensions and attribute values, the number of possible combinations grows exponentially, which leads to a sharp increase in the complexity of the analysis, making it difficult to perform effective analysis through traditional methods. How to design an algorithm to control complexity while maintaining the accuracy and efficiency of the analysis is a technical problem.

[0078] Based on this, an embodiment of the present application proposes a method for locating the root cause of a multi-dimensional indicator, which can realize the locating the root cause of a multi-dimensional indicator and improve the accuracy of the root cause locating.

[0079] Reference Figure 1 , Figure 1 It is a flowchart of a multi-dimensional indicator root cause location method provided in an embodiment of the present application, including but not limited to steps S110 to S150.

[0080] Step S110, filtering out abnormal candidate dimensional factor combinations through an adaptive residual filtering algorithm.

[0081] The embodiment of the present application uses residuals to represent the degree of change of the dimensional factor combination, and applies the residual threshold to determine whether the change is abnormal. That is, the adaptive residual filtering algorithm is used to filter out abnormal candidate dimensional factor combinations, which can narrow the range of "abnormal" indicator dimensions for root cause location and reduce the complexity of the algorithm.

[0082] Reference Figure 2 , Figure 2 It is a flowchart of the steps of filtering out abnormal dimensional factor combinations through an adaptive residual filtering algorithm provided by an embodiment of the present application, including but not limited to steps S210 to S240.

[0083] Step S210, according to the expected value and the observed value corresponding to the dimensional factor combination, the residual value corresponding to each dimensional factor combination is calculated.

[0084] Step S230, determining a target residual value corresponding to a significant change in the cumulative frequency value according to the corresponding relationship between the residual value and the cumulative frequency value;

[0085] Step S240: The dimensionality factor combination whose residual value is greater than the target residual value among the dimensionality factor combinations is taken as an abnormal candidate dimensionality factor combination.

[0086] In the embodiment of the present application, the residual values ​​corresponding to each dimensional factor combination can be calculated based on the expected value and the observed value corresponding to the dimensional factor combination. Specifically, the residual value can be calculated by the following formula 1:

[0087] RD (e) =F (e) -A (e) (Formula 1);

[0088] In Formula 1, e represents the combination of dimensional factors, such as e is (city = Shenzhen, operator = China Mobile), RD (e) Represents the residual value corresponding to the dimension factor combination e, F (e) A represents the expected value of the dimension factor combination e. (e) Represents the observed value corresponding to the dimension factor combination e.

[0089] For example, assuming that there are the following dimensional factor combinations, and their corresponding observed values ​​and expected values ​​are shown in Table 1, the residual value of each dimensional factor combination can be calculated according to the above formula 1, as shown in Table 1:

[0090] Table 1

[0091] City ISP Observations Expected Value Residual Shenzhen move 1200 1500 -300 Shenzhen China Unicom 1500 1300 200 Wuhan telecommunications 1400 1700 -300 ... ... ... ... ...

[0092] Step S220, sorting the residual values ​​of each dimensional factor combination in order of size, and constructing a cumulative distribution function to calculate the cumulative frequency value corresponding to each residual value.

[0093] In the embodiment of the present application, after calculating the residual values ​​corresponding to each dimensional factor combination, the residual values ​​of each dimensional factor combination can be sorted in order of size, and a cumulative distribution function can be constructed to calculate the cumulative frequency value corresponding to each residual value. Specifically, all dimensional factor combinations can be sorted from small to large according to the residual values, such as by sorting, the following residual data sequence can be obtained:

[0094] [-300, -200, -150, -100, -50, 0, 50, 100, 200, 300, 500, 1000].

[0095] Then construct the cumulative distribution function (CDF) to calculate the cumulative frequency value corresponding to each residual value. The cumulative distribution function (CDF) is shown in the following formula 2:

[0096]

[0097] In Formula 2, n is the total number of data points in the data set, i is the position of the current data point in the sorted residual data sequence (counting starts from 1), and L is the indicator function. j ≤x i The value is 1.

[0098] For example, for the first data point -300 in the residual data sequence, the corresponding cumulative probability value is 1 / 13 (because there are 13 data points); for the second data point -200 in the residual data sequence, the corresponding cumulative probability value is 2 / 13, and so on, for the twelfth data point 500 in the residual data sequence, the corresponding cumulative probability value is 12 / 13.

[0099] Next, based on the correspondence between the residual value and the cumulative frequency value, determine the target residual value corresponding to the significant change in the cumulative frequency value. Specifically, a corresponding relationship curve between the cumulative probability value and the residual value can be drawn on the chart. As the cumulative probability value corresponding to the data point in the residual data sequence increases, the CDF curve will gradually rise. Figure 3 , Figure 3 : is an example diagram of a CDF curve provided by an embodiment of the present application, wherein the horizontal axis is the cumulative probability value and the vertical axis is the residual value. Figure 3 The CDF curve shown in the figure shows that the slope of the CDF curve increases significantly near the residual value of 500, which means that the point (500, 12 / 13) in the CDF curve is the inflection point. This inflection point marks the transition of the data distribution from most normal values ​​to abnormal values, that is, the target residual value can be determined through the inflection point. Specifically, the cumulative probability value corresponding to the data points before the target residual value of 500 has been reached, and the data points after the target residual value of 500 may be abnormal data points.

[0100] In an embodiment of the present application, abnormal dimensional factor combinations are filtered out by using a target residual value, that is, only dimensional factor combinations whose residual values ​​exceed the target residual value are considered abnormal, and these filtered abnormal dimensional factor combinations can be used for subsequent root cause location.

[0101] In the embodiment of the present application, the cumulative distribution function (CDF) is not affected by extreme values, so when there are some extreme values ​​in the data, using the cumulative distribution function (CDF) to determine the target residual value is more robust than using the mean or median. And by summarizing the form of the CDF curve, an intuitive representation of the data distribution is provided, which helps to visualize the patterns and outliers in the data set, making it easier to identify and interpret the structure in the data. And the adaptive residual algorithm is an unsupervised algorithm that does not require any assumptions about the distribution of the data set and does not require training data.

[0102] Step S120 , clustering the candidate dimensional factor combinations based on a density clustering algorithm, so as to cluster the candidate dimensional factor combinations affected by the same root cause into one cluster, and obtain a plurality of cluster families.

[0103] In the embodiment of the present application, after filtering out abnormal candidate dimensional factor combinations through the adaptive residual filtering algorithm, the candidate dimensional factor combinations can be further clustered based on the density clustering algorithm to cluster the candidate dimensional factor combinations affected by the same root cause into one cluster to obtain multiple cluster families. That is, through the density clustering algorithm, the abnormal root cause can be decomposed into simpler sub-problems (i.e., a single root cause), and the search space can be reduced, which can effectively control the complexity of the algorithm.

[0104] Reference Figure 4 , Figure 4 An embodiment of the present application provides a density clustering algorithm for clustering candidate dimensional factor combinations to cluster candidate dimensional factor combinations affected by the same root cause into one cluster to obtain a step flow chart of multiple cluster families, including but not limited to steps S410 to S430.

[0105] Step S410, calculating the deviation score corresponding to each candidate dimensional factor combination according to the expected value and the observed value corresponding to each candidate dimensional factor combination;

[0106] Step S420, calculating the mean and variance of the deviation scores corresponding to each candidate dimensional factor combination, and calculating the probability density value corresponding to each candidate dimensional factor combination according to the mean and variance;

[0107] Step S430, calculating the relative distance threshold of each probability density value, and clustering the candidate dimension factors with similar deviation scores into a cluster according to the relative distance threshold, to obtain multiple cluster families.

[0108] In the embodiment of the present application, according to the expected value and the observed value corresponding to each candidate dimensional factor combination, the deviation score corresponding to each candidate dimensional factor combination can be calculated. Specifically, the deviation score can be calculated by the following formula 3:

[0109]

[0110] In formula 3, D (e) represents the deviation score corresponding to the candidate dimension factor combination e, F (e) represents the expected value corresponding to the candidate dimension factor combination e, A (e) Represents the observed value corresponding to the candidate dimension factor combination e.

[0111] For example, for the dimension factor combination e (city = Shenzhen, IPS = mobile) in Table 1, the corresponding deviation score is

[0112] Then calculate the mean and variance of the deviation scores corresponding to each candidate dimension factor combination, and calculate the probability density value corresponding to each candidate dimension factor combination based on the mean and variance. Among them, the mean is the sum of all data points divided by the number of data points, and the variance is the square of the difference between each data point and the mean. Specifically, the probability density value can be calculated by the following formula 4:

[0113]

[0114] In formula 4, Represents the probability density value corresponding to the candidate dimension factor combination e, D ( e ) represents the deviation score corresponding to the candidate dimension factor combination e, μ represents the mean of the deviation score, σ 2 Represents the variance of the deviation score.

[0115] Exemplarily, assuming that there are candidate dimensional factor combinations and their corresponding observed values, expected values, and deviation scores as shown in Table 2, the probability density values ​​corresponding to the candidate dimensional factor combinations shown in Table 2 can be calculated by Formula 4. The specific probability density values ​​can be referred to Table 3.

[0116] Table 2

[0117] City ISP Observations Expected Value Deviation score Shenzhen move 1174 1000 -0.08 Shenzhen China Unicom 1131 1500 0.14 Shenzhen telecommunications 1200 1130 -0.03 Wuhan move 1300 1200 -0.04 Wuhan China Unicom 1250 1177 -0.03 Wuhan telecommunications 895 1400 0.22 Shanghai move 1300 1689 0.13 Shanghai China Unicom 1252 1500 0.09 Shanghai telecommunications 1120 1300 0.074

[0118] Table 3

[0119] City ISP Observations Expected Value Deviation score PDF Shenzhen move 1174 1000 -0.08 1.6 Shenzhen China Unicom 1131 1500 0.14 2.75 Shenzhen telecommunications 1200 1130 -0.03 2.87 Wuhan move 1300 1200 -0.04 2.61 Wuhan China Unicom 1250 1177 -0.03 2.87 Wuhan telecommunications 895 1400 0.22 0.91 Shanghai move 1300 1689 0.13 3 Shanghai China Unicom 1252 1500 0.09 3.84 Shanghai telecommunications 1120 1300 0.074 4.05

[0120] In an embodiment of the present application, the probability density value of the deviation score corresponding to each candidate dimensional factor combination is calculated. According to the central limit theorem, large sample data often approximates a normal distribution. Therefore, it is reasonable to assume that the data conforms to a normal distribution, especially when the sample size is large enough (different distribution functions can be selected according to the actual distribution of the data, such as Poisson distribution, chi-square distribution, etc.). The probability density value of the deviation score corresponding to each candidate dimensional factor combination conforms to the normal distribution. Therefore, based on Formula 4, the probability density value corresponding to each candidate dimensional factor combination can be calculated according to the mean and variance of the deviation scores corresponding to each candidate dimensional factor combination.

[0121] After calculating the probability density values ​​corresponding to each candidate dimensional factor combination, the relative distance threshold of each probability density value can be further calculated, and the candidate dimensional factor combinations with similar deviation scores can be clustered into one cluster according to the relative distance threshold to obtain multiple cluster families.

[0122] Specifically, refer to Figure 5 , Figure 5 It is a flowchart of the steps for calculating the relative distance threshold of each probability density value provided by an embodiment of the present application, including but not limited to steps S510 to S520.

[0123] Step S510, obtaining the minimum probability density value from the probability density values ​​corresponding to each candidate dimensional factor combination;

[0124] Step S520, calculating the relative density distances between the minimum probability density value and other probability density values, and taking the median of the relative density distances between the minimum probability density value and other probability density values ​​as the relative distance threshold.

[0125] In the embodiment of the present application, each candidate dimensional factor combination can be sorted in order of probability density value from small to large. For example, the following sorting sequence can be obtained by sorting the probability density values ​​shown in Table 3 in ascending order:

[0126] [0.91, 1.6, 2.61, 2.75, 2.87, 2.87, 3, 3.84, 4.05].

[0127] Then, starting from the first value of the sorted sequence (that is, the smallest probability density value), the relative density distance between other probability density values ​​is calculated, that is, DISi = |f(xi)-f(xn). The relative density distances between the smallest probability density value and other probability density values ​​are as follows:

[0128] [3.14, 2.45, 1.44, 1.3, 1.18, 1.18, 1.05, 0.21].

[0129] After obtaining the relative density distance between the minimum probability density value and other probability density values, the median of the relative density distance between the minimum probability density value and other probability density values ​​can be used as the relative distance threshold. For example, the median of the relative density distance sequence [3.14, 2.45, 1.44, 1.3, 1.18, 1.18, 1.05, 0.21] can be calculated to be 1.24. The relative distance threshold can be determined to be 1.24.

[0130] After the relative distance threshold is determined, candidate dimension factors with similar deviation scores can be combined and clustered into one cluster according to the relative distance threshold to obtain multiple cluster families.

[0131] Reference Figure 6 , Figure 6It is a flowchart of the steps of clustering candidate dimension factors with similar deviation scores into a cluster according to a relative distance threshold to obtain multiple cluster families, including but not limited to steps S610 to S640, provided in an embodiment of the present application.

[0132] Step S610, sorting the probability density values ​​corresponding to each candidate dimensional factor combination in ascending order;

[0133] Step S620, selecting the candidate dimension factor combination with the highest ranking from the ranking as the starting point, and calculating the relative density distances between other candidate dimension factor combinations in the ranking and the starting point in order of ranking;

[0134] Step S630: if the calculated relative density distance is less than or equal to the relative distance threshold, the corresponding candidate dimensional factor combination and the candidate dimensional factor combination corresponding to the starting point are classified into the same cluster group;

[0135] Step S640, if the calculated density relative distance is greater than the relative distance threshold, the corresponding candidate dimension factor combination is updated to the starting point, and the step of calculating the density relative distances of other candidate dimension factor combinations in the sorting order and the starting point is returned to in sequence, until all candidate dimension factor combinations are clustered into corresponding clustering families.

[0136] In an embodiment of the present application, the probability density values ​​corresponding to each candidate dimensional factor combination are first sorted in ascending order. As mentioned above, the probability density values ​​shown in Table 3 are sorted in ascending order to obtain the following sorting sequence [0.91, 1.6, 2.61, 2.75, 2.87, 2.87, 3, 3.84, 4.05]. Table 4 is obtained by sorting Table 3 in ascending order according to the probability density value.

[0137] Table 4

[0138]

[0139]

[0140] Then, the candidate dimension factor combination with the highest ranking is selected from the sorting as the starting point, and the relative density distances between the other candidate dimension factor combinations in the sorting and the starting point are calculated in sequence according to the sorting order. That is, the first value of the sorting sequence is taken as the starting point, and the relative density distances between the second value, the third value, the fourth value, the fifth value, and so on in the sorting and the first value are calculated in sequence. If the calculated relative density distance is less than or equal to the relative distance threshold, the corresponding candidate dimension factor combination and the candidate dimension factor combination corresponding to the starting point are classified into the same cluster family. If the relative density distance between the second value and the first value is less than or equal to the relative distance threshold, but the relative density distance between the third value and the first value is greater than the relative distance threshold, the first value and the second value in the sorting sequence can be classified into the same cluster family, that is, the candidate dimension factor combination corresponding to the first value and the candidate dimension factor combination corresponding to the second value are classified into the same cluster family. If the calculated relative density distance is greater than the relative distance threshold, the corresponding candidate dimension factor combination is updated as the starting point, and the step of calculating the relative density distances between the other candidate dimension factor combinations in the sorting and the starting point in sequence according to the sorting order is returned until all candidate dimension factor combinations are clustered into the corresponding cluster families. If the relative density distance between the third value and the first value is greater than the relative distance threshold, then the third value is taken as the starting point, and the relative density distances between the fourth value, the fifth value, ... and the third value are calculated in sequence. If the relative density distances between the fourth value and the fifth value and the third value are both less than or equal to the relative distance threshold, and the relative density distance between the sixth value and the third value is greater than the relative distance threshold, then the third value, the fourth value and the fifth value are classified into the same cluster family, that is, the candidate dimension factor combination corresponding to the third value, the candidate dimension factor combination corresponding to the fourth value, and the candidate dimension factor combination corresponding to the fifth value are classified into the same cluster family. Then, the sixth value is taken as the starting point, and the relative density distances between the seventh value, the eighth value, ... and the sixth value are calculated in sequence, and in this way, all candidate dimension factor combinations are clustered into corresponding cluster families.

[0141] It should be noted that since the probability density values ​​corresponding to each candidate dimensional factor combination are sorted in ascending order in advance, when the relative density distance between a certain value in the sort and the starting point is greater than the relative distance threshold, the relative density distances between the values ​​sorted after this value and the starting point must be greater than the relative distance threshold. That is, after calculating that the relative density distance between a certain value and the starting point is greater than the relative distance threshold, there is no need to continue calculating the relative density distances between other values ​​ranked after this value and the starting point.

[0142] Exemplarily, taking the candidate dimension factor combinations shown in Table 4 above as an example, the relative distance threshold is 1.24.

[0143] Taking the first value 0.91 as the starting point, the relative density distance between it and the second value 1.6 is calculated to be 0.69<1.24; the relative density distance between it and the third value 2.61 is calculated to be 1.7>1.24; then the candidate dimension factor combinations corresponding to the first value 0.91 and the second value 1.6 are classified into the same cluster family (i.e., the first cluster family). Taking the third value 2.61 as the new starting point, the relative density distance between it and the fourth value 2.75 is calculated to be 0.14<1.24; the relative density distance between it and the fifth value 2.87 is calculated to be 0.26<1.24; the relative density distance between it and the sixth value 2.87 is calculated to be 0.26<1.24; the relative distance between it and the seventh value 3 is calculated to be 0.39<1.24; the relative distance between it and the eighth value 3.84 is calculated to be 1.32>1.24. Therefore, the candidate dimensional factor combinations corresponding to the 3rd value 2.61, the 4th value 2.75, the 5th value 2.87, the 6th value 2.87, and the 7th value 3 are classified into the same cluster family (i.e., the second cluster family). The 8th value 3.84 is taken as the new starting point; the relative distance between it and the 9th value 4.05 is calculated to be 0.21<1.24; then the candidate dimensional factor combinations corresponding to the 8th value 3.84 and the 9th value 4.05 are classified into the same cluster family (i.e., the third cluster family). In this way, referring to Table 5, each candidate dimensional factor combination can be clustered into the above three cluster families.

[0144] Table 5

[0145]

[0146]

[0147] The embodiment of the present application clusters the candidate dimensional factor combinations based on the density clustering algorithm. It does not need to specify the number of clusters and the density distance threshold in advance, and can adaptively determine the cluster center and boundary according to the distribution of the data. In addition, the algorithm is a one-dimensional clustering based on the deviation score, and the calculation of the probability density value and the relative density threshold is relatively simple, and the calculation cost is low; and the algorithm does not require complex data preprocessing steps, such as feature scaling, cross-validation of the number of clusters, etc., which can effectively control the complexity of the algorithm.

[0148] Step S130, according to the abnormal fluctuation degree, consistency ratio and noise ratio of each candidate dimensional factor combination in the clustering family, calculate the first weighted abnormal influence score corresponding to each clustering family, and obtain the target clustering family with the largest first weighted abnormal influence score.

[0149] In the embodiment of the present application, after clustering candidate dimensional factor combinations affected by the same root cause into a cluster based on the density clustering algorithm to obtain multiple cluster families, the first weighted abnormal impact score corresponding to each cluster family can be calculated according to the abnormal fluctuation degree, consistency ratio and noise ratio of each candidate dimensional factor combination in the cluster family. Thus, the target cluster family with the largest first weighted abnormal impact score can be further obtained.

[0150] Reference Figure 7 , Figure 7 It is a flowchart of the steps provided by an embodiment of the present application for calculating the first weighted abnormal impact score corresponding to each clustering group according to the abnormal fluctuation degree, consistency ratio and noise ratio of each candidate dimensional factor combination in the clustering group, including but not limited to steps S710 to S740.

[0151] Step S710, calculate the ratio of the absolute value of the difference between the observed value and the expected value corresponding to each candidate dimensional factor combination in the cluster family to the expected value, obtain the abnormal fluctuation degree of each candidate dimensional factor combination in the cluster family, and perform weighted summation on the abnormal fluctuation degree of each candidate dimensional factor combination in the cluster family to obtain the first abnormal impact score.

[0152] Step S720, calculate the ratio of the absolute value of the difference between the deviation scores corresponding to each candidate dimensional factor combination in the cluster family and the mean of the deviation scores corresponding to all candidate dimensional factor combinations in the cluster family to the mean of the deviation scores corresponding to all candidate dimensional factor combinations in the cluster family, obtain the consistency ratio of each candidate dimensional factor combination in the cluster family, and perform weighted summation on the consistency ratios of each candidate dimensional factor combination in the cluster family to obtain the second abnormal impact score.

[0153] Step S730, calculate 1 minus the ratio of the deviation scores corresponding to each candidate dimensional factor combination in the cluster family to the maximum deviation score corresponding to the candidate dimensional factor combination in the cluster family, obtain the noise ratio of each candidate dimensional factor combination in the cluster family, and perform weighted summation on the noise ratios of each candidate dimensional factor combination in the cluster family to obtain the third abnormal impact score.

[0154] Step S740 : weighting the first abnormal impact score, the second abnormal impact score, and the third abnormal impact score corresponding to each cluster group to obtain a first weighted abnormal impact score corresponding to each cluster group.

[0155] In the embodiment of the present application, the first weighted abnormal impact score of each cluster group can be calculated by the following formula 5:

[0156] WAIS (E) =w1*AI (E) -w2*CR(E) -w3*NR (E) (Formula 5);

[0157] In formula 5, WAIS (E) Indicates the first weighted anomaly impact score corresponding to cluster family E, AI (E) Indicates the first anomaly impact score corresponding to cluster E, CR (E) represents the second anomaly impact score corresponding to cluster E, NR (E) represents the third abnormal impact score corresponding to cluster family E, w1 represents the weight coefficient corresponding to the first abnormal impact score, w2 represents the weight coefficient corresponding to the second abnormal impact score, and w3 represents the weight coefficient corresponding to the third abnormal impact score. Among them, the weight coefficients w1, w2, and w3 are used to balance the influence of the corresponding parts, and the default value can be set to w1=w2=w3=0.1. It should be noted that the weight coefficients w1, w2, and w3 can be dynamically modified according to actual data experiments, and different data scenarios may require different weights.

[0158] In the embodiment of the present application, after the first weighted abnormal influence scores corresponding to each cluster group are calculated by the above formula 5, the cluster group with the largest first weighted abnormal influence score can be screened out as the target cluster group.

[0159] The first abnormal impact score can be calculated by the following formula 6:

[0160]

[0161] In formula 6, AI (E) represents the first abnormal impact score corresponding to cluster family E, N represents the number of candidate dimension factor combinations in cluster family E, e represents the candidate dimension factor combination belonging to cluster family E, and F (e) represents the expected value corresponding to the candidate dimension factor combination e, A (e) Represents the observed value corresponding to the candidate dimension factor combination e.

[0162] In the embodiment of the present application, as shown in Formula 6, by calculating the ratio of the absolute value of the difference between the observed value and the expected value corresponding to each candidate dimensional factor combination in the cluster family and the expected value, the abnormal fluctuation degree of each candidate dimensional factor combination in the cluster family can be obtained. Then, the abnormal fluctuation degree of each candidate dimensional factor combination in the cluster family is weighted and summed to obtain the first abnormal influence score. Among them, the larger the first abnormal influence score corresponding to the cluster family E, the greater the deviation between the observed value and the predicted value of each candidate dimensional factor combination in the cluster family E.

[0163] The second abnormal impact score can be calculated by the following formula 7:

[0164]

[0165] In formula 7, CR (E) represents the second abnormal influence score corresponding to cluster family E, N represents the number of candidate dimension factor combinations in cluster family E, e represents the candidate dimension factor combination belonging to cluster family E, D (e) represents the deviation score corresponding to the candidate dimension factor combination e, D (E) Represents the mean of the deviation scores corresponding to all candidate dimension factor combinations in cluster family E.

[0166] In an embodiment of the present application, as shown in Formula 7, by calculating the ratio of the absolute value of the difference between the deviation scores corresponding to each candidate dimensional factor combination in the cluster family and the mean of the deviation scores corresponding to all candidate dimensional factor combinations in the cluster family and the mean of the deviation scores corresponding to all candidate dimensional factor combinations in the cluster family, the consistency ratio of each candidate dimensional factor combination in the cluster family can be obtained. Then, the consistency ratios of each candidate dimensional factor combination in the cluster family are weighted and summed to obtain a second abnormal impact score. Among them, the consistency ratio is used to measure the consistency of the deviation score of the candidate dimensional factor combination e of the cluster family E with the deviation scores of other candidate dimensional factor combinations in the cluster family E. The second abnormal impact score CR corresponding to cluster family E (E) The smaller it is, the better the consistency between the candidate dimension factor combinations within the cluster family E.

[0167] The third abnormal impact score can be calculated by the following formula 8:

[0168]

[0169] In formula 8, NR (E) represents the third abnormal impact score corresponding to cluster family E, N represents the number of candidate dimension factor combinations in cluster family E, e represents the candidate dimension factor combination belonging to cluster family E, D (e) Indicates the deviation score corresponding to the candidate dimension factor combination e, max (D) It represents the maximum deviation score among the deviation scores corresponding to all candidate dimension factor combinations in cluster family E.

[0170] In the embodiment of the present application, as shown in Formula 8, by calculating 1 minus the ratio of the deviation scores corresponding to each candidate dimensional factor combination in the cluster family and the maximum deviation score corresponding to the candidate dimensional factor combination in the cluster family, the noise ratio of each candidate dimensional factor combination in the cluster family can be obtained. Then, the noise ratios of each candidate dimensional factor combination in the cluster family are weighted and summed to obtain the third abnormal impact score. Among them, the noise ratio is used to reflect the degree to which the deviation scores of the candidate dimensional factor combinations in the cluster family E are affected by noise. The third abnormal impact score NR corresponding to the cluster family E is (E)The larger it is, the more the deviation scores of the candidate dimension factor combinations within the cluster family E are affected by noise.

[0171] Exemplarily, taking the candidate dimensional factor combinations shown in Table 5 as an example, each candidate dimensional factor combination is clustered into three cluster groups based on the density clustering algorithm. Through the above formula 6, the first abnormal impact scores AI corresponding to the three cluster groups can be calculated as [0.27, 0.14, 0.15]. Through the above formula 7, the second abnormal impact scores CR corresponding to the three cluster groups can be calculated as [2.14, 2.38, 0.98]. Through the above formula 8, the third abnormal impact scores NR corresponding to the three cluster groups can be calculated as [0.68, 0.78, 0.09]. Therefore, through the above formula 5, the first weighted abnormal impact scores corresponding to the three cluster groups can be calculated as [-0.255, -0.302, -0.092]. Therefore, it can be determined that the maximum first weighted abnormal impact score is -0.092, and the third cluster group corresponding to the first weighted abnormal impact score of -0.092 can be screened out as the target cluster group.

[0172] In the embodiment of the present application, during the calculation of the first weighted abnormal impact score, the influence of multiple aspects such as the abnormal fluctuation degree, consistency ratio and noise ratio corresponding to each candidate dimensional factor combination is comprehensively considered, so that the cluster family to which the root cause belongs can be accurately determined.

[0173] Step S140, calculating the second weighted abnormal impact score corresponding to each candidate dimensional factor combination in the target cluster family according to the abnormal fluctuation degree and consistency ratio of each candidate dimensional factor combination in the target cluster family.

[0174] In an embodiment of the present application, after determining the target cluster family to which the root cause belongs, the second weighted abnormal impact score corresponding to each candidate dimensional factor combination in the target cluster family can be further calculated based on the abnormal fluctuation degree and consistency ratio of each candidate dimensional factor combination in the target cluster family.

[0175] Reference Figure 8 , Figure 8 It is a flowchart of the steps provided by an embodiment of the present application for calculating the second weighted abnormal impact score corresponding to each candidate dimensional factor combination in the target cluster family according to the abnormal fluctuation degree and consistency ratio of each candidate dimensional factor combination in the target cluster family, including but not limited to steps S810 to S830.

[0176] Step S810, calculating the ratio of the absolute value of the difference between the observed value and the expected value corresponding to each candidate dimensional factor combination in the target cluster family to the expected value, and obtaining the abnormal fluctuation degree of each candidate dimensional factor combination in the target cluster family;

[0177] Step S820, calculating the ratio of the absolute value of the difference between the deviation score corresponding to each candidate dimensional factor combination in the target cluster family and the mean of the deviation scores corresponding to all candidate dimensional factor combinations in the target cluster family to the mean of the deviation scores corresponding to all candidate dimensional factor combinations in the target cluster family, and obtaining the consistency ratio of each candidate dimensional factor combination in the target cluster family;

[0178] Step S830, weighting the abnormal fluctuation degree and consistency ratio corresponding to each candidate dimensional factor combination in the target cluster family to obtain a second weighted abnormal impact score corresponding to each candidate dimensional factor combination in the target cluster family.

[0179] In the embodiment of the present application, the second weighted abnormal impact score of the target cluster group can be calculated by the following formula 9:

[0180] WAIS (e) =w1*AI (e) -w2*CR (e) (Formula 9);

[0181] In formula 9, WAIS (e) Represents the second weighted abnormal impact score corresponding to the candidate dimension factor combination e in the target cluster family, AI (e) Indicates the abnormal fluctuation degree corresponding to the candidate dimension factor combination e in the target cluster family, CR (e) It represents the consistency ratio corresponding to the candidate dimension factor combination e in the target cluster family, w1 represents the weight coefficient corresponding to the abnormal fluctuation degree, and w2 represents the weight coefficient corresponding to the consistency ratio. Similarly, the weight coefficients w1 and w2 are used to balance the influence of the corresponding parts, and the default value can be set to w1=w2=0.1. It should be noted that the weight coefficients w1 and w2 can be dynamically modified according to the actual data experiment, and different data scenarios may require different weights.

[0182] Among them, the abnormal fluctuation degree can be calculated by the following formula 10:

[0183]

[0184] In formula 10, AI (e) Indicates the abnormal fluctuation degree corresponding to the candidate dimension factor combination e in the target cluster family, F (e) A represents the expected value of the candidate dimension factor combination e in the target cluster family, (e) Represents the observed value corresponding to the candidate dimension factor combination e in the target cluster family.

[0185] In the embodiment of the present application, as shown in Formula 10, by calculating the ratio of the absolute value of the difference between the observed value and the expected value corresponding to each candidate dimensional factor combination in the target cluster family and the expected value, the abnormal fluctuation degree corresponding to each candidate dimensional factor combination in the target cluster family can be obtained. Among them, the greater the abnormal fluctuation degree, the greater the deviation between the observed value and the predicted value of the candidate dimensional factor combination e.

[0186] The consistency ratio can be calculated by the following formula 11:

[0187]

[0188] In formula 11, CR (e) represents the consistency ratio corresponding to the candidate dimension factor combination e in the target cluster family, D (e) Denotes the deviation score corresponding to the candidate dimension factor combination e in the target cluster family, D (E) Represents the mean of the deviation scores corresponding to all candidate dimension factor combinations in the target cluster family E.

[0189] In the embodiment of the present application, as shown in Formula 11, the consistency ratio of each candidate dimensional factor combination in the target cluster family can be obtained by calculating the ratio of the absolute value of the difference between the deviation score corresponding to each candidate dimensional factor combination in the target cluster family and the mean of the deviation scores corresponding to all candidate dimensional factor combinations in the target cluster family and the mean of the deviation scores corresponding to all candidate dimensional factor combinations in the target cluster family. Among them, the larger the consistency ratio, the greater the deviation between the deviation score of the candidate dimensional factor combination e in the target cluster family and the mean of the deviation scores corresponding to all candidate dimensional factor combinations in the target cluster family.

[0190] In an embodiment of the present application, after calculating the abnormal fluctuation degree and consistency ratio corresponding to each candidate dimensional factor combination in the target cluster family, the second weighted abnormal impact score corresponding to each candidate dimensional factor combination in the target cluster family can be calculated by Formula 9.

[0191] For example, taking the candidate dimensional factor combinations shown in Table 5 as an example, the target cluster family is the third cluster family, and the third cluster family includes the candidate dimensional factor combinations (city = Shanghai, ISP = China Unicom) and (city = Shanghai, ISP = China Telecom). The second weighted abnormal impact scores corresponding to the two candidate dimensional factor combinations can be calculated as [-0.081, -0.084] through the above formula 9.

[0192] In the embodiment of the present application, during the calculation of the second weighted abnormal impact score, the influence of multiple aspects such as the abnormal fluctuation degree and the consistency ratio corresponding to each candidate dimensional factor combination is comprehensively considered, so that the second weighted abnormal impact score corresponding to each candidate dimensional factor combination in the target cluster family can be accurately determined, so that the root cause can be determined based on the second weighted abnormal impact score.

[0193] Step S150: Determine at least one candidate dimensional factor combination as a root cause from the target cluster family according to the second weighted abnormal impact score corresponding to each candidate dimensional factor combination in the target cluster family.

[0194] In an embodiment of the present application, after calculating the second weighted abnormal impact scores corresponding to each candidate dimensional factor combination in the target cluster family, at least one candidate dimensional factor combination can be further determined as the root cause from the target cluster family according to the second weighted abnormal impact scores corresponding to each candidate dimensional factor combination in the target cluster family. By proposing a method for comprehensively evaluating the impact of candidate dimensional factor combinations, it is helpful to fully understand the impact of each candidate dimensional factor combination on the overall indicator fluctuation, and to improve the accuracy of root cause location.

[0195] Specifically, the candidate dimensional factor combination corresponding to the largest second weighted abnormal impact score in the target cluster family can be used as the common root cause. Alternatively, the candidate dimensional factor combinations in the target cluster family can be sorted in order from large to small according to the second weighted abnormal impact score, so that the multiple candidate dimensional factor combinations ranked before N numbers can be used as the root cause. Alternatively, the candidate dimensional factor combinations in the target cluster family can be sorted in order from small to large according to the second weighted abnormal impact score, so that the multiple candidate dimensional factor combinations ranked after N numbers can be used as the root cause. Wherein, N is a positive integer greater than 1.

[0196] In the embodiment of the present application, the larger the second weighted abnormal impact score, the greater the probability that the candidate dimensional factor combination is the root cause of the abnormality. Therefore, outputting the candidate dimensional factor combination with a larger second weighted abnormal impact score as the root cause can improve the accuracy of root cause location.

[0197] In some embodiments, after taking multiple candidate dimensional factor combinations ranked before the N numbers as the common root cause, the attributes of the common root cause can be further analyzed to determine the final root cause. That is, when the output root cause contains multiple candidate dimensional factor combinations, the attributes of the multiple candidate dimensional factor combinations can be analyzed to determine the final root cause. As mentioned above, since the second weighted abnormal impact score of the candidate dimensional factor combination (city = Shanghai, ISP = China Unicom) included in the third cluster family is -0.081, and the second weighted abnormal impact score of the candidate dimensional factor combination (city = Shanghai, ISP = China Telecom) included in the third cluster family is -0.084, the second weighted abnormal impact scores corresponding to the two are not much different. By performing attribute analysis on these two candidate dimensional factor combinations, it is found that both contain the same region Shanghai, from which it can be inferred that the root cause of the index fluctuation is the server or network failure in Shanghai.

[0198] An embodiment of the present application further provides an electronic device, which includes a memory and a processor, wherein the memory stores a computer program, and the above method is implemented when the processor executes the computer program.

[0199] See also Fig. 9 , Fig. 9 The hardware structure of an electronic device of another embodiment is illustrated, and the electronic device includes:

[0200] The processor 901 may be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (Application Specific Integrated Circuit, ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of the present application;

[0201] The memory 902 can be implemented in the form of a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 902 can store an operating system and other applications. When the technical solution provided in the embodiments of this specification is implemented by software or firmware, the relevant program code is stored in the memory 902, and the processor 901 calls and executes the above method of the embodiment of this application;

[0202] Input / output interface 903, used to implement information input and output;

[0203] Communication interface 904, used to realize communication interaction between the device and other devices, which can be realized by wired mode (such as USB, network cable, etc.) or wireless mode (such as mobile network, WIFI, Bluetooth, etc.);

[0204] A bus 905 that transmits information between the various components of the device (e.g., the processor 901, the memory 902, the input / output interface 903, and the communication interface 904);

[0205] The processor 901 , the memory 902 , the input / output interface 903 and the communication interface 904 are connected to each other in communication within the device via a bus 905 .

[0206] The embodiments described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application and do not constitute a limitation on the technical solutions provided in the embodiments of the present application. Those skilled in the art will appreciate that with the evolution of technology and the emergence of new application scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0207] Those skilled in the art will appreciate that the technical solutions shown in the figures do not constitute a limitation on the embodiments of the present application, and may include more or fewer steps than shown in the figures, or a combination of certain steps, or different steps.

[0208] The device embodiments described above are merely illustrative, and the units described as separate components may or may not be physically separated, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0209] Those skilled in the art will appreciate that all or some of the steps in the methods disclosed above, and the functional modules / units in the systems and devices may be implemented as software, firmware, hardware, or a suitable combination thereof.

[0210] The terms "first", "second", "third", "fourth", etc. (if any) in the specification of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0211] It should be understood that in the present application, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the objects associated before and after are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0212] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the above units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0213] The units described above as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0214] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0215] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including multiple instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, referred to as ROM), random access memory (Random Access Memory, referred to as RAM), disk or optical disk and other media that can store programs.

[0216] The preferred embodiments of the present invention are described above with reference to the accompanying drawings, but the scope of the rights of the present invention is not limited thereto. Any modification, equivalent substitution and improvement made by a person skilled in the art without departing from the scope and substance of the present invention should be within the scope of the rights of the present invention.

Claims

1. A multi-dimensional indicator root cause location method, characterized in that: The method comprises: Filter out abnormal candidate dimension factor combinations through adaptive residual filtering algorithm; Clustering the candidate dimensional factor combinations based on a density clustering algorithm to cluster the candidate dimensional factor combinations affected by the same root cause into one cluster to obtain a plurality of cluster families; According to the abnormal fluctuation degree, consistency ratio and noise ratio of each candidate dimensional factor combination in the clustering family, a first weighted abnormal impact score corresponding to each clustering family is calculated, and a target clustering family with the largest first weighted abnormal impact score is obtained; Calculating a second weighted abnormal impact score corresponding to each candidate dimensional factor combination in the target cluster family according to the abnormal fluctuation degree and consistency ratio of each candidate dimensional factor combination in the target cluster family; According to the second weighted abnormal impact score corresponding to each candidate dimensional factor combination in the target cluster family, at least one candidate dimensional factor combination is determined from the target cluster family as a root cause.

2. The method according to claim 1, characterized in that The abnormal dimensional factor combinations filtered out by the adaptive residual filtering algorithm include: According to the expected value and observed value corresponding to the dimensional factor combination, the residual value corresponding to each dimensional factor combination is calculated; The residual values ​​of each of the dimensional factor combinations are sorted in order of size, and a cumulative distribution function is constructed to calculate the cumulative frequency value corresponding to each of the residual values; Determining a target residual value corresponding to a significant change in the cumulative frequency value according to a correspondence between the residual value and the cumulative frequency value; The dimensionality factor combinations whose residual values ​​are greater than the target residual value in the dimensionality factor combinations are taken as abnormal candidate dimensionality factor combinations.

3. The method according to claim 1, characterized in that The density-based clustering algorithm clusters the candidate dimensional factor combinations to cluster the candidate dimensional factor combinations affected by the same root cause into one cluster, thereby obtaining a plurality of cluster families, including: According to the expected value and the observed value corresponding to each of the candidate dimensional factor combinations, the deviation score corresponding to each of the candidate dimensional factor combinations is calculated; Calculate the mean and variance of the deviation scores corresponding to each of the candidate dimensional factor combinations, and calculate the probability density value corresponding to each of the candidate dimensional factor combinations based on the mean and the variance; The relative distance threshold of each of the probability density values ​​is calculated, and the candidate dimension factors with similar deviation scores are clustered into one cluster according to the relative distance threshold to obtain a plurality of cluster families.

4. The method according to claim 3, characterized in that The calculation of the relative distance threshold of each probability density value comprises: Obtaining the minimum probability density value from the probability density values ​​corresponding to each of the candidate dimensional factor combinations; The relative density distances between the minimum probability density value and other probability density values ​​are calculated, and the median of the relative density distances between the minimum probability density value and other probability density values ​​is used as the relative distance threshold.

5. The method according to claim 3 or 4, characterized in that: The candidate dimension factors with similar deviation scores are clustered into one cluster according to the relative distance threshold, and multiple cluster families are obtained, including: Sort the probability density values ​​corresponding to each of the candidate dimensional factor combinations in ascending order; Selecting the candidate dimensional factor combination with the highest ranking from the ranking as the starting point, and calculating the relative density distances between other candidate dimensional factor combinations in the ranking and the starting point in order of ranking; If the calculated relative density distance is less than or equal to the relative distance threshold, the corresponding candidate dimensional factor combination and the candidate dimensional factor combination corresponding to the starting point are classified into the same clustering family; If the calculated density relative distance is greater than the relative distance threshold, the corresponding candidate dimensional factor combination is updated as the starting point, and the step of calculating the density relative distances of other candidate dimensional factor combinations in the sorting order and the starting point is returned to in sequence, until all candidate dimensional factor combinations are clustered into corresponding clustering families.

6. The method according to claim 1, characterized in that The step of calculating the first weighted abnormal impact score corresponding to each cluster group according to the abnormal fluctuation degree, consistency ratio and noise ratio of each candidate dimensional factor combination in the cluster group includes: Calculate the ratio of the absolute value of the difference between the observed value and the expected value corresponding to each candidate dimensional factor combination in the cluster family to the expected value, obtain the abnormal fluctuation degree of each candidate dimensional factor combination in the cluster family, and perform weighted summation on the abnormal fluctuation degree of each candidate dimensional factor combination in the cluster family to obtain a first abnormal impact score; Calculate the ratio of the absolute value of the difference between the deviation score corresponding to each candidate dimensional factor combination in the cluster family and the mean of the deviation scores corresponding to all candidate dimensional factor combinations in the cluster family to the mean of the deviation scores corresponding to all candidate dimensional factor combinations in the cluster family, obtain the consistency ratio of each candidate dimensional factor combination in the cluster family, and perform weighted summation on the consistency ratios of each candidate dimensional factor combination in the cluster family to obtain the second abnormal impact score; Calculate 1 minus the ratio of the deviation scores corresponding to each candidate dimensional factor combination in the cluster family to the maximum deviation score corresponding to the candidate dimensional factor combination in the cluster family to obtain the noise ratio of each candidate dimensional factor combination in the cluster family, and perform weighted summation on the noise ratios of each candidate dimensional factor combination in the cluster family to obtain the third abnormal impact score; The first abnormality impact score, the second abnormality impact score, and the third abnormality impact score respectively corresponding to each of the cluster groups are weighted to obtain a first weighted abnormality impact score respectively corresponding to each of the cluster groups.

7. The method according to claim 1, characterized in that The step of calculating the second weighted abnormal impact score corresponding to each candidate dimensional factor combination in the target cluster family according to the abnormal fluctuation degree and consistency ratio of each candidate dimensional factor combination in the target cluster family comprises: Calculate the ratio of the absolute value of the difference between the observed value and the expected value corresponding to each candidate dimensional factor combination in the target cluster family to the expected value, and obtain the abnormal fluctuation degree corresponding to each candidate dimensional factor combination in the target cluster family; Calculate the ratio of the absolute value of the difference between the deviation score corresponding to each candidate dimensional factor combination in the target cluster family and the mean of the deviation scores corresponding to all candidate dimensional factor combinations in the target cluster family to the mean of the deviation scores corresponding to all candidate dimensional factor combinations in the target cluster family, and obtain the consistency ratio corresponding to each candidate dimensional factor combination in the target cluster family; The abnormal fluctuation degree and the consistency ratio respectively corresponding to each of the candidate dimensional factor combinations in the target cluster family are weighted to obtain a second weighted abnormal impact score respectively corresponding to each of the candidate dimensional factor combinations in the target cluster family.

8. The method according to claim 1, characterized in that The determining, according to the second weighted abnormal impact score corresponding to each candidate dimensional factor combination in the target cluster family, at least one candidate dimensional factor combination as the root cause from the target cluster family includes: Taking the candidate dimensional factor combination corresponding to the largest second weighted abnormal impact score in the target cluster group as a common root cause; or, Sorting each candidate dimensional factor combination in the target cluster family in descending order according to the second weighted abnormal impact score; A plurality of candidate dimension factors ranked before N numbers are combined as the root cause, where N is a positive integer greater than 1.

9. The method according to claim 8, characterized in that After combining multiple candidate dimension factors ranked before the N numbers as a common root cause, the method further includes: The attributes of the common root causes are analyzed to determine a final root cause.

10. An electronic device, characterized in that: The electronic device comprises a memory and a processor, the memory stores a computer program, and the processor implements the method according to any one of claims 1 to 9 when executing the computer program.

Images