Intelligent early warning and abnormal root cause positioning scheme combined with multi-dimensional business index data

Abstract

The invention provides an intelligent early warning and abnormal root cause positioning scheme combined with multi-dimensional service index data, and the scheme comprises the steps: carrying out the clustering of a plurality of service time sequence indexes based on the time domain feature and frequency domain feature of each service time sequence index, determining a service time sequence index belonging to a periodic characteristic and a service time sequence index belonging to a non-periodic characteristic; inputting the periodic time sequence characteristics of the service time sequence indexes belonging to the periodic characteristics into a deep neural network model to determine abnormal values of the service time sequence indexes, and inputting the non-periodic time sequence characteristics of the service time sequence indexes belonging to the non-periodic characteristics into a long-short-term memory model to determine abnormal values of the service time sequence indexes; according to the invention, fault positioning analysis is carried out on the abnormal values of the abnormal business time sequence indexes and the predicted values corresponding to the abnormal values based on the risk positioning technology, and the basic factors influencing the fault occurrence of the plurality of business time sequence indexes are determined, so that the accuracy of abnormal value detection is improved.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to an intelligent early warning and abnormal root cause location solution that combines multi-dimensional business indicator data. Background Art

[0002] Business operations have entered the era of artificial intelligence operations. In the field of operations, anomaly detection and root cause analysis are very important foundations, which determine the quantity and quality of alarms and also affect the reliability of actions to be taken after anomalies are discovered. At present, the monitoring indicators in the Internet field are all at the level of tens of thousands. Traditional operators' anomaly monitoring basically processes the corresponding indicator data of each dimension through the data warehouse, and then monitors whether the business volume in various regions across the country is healthy based on the rules manually configured by the operators. The manual rule method requires different rules to be configured in each interval, which is time-consuming and labor-intensive, especially when the business changes, it needs to be reconfigured and modified. Therefore, how to quickly and accurately detect anomalies in business indicators has become a technical issue that cannot be underestimated. Summary of the invention

[0003] In view of this, the purpose of this application is to provide an intelligent early warning and abnormal root cause location solution that combines multi-dimensional business indicator data. By dividing the business timing indicators and using different models to detect outliers for business timing indicators with different characteristics, the accuracy of outlier detection is improved. Risk location technology can be used to quickly and accurately determine the root factors that affect the failure of business timing indicators.

[0004] The embodiment of the present application provides an intelligent early warning and abnormal root cause location solution combining multi-dimensional business indicator data, and the intelligent early warning and abnormal root cause location solution includes:

[0005] Acquire multiple service timing indicators to be detected, cluster the multiple service timing indicators based on the time domain characteristics and frequency domain characteristics of each service timing indicator, and determine the service timing indicators belonging to periodic characteristics and the service timing indicators belonging to non-periodic characteristics;

[0006] Input the periodic time series features of the business time series indicators with periodic characteristics into a pre-trained deep neural network model to determine the abnormal values ​​of the business time series indicators, and input the non-periodic time series features of the business time series indicators with non-periodic characteristics into a pre-trained long short-term memory model to determine the abnormal values ​​of the business time series indicators;

[0007] Based on the risk location technology, fault location analysis is performed on the abnormal values ​​of the abnormal business timing indicators and the predicted values ​​corresponding to each abnormal value to determine the fundamental factors affecting the failure of multiple business timing indicators; wherein the predicted values ​​are determined based on the model corresponding to the business timing indicators.

[0008] In a possible implementation, the deep neural network model is trained by the following steps:

[0009] Inputting sample periodic time series features of sample business time series indicators belonging to periodic characteristics into the time series decomposition network layer of the initial deep neural network model, processing the sample periodic time series features, and generating first sample features;

[0010] Inputting the first sample feature into the feature engineering network layer of the initial deep neural network model, performing wavelet decomposition on the first sample feature to extract wavelet features, performing cosine similarity calculation on the wavelet features and the corresponding historical time series features in the same-chain-month time window to extract correlation features;

[0011] Inputting the wavelet feature and the correlation feature into the processing network layer of the initial deep neural network model, standardizing the correlation feature and the wavelet feature, and predicting the sample prediction value of the sample period time series based on the standardized correlation feature and the second sample feature;

[0012] The deep neural network model is obtained by iteratively changing the initial deep neural network model based on the loss value between the sample prediction value and the sample business indicator value of the sample period time series.

[0013] In a possible implementation manner, the sample service timing indicators belonging to the periodic characteristic are determined by the following steps:

[0014] Eliminate the business indicators corresponding to holidays from the initial business time series indicators, and use the business indicators of the same and month-on-month periods to supplement the eliminated business indicators to determine the supplemented initial business time series indicators;

[0015] Performing missing value interpolation processing on the supplemented initial business time series indicators to determine the initial business time series indicators after the missing value interpolation processing;

[0016] The initial business time series indicators after the missing value interpolation processing are subjected to abnormal value interpolation processing to determine the sample business time series indicators.

[0017] In a possible implementation manner, the sample periodic time series features of the sample business time series indicators belonging to the periodic characteristics are input into the time series decomposition network layer of the initial deep neural network model, and the sample periodic time series features are processed to generate the first sample features, including:

[0018] Performing bilateral filtering on the sample periodic time series features to obtain the periodic time series features after denoising;

[0019] Performing minimum absolute deviation regression trend analysis on the denoised sample periodic time series characteristics to obtain trend characteristics;

[0020] The difference feature between the denoised sample periodic time series feature and the trend feature is seasonally decomposed to obtain the first sample feature.

[0021] In a possible implementation manner, inputting the non-periodic time series features of the business time series indicators with non-periodic characteristics into a pre-trained long short-term memory model to determine the abnormal value of the business time series indicators includes:

[0022] Inputting the non-periodic time series features into the long short-term memory model, predicting the business indicator value at each time point in the non-periodic time series features, and outputting the predicted value at each time point in the non-periodic time series features;

[0023] Determine the mean square error between the predicted value at each time point in the non-periodic time series feature and the actual service data value at each time point;

[0024] If the mean square error is less than a preset threshold, the actual business data value at the time point corresponding to the mean square error is an abnormal value.

[0025] In a possible implementation manner, the risk location technology is used to perform fault location analysis on the abnormal values ​​of the abnormal business timing indicators and the predicted values ​​corresponding to each abnormal value to determine the root factors that affect the failure of multiple business timing indicators, including:

[0026] Based on the time point corresponding to the abnormal value of the business time series indicator with abnormality and the time window threshold, multiple abnormal values ​​of the business time series indicator are divided into regions to determine multiple abnormal partitions;

[0027] Taking the abnormal value of the business time series indicator as a sub-node in the abnormal partition, performing weighted deviation calculation and ripple effect processing based on the abnormal value and predicted value of the sub-node, and determining the risk score of each sub-node in each abnormal partition;

[0028] The subnode corresponding to the highest risk score is regarded as the fundamental factor affecting the failure of the business timing indicator.

[0029] In a possible implementation manner, for each of the abnormal partitions, the abnormal value of the business time series indicator is used as a sub-node in the abnormal partition, and weighted deviation calculation and ripple effect processing are performed based on the abnormal value and predicted value of the sub-node to determine the risk score of each of the sub-nodes in each of the abnormal partitions, including:

[0030] Based on the abnormal value and predicted value of the child node, the actual business indicator value of the parent node corresponding to the child node and the predicted value of the parent node, determine the influence degree value of the child node on the parent node; wherein the parent node is the dimension for dividing the business time series indicator;

[0031] For each of the subnodes, the predicted business value of the subnode and the abnormal value of the subnode are calculated based on the weighted deviation calculation formula to determine a first weighted deviation score value of the subnode, and the risk level value of the subnode is determined based on the influence level value of the subnode and the first weighted deviation score value of the subnode;

[0032] For each of the parent nodes, a second weighted deviation score value between the predicted business indicator value and the abnormal value of all child nodes under the parent node and the weighted deviation score value of the parent node are determined based on the weighted deviation calculation formula, and a ripple effect value of the parent node is determined based on the second weighted deviation score value and the weighted deviation score value of the parent node;

[0033] Based on the difference between the risk level value of the child node and the ripple effect value of the parent node corresponding to the node, the risk score of each child node under the abnormal partition is determined.

[0034] The embodiment of the present application also provides an intelligent early warning and abnormal root cause location device based on multi-dimensional business indicator data, and the intelligent early warning and abnormal root cause location device includes:

[0035] A division module, used to obtain multiple service timing indicators to be detected, cluster the multiple service timing indicators based on the time domain characteristics and frequency domain characteristics of each service timing indicator, and determine the service timing indicators belonging to periodic characteristics and the service timing indicators belonging to non-periodic characteristics;

[0036] An anomaly detection module, used for inputting the periodic time series features of the business time series indicators belonging to periodic characteristics into a pre-trained deep neural network model to determine the abnormal value of the business time series indicators, and inputting the non-periodic time series features of the business time series indicators belonging to non-periodic characteristics into a pre-trained long short-term memory model to determine the abnormal value of the business time series indicators;

[0037] The root cause location module is used to perform fault location analysis on the abnormal values ​​of the abnormal business timing indicators and the predicted values ​​corresponding to each abnormal value based on risk location technology, and determine the fundamental factors affecting the failure of multiple business timing indicators; wherein the predicted values ​​are determined based on the model corresponding to the business timing indicators.

[0038] An embodiment of the present application also provides an electronic device, including: a processor, a memory and a bus, wherein the memory stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor and the memory communicate through the bus, and when the machine-readable instructions are executed by the processor, the steps of the intelligent early warning and abnormal root cause location solution combined with multi-dimensional business indicator data are performed as described above.

[0039] An embodiment of the present application also provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the steps of the above-mentioned intelligent early warning and abnormal root cause location solution combining multi-dimensional business indicator data are executed.

[0040] The embodiment of the present application provides an intelligent early warning and abnormal root cause location solution combined with multi-dimensional business indicator data, and the intelligent early warning and abnormal root cause location solution includes: obtaining multiple business timing indicators to be detected, clustering the multiple business timing indicators based on the time domain characteristics and frequency domain characteristics of each business timing indicator, and determining the business timing indicators with periodic characteristics and the business timing indicators with non-periodic characteristics; inputting the periodic timing characteristics of the business timing indicators with periodic characteristics into a pre-trained deep neural network model to determine the abnormal values ​​of the business timing indicators, and inputting the non-periodic timing characteristics of the business timing indicators with non-periodic characteristics into a pre-trained long short-term memory model to determine the abnormal values ​​of the business timing indicators; based on risk location technology, performing fault location analysis on the abnormal values ​​of the abnormal business timing indicators and the predicted values ​​corresponding to each of the abnormal values, and determining the fundamental factors affecting the failure of multiple business timing indicators; wherein the predicted values ​​are determined based on the model corresponding to the business timing indicators. By dividing the business timing indicators and using different models to detect outliers for business timing indicators with different characteristics, the accuracy of outlier detection is improved. The risk location technology can quickly and accurately determine the root factors that affect the failure of business timing indicators.

[0041] In order to make the above-mentioned objects, features and advantages of the present application more obvious and easy to understand, preferred embodiments are specifically cited below and described in detail with reference to the attached drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0043] Figure 1 A flowchart of an intelligent early warning and abnormal root cause location solution combining multi-dimensional business indicator data provided in an embodiment of the present application;

[0044] Figure 2 A schematic diagram of the periodic timing characteristics provided by an embodiment of the present application;

[0045] Figure 3 A schematic diagram of the non-periodic timing characteristics provided by an embodiment of the present application;

[0046] Figure 4 A schematic diagram of the stable timing characteristics provided by an embodiment of the present application;

[0047] Figure 5 A schematic diagram of the node attribute relationship of the service timing indicator provided in the embodiment of the present application;

[0048] Figure 6 One of the structural schematic diagrams of an intelligent early warning and abnormal root cause location device combined with multi-dimensional business indicator data provided in an embodiment of the present application;

[0049] Figure 7 A second structural diagram of an intelligent early warning and abnormal root cause location device combining multi-dimensional business indicator data provided in an embodiment of the present application;

[0050] Figure 8 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0051] To make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all of the embodiments. The components of the embodiments of the present application usually described and shown in the drawings here can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the application claimed for protection, but merely represents the selected embodiments of the present application. Based on the embodiments of the present application, each other embodiment obtained by those skilled in the art without making creative work belongs to the scope of protection of the present application.

[0052] First, the application scenarios to which the present application is applicable are introduced. The present application can be applied in the field of computer processing technology.

[0053] According to research, business operations have entered the era of AI operation and maintenance. In the field of operations, anomaly detection and root cause analysis are very important foundations, which determine the quantity and quality of alarms and also affect the reliability of actions to be taken after anomalies are discovered. At present, the monitoring indicators in the Internet field are all at the level of tens of thousands. Traditional operators' abnormal monitoring basically processes the corresponding indicator data of each dimension through the data warehouse, and then monitors whether the business volume in various regions across the country is healthy based on the rules manually configured by the operators. The manual rule method requires different rules to be configured in each interval, which is time-consuming and labor-intensive, especially when the business changes, it needs to be reconfigured and modified. Therefore, how to quickly and accurately detect anomalies in business indicators has become a technical issue that cannot be underestimated.

[0054] Based on this, the embodiment of the present application provides an intelligent early warning and abnormal root cause location solution that combines multi-dimensional business indicator data. By dividing the business timing indicators and using different models to detect outliers for business timing indicators with different characteristics, the accuracy of outlier detection is improved. The risk location technology can be used to quickly and accurately determine the root factors that affect the failure of business timing indicators.

[0055] See also Figure 1 , Figure 1 This is a flow chart of an intelligent early warning and abnormal root cause location solution that combines multi-dimensional business indicator data provided by the embodiment of the present application. Figure 1 As shown in , the intelligent early warning and abnormal root cause location solution provided by the embodiment of the present application includes:

[0056] S101: Acquire multiple service timing indicators to be detected, cluster the multiple service timing indicators based on the time domain characteristics and frequency domain characteristics of each service timing indicator, and determine the service timing indicators with periodic characteristics and the service timing indicators with non-periodic characteristics.

[0057] In this step, the multiple service timing indicators to be detected are clustered according to the acquired time domain characteristics and frequency domain characteristics, and the service timing indicators with periodic characteristics and the service timing indicators with non-periodic characteristics are determined.

[0058] Among them, the business time series indicator can be a business indicator with a time series that needs to be monitored and managed in the financial Internet. Any business indicator that needs to be monitored and managed can be a business time series indicator in this solution, and this part does not make specific restrictions.

[0059] Here, the business timing indicators are clustered in the following ways: curve generation is performed on the business timing indicators, and the statistical features of the curve are extracted using a multi-scale sliding window to determine the time domain features; the curve is Fourier transformed, and the spectrum is extracted from the Fourier transformed curve, and the amplitude and phase of the spectrum are extracted as frequency domain features to determine the frequency domain features; the time domain features and frequency domain features are input into a pre-trained decision tree model, and the business timing indicators are clustered using the time domain features and frequency domain features, and the business timing indicators with periodic characteristics and the business timing indicators with non-periodic characteristics are output. Among them, the statistical features are the features obtained after the mean processing, variance processing, coefficient of variation processing and difference processing of the curve.

[0060] Among them, before obtaining multiple business time series indicators to be detected, it is necessary to perform data preprocessing on the business time series indicators, and the data preprocessing includes holiday elimination processing and missing value interpolation processing.

[0061] For further information, see Figure 2 , Figure 3 , Figure 4 , Figure 2 A schematic diagram of the periodic timing characteristics provided by an embodiment of the present application; Figure 3 A schematic diagram of the non-periodic timing characteristics provided by an embodiment of the present application; Figure 4 Schematic diagram of the stable timing characteristics provided by the embodiment of the present application. Figure 2 The periodic timing characteristics shown in and Figure 4 The stationary time series features shown in the figure have very small statistical values ​​within a certain time window, while Figure 3 The non-periodic time series features shown in the figure have particularly large statistical fluctuations within a certain time window. In addition, the frequency spectrum of the periodic time series features contains very little information, while the other two types of frequency spectrums are relatively chaotic. Therefore, a rough classification can be achieved through clustering algorithms based on time domain features and frequency domain features. The decision tree algorithm can be used to learn based on sample labels to finally classify the curve into periodic and non-periodic for subsequent model design. Since the stationary time series feature is a type of periodic time series feature, the stationary time series feature is classified into the periodic time series feature.

[0062] In this application, it is difficult to use some general algorithms to cover all scenarios due to the large differences in monitoring indicator types. Especially in feature engineering, the complex feature relationships processed by general methods are difficult for some machine learning models to have strong expression capabilities. When encountering such a problem, it is necessary to find a classifier to roughly separate the shape of the curve first, and use targeted algorithms to process different curves to improve the accuracy of detection.

[0063] S102: Input the periodic timing features of the business timing indicators with periodic characteristics into a pre-trained deep neural network model to determine the abnormal values ​​of the business timing indicators, and input the non-periodic timing features of the business timing indicators with non-periodic characteristics into a pre-trained long short-term memory model to determine the abnormal values ​​of the business timing indicators.

[0064] In this step, the periodic timing features of the business timing indicators with periodic characteristics are input into a pre-trained deep neural network model to determine the abnormal values ​​of the business timing indicators, and the non-periodic timing features of the business timing indicators with non-periodic characteristics are input into a pre-trained long short-term memory model to determine the abnormal values ​​of the business timing indicators.

[0065] Here, different types of algorithms are selected for the classified business time series indicators to perform outlier detection in a targeted manner. Since the year-on-year and month-on-month features of periodic time series features are more important than real-time features, the deep neural network model (Deep Neural Networks, DNN) is used for outlier detection. The real-time features of non-periodic time series features are more important, so the long short-term memory model (Long Short-Term Memory, LSTM) is used for outlier detection. Targeted anomaly detection is achieved according to different curve types, which improves the accuracy of detection.

[0066] In a possible implementation, the deep neural network model is trained by the following steps:

[0067] A: Input the sample periodic timing features of the sample business timing indicators with periodic characteristics into the timing decomposition network layer of the initial deep neural network model, process the sample periodic timing features, and generate the first sample features.

[0068] Here, the sample periodic timing features of the sample business timing indicators belonging to periodic characteristics are input into the timing decomposition network layer of the initial deep neural network model, and the sample periodic timing features are processed to generate the first sample features.

[0069] In a possible implementation manner, the sample service timing indicators belonging to the periodic characteristic are determined by the following steps:

[0070] (1): Eliminate the business indicators corresponding to holidays from the initial business time series indicators, and use the business indicators of the same and month-on-month periods to supplement the eliminated business indicators to determine the supplemented initial business time series indicators.

[0071] Here, the regularly maintained statutory holiday table is used to eliminate the business indicators corresponding to holidays in the initial business time series indicators, and after elimination, the same-month and year-on-year cycle data are used to fill in.

[0072] (2): Perform missing value interpolation processing on the supplemented initial business time series indicators to determine the initial business time series indicators after the missing value interpolation processing.

[0073] Here, the missing value interpolation processing is performed on the supplemented initial business time series indicators to determine the initial business time series indicators after the missing value interpolation processing. Specifically, when the time window of the missing value is relatively small, the moving average of the previous and next time windows is used for filling. When the missing value is relatively large, the change value between the current point and its previous point is used as a new sequence, and then the previous and next data are evenly filled.

[0074] (3): Perform outlier interpolation processing on the initial business time series indicators after the missing value interpolation processing to determine the sample business time series indicators.

[0075] Here, outlier interpolation is performed on the initial business time series indicators after the missing value interpolation process to determine the sample business time series indicators.

[0076] Among them, indicators with abnormal labels can be treated as missing values. For businesses without labels, the hypothesis test method is used to roughly locate the abnormal interval and interpolate the missing values. For example, the Grubbs test method:

[0077]

[0078] Where G represents the G value, represents the mean of the data points, Y represents the actual value of the data points, and S represents the standard deviation.

[0079]

[0080] Where N is the number of samples, t α / (2N),N-2 represents the critical value of the t distribution with (N-2) degrees of freedom and the significance level of α / (2N).

[0081] The training data in this application comes from the company's online business indicators and the public data sets officially provided by aiops (KPI data of large Internet companies). Among them, the company's business indicators include the start and end time of manually marked faults (less data), and the official public data sets provide a large number of user annotations, so it is necessary to pre-process the training data to improve the accuracy of the subsequent model training process.

[0082] In a possible implementation manner, the sample periodic time series features of the sample business time series indicators belonging to the periodic characteristics are input into the time series decomposition network layer of the initial deep neural network model, and the sample periodic time series features are processed to generate the first sample features, including:

[0083] a: Perform bilateral filtering on the sample periodic time series features to obtain the denoised periodic time series features.

[0084] Here, bilateral filtering is performed on the periodic time series features of the samples to obtain denoised periodic time series features.

[0085] Among them, bilateral filtering is used to denoise the time series, which is an edge-preserving filter in image processing. The basic idea of ​​bilateral filtering is to use neighbors with similar values ​​to smooth the time series.

[0086] b: Perform minimum absolute deviation regression trend analysis on the denoised sample periodic time series characteristics to obtain trend characteristics.

[0087] Here, the minimum absolute deviation regression trend analysis is performed on the periodic time series characteristics of the denoised samples to obtain trend characteristics.

[0088] c: Perform seasonal decomposition on the difference feature between the denoised sample periodic time series feature and the trend feature to obtain the first sample feature.

[0089] Here, seasonal decomposition is performed on the difference feature between the denoised sample periodic time series feature and the trend feature to obtain the first sample feature.

[0090] In a specific embodiment, the working principle of the time series decomposition network layer is as follows: Trend decomposition: Use local regression (Loess) technology to estimate the trend component. Loess is a non-parametric regression method that can fit a smooth trend curve based on the local characteristics of the data points. Seasonal decomposition: The seasonal component is gradually extracted from the original data in an iterative manner. Each iteration updates the remaining data until convergence. Residual extraction: The remaining part is considered to be the residual component, which contains random fluctuations in the data and other uncaptured features.

[0091] B: Input the first sample feature into the feature engineering network layer of the initial deep neural network model, perform wavelet decomposition on the first sample feature to extract the wavelet feature, calculate the cosine similarity between the wavelet feature and the corresponding historical time series feature in the same-year and month-on-month time window, and extract the correlation feature.

[0092] Here, the first sample feature is input into the feature engineering network layer of the initial deep neural network model, the first sample feature is subjected to wavelet decomposition to extract the wavelet feature, the cosine similarity between the wavelet feature and the corresponding historical time series feature in the same-chain time window is calculated to extract the correlation feature.

[0093] Among them, wavelet analysis is mainly used for filtering and eliminating noise in time series, and can reflect the characteristics of sequence data that cannot be observed at a conventional scale. Unlike Fourier transform, wavelet analysis has the function of time-frequency multi-resolution analysis. Due to the diversity of wavelet bases and the extension mode of signals, it is easy to obtain high-level features. In the process of wavelet grading, there are two basic functions, namely the father wavelet and the mother wavelet:

[0094]

[0095] f(x)=A j (x)+Dj (x)+…+D J (x)

[0096] Among them, the parameter j=1…is the scale parameter of the decomposition to the Jth layer, k is the translation parameter, and the parent wavelet Convert the original signal f(x) into approximate components, the mother wavelet ψ j,k (J) Then f(x) is converted into the detail part.

[0097] In a specific embodiment, the original residual signal can be decomposed into a primary low-frequency signal and a primary high-frequency signal, and the primary low-frequency signal is further decomposed into a secondary low-frequency signal and a secondary high-frequency signal, and the secondary low-frequency signal can be further decomposed into a tertiary low-frequency signal and a tertiary high-frequency signal. The final wave signal is a primary high-frequency signal, a secondary high-frequency signal, a tertiary high-frequency signal and a tertiary low-frequency signal. It should be noted that the above-mentioned wavelet decomposition level is only an exemplary description, and more levels of wavelet decomposition can be performed according to actual needs. The more layers of wavelet decomposition, the more detailed the frequency features obtained, and the richer the feature levels. Each wavelet coefficient corresponds to a specific scale or frequency, and can provide data features at different time scales. By analyzing components at different scales, the multi-level characteristics of the data can be revealed.

[0098] Here, for periodic and stable sequences, the shape change within the same-month and year-on-year time window is an important indicator for judging abnormalities, and it is also the only criterion that operators often use to judge whether the alarm is correct. The formula for calculating cosine similarity is as follows:

[0099]

[0100] Among them, x1[n] represents the wavelet feature of the sample periodic time series feature, x2[n] represents the historical time series feature, cosθ is the similarity value, and the correlation feature is the correlation feature between the wavelet feature and the historical time series feature whose similarity value is greater than the preset threshold.

[0101] C: Input the wavelet features and the correlation features into the processing network layer of the initial deep neural network model, standardize the correlation features and the wavelet features, and predict the sample prediction values ​​of the sample period time series based on the standardized correlation features and the second sample features.

[0102] Here, the wavelet features and the correlation features are input into the processing network layer of the initial deep neural network model, the correlation features and the wavelet features are standardized, and the sample prediction values ​​of the sample period time series are predicted based on the standardized correlation features and the second sample features.

[0103] The sample predicted business indicator value is the predicted value of the business indicator corresponding to each time point in the sample periodic time series characteristics of the sample business time series indicator.

[0104] Among them, after calculating the correlation features, since the value range of the cosine value is [-1,1], the correlation features need to be normalized to improve the prediction accuracy of the subsequent data processing model.

[0105] After extracting the wavelet features and correlation features, in order to further improve the training effect of the ordered data processing model and enable the model to better learn the characteristic information in the sample periodic time series features, the sample periodic time series features can be expanded. The SMOTE oversampling algorithm can be used to expand the sample periodic time series features. The specific algorithm is as follows:

[0106] The following formula is used to artificially synthesize new samples using a small number of samples (abnormally labeled samples) and put them into the data set. The formula is as follows:

[0107] x new =x+rand(0,1)*|xx n |

[0108] Among them, x new represents the synthesized sample point, x represents the sample point marked with an abnormal label, and x n It represents K adjacent random samples selected by a certain sampling rate, and rand(0,1) is a random number. By using the oversampling algorithm, the abnormal samples in the periodic time series characteristics of the samples can be expanded.

[0109] In order to further improve the training effect of the ordered data processing model, it is necessary to standardize the extracted wavelet features and correlation features. The standardization of wavelet features can be done by standardizing the mean and standard deviation of the high-frequency data in the 6-hour window before and after the last week. The specific method is:

[0110]

[0111] Among them, Z score1 represents the standardized wavelet feature, y represents the business indicator data value in the wavelet feature, mean(T-6,T+6) represents the mean of the high-frequency data in the 6-hour window before and after last week, σ ( T-6, T+6) represents the standard deviation of high-frequency data in the 6-hour window before and after the week.

[0112] For the standardization of correlation features, the baseline value can be used to control the feature values ​​with excessive deformation in the sample periodic time series features. The baseline value can be obtained by adding the coefficient of variation (mean divided by standard deviation) under the moving average and year-on-year time window. The specific calculation method is:

[0113] Z score2 =(1-cosθ)|baseline-realvalue|

[0114] Among them, Z score2 is the standardized correlation feature, baseline represents the baseline value, and realvalue represents the data value in the sample periodic time series feature.

[0115] After the wavelet features and correlation features are standardized, they can be input into the initial deep neural network model for prediction to obtain sample prediction values.

[0116] D: The deep neural network model is obtained by iteratively changing the initial deep neural network model based on the loss value between the sample prediction value and the sample business indicator value of the sample period time series.

[0117] Here, the initial deep neural network model is iteratively modified according to the loss value between the sample prediction value and the sample business indicator value of the sample period time series to obtain the deep neural network model.

[0118] Among them, the specific implementation method of inputting the periodic timing characteristics of the business timing indicators belonging to periodic characteristics into the deep neural network model to determine the abnormal values ​​of the business timing indicators is: inputting the periodic timing characteristics into the deep neural network model to determine the predicted value corresponding to each time point in the periodic timing characteristics, and determining whether the actual business data value at the time point is an abnormal value based on the mean square error between the predicted value at the time point and the actual business data value.

[0119] In a possible implementation manner, inputting the non-periodic time series features of the business time series indicators with non-periodic characteristics into a pre-trained long short-term memory model to determine the abnormal value of the business time series indicators includes:

[0120] (i) Inputting the non-periodic time series features into the long short-term memory model, predicting the business indicator value at each time point in the non-periodic time series features, and outputting the predicted value at each time point in the non-periodic time series features.

[0121] Here, the non-periodic time series features are input into the long short-term memory model, the business indicator value at each time point in the non-periodic time series features is predicted, and the predicted value at each time point in the non-periodic time series features is output.

[0122] Among them, in this application, the LSTM model is used for regression, one business indicator corresponds to one LSTM model, and the LSTM model is adjusted by the MSE between the predicted value and the actual business data value. LSTM is an excellent variant of the recurrent neural network. It inherits most of the features in the recurrent neural network, and the most important thing is to solve the problem of gradient diffusion. LSTM has a good learning ability for the modeling of high availability of the context scenario such as the separated non-periodic sequence. For periodic and stable models, more high-dimensional features can be extracted, and the deep neural network model has stronger expression and generalization capabilities in high feature dimensions than general machine learning models. Therefore, this application uses a deep neural network (DNN) as a classification model, and uses wavelet analysis and deformation feature methods to extract high-dimensional features for deep neural network learning. By selecting different types of algorithms for the classified curves, a targeted model is established to improve the accuracy of abnormal identification of business time series indicators.

[0123] (ii): Determine the mean square error between the predicted value at each time point in the non-periodic time series feature and the actual business data value at each time point; if the mean square error is less than a preset threshold, the actual business data value at the time point corresponding to the mean square error is an abnormal value.

[0124] Here, the mean square error between the predicted value at each time point in the non-periodic time series feature and the actual business data value at each time point is determined; if the mean square error is less than a preset threshold, the actual business data value at the time point corresponding to the mean square error is an outlier.

[0125] S103: Based on the risk location technology, fault location analysis is performed on the abnormal values ​​of the abnormal business timing indicators and the predicted values ​​corresponding to each of the abnormal values ​​to determine the fundamental factors affecting the failure of multiple business timing indicators; wherein the predicted values ​​are determined based on the model corresponding to the business timing indicators.

[0126] In this step, fault location analysis is performed on the abnormal values ​​of the abnormal business timing indicators and the predicted values ​​corresponding to each abnormal value based on the risk location technology to determine the fundamental factors that affect the failure of multiple business timing indicators.

[0127] Among them, the predicted value is determined based on the model corresponding to the business timing indicator. For example, the predicted value of the business timing indicator with periodic characteristics is determined based on the deep neural network model.

[0128] Here, the risk location technology (RiskLoc technology) is able to accurately and efficiently locate the root causes in multi-dimensional time series without significant root cause assumptions.

[0129] In the prior art, the focus is usually on reducing the search space for fault root cause location processing, which requires a lot of manual parameter adjustments, and the running speed is too slow or it is impossible to find more complex root causes. Therefore, the RiskLoc technology used in this application can accurately and efficiently locate the root cause in a multidimensional time series without a significant root cause hypothesis. The partitioning method is used to iteratively search for possible root cause elements in the abnormal partition.

[0130] In a possible implementation manner, the risk location technology is used to perform fault location analysis on the abnormal values ​​of the abnormal business timing indicators and the predicted values ​​corresponding to each abnormal value to determine the root factors that affect the failure of multiple business timing indicators, including:

[0131] I: Based on the time point corresponding to the abnormal value of the business timing indicator with abnormality and the time window threshold, multiple abnormal values ​​of the business timing indicator are divided into regions to determine multiple abnormal partitions.

[0132] Here, multiple abnormal values ​​of the business time series indicator are divided into regions according to the time points corresponding to the abnormal values ​​of the abnormal business time series indicator and the time window threshold, and multiple abnormal partitions are determined.

[0133] II: Taking the abnormal value of the business time series indicator as a sub-node in the abnormal partition, performing weighted deviation calculation and ripple effect processing based on the abnormal value and predicted value of the sub-node, and determining the risk score of each sub-node in each abnormal partition.

[0134] Here, the outliers of the business time series indicators are taken as sub-nodes in the anomaly partition. Weighted deviation calculation and ripple effect processing are performed based on the outliers and predicted values ​​of the sub-nodes to determine the risk score of each sub-node in each anomaly partition.

[0135] Among them, the anomaly partitioning scheme is utilized, and the possible root cause elements are iteratively searched within the anomaly partition through the RiskLoc technology.

[0136] In a possible implementation manner, for each of the abnormal partitions, the abnormal value of the business time series indicator is used as a sub-node in the abnormal partition, and weighted deviation calculation and ripple effect processing are performed based on the abnormal value and predicted value of the sub-node to determine the risk score of each of the sub-nodes in each of the abnormal partitions, including:

[0137] i: Based on the abnormal value and predicted value of the child node, the actual business indicator value of the parent node corresponding to the child node and the predicted value of the parent node, determine the influence degree of the child node on the parent node; wherein the parent node is the dimension for dividing the business timing indicator.

[0138] Here, the influence degree of the child node on the parent node is determined by the following formula:

[0139]

[0140] Among them, ep(e) is the influence of child node e on parent node M, v(e) represents the abnormal value of the child node, f(e) represents the predicted value of the child node, v(M) represents the actual business indicator value of the parent node, and f(M) represents the predicted value of the parent node. Among them, the actual business indicator value of the parent node is the aggregate value of the actual values ​​of multiple child nodes under the parent node, and the predicted value of the parent node is the aggregate value of the predicted values ​​of multiple child nodes under the parent node. For further information, please refer to Figure 5 , Figure 5 A schematic diagram of the node attribute relationship of the service timing indicator provided in the embodiment of the present application, such as Figure 5 As shown, Figure 5 The X in the figure 1234 , child nodes such as Figure 5 X in 123 , X 12 wait.

[0141] ii: For each of the sub-nodes, the predicted business value of the sub-node and the abnormal value of the sub-node are calculated based on the weighted deviation calculation formula to determine the first weighted deviation score value of the sub-node; based on the influence value of the sub-node and the first weighted deviation score value of the sub-node, the risk level value of the sub-node is determined.

[0142] Here, the first weighted deviation score value of the child node is determined by the following formula:

[0143]

[0144] Wherein, ds(e) is the first weighted deviation score value of the child node.

[0145] Here, the risk level of the child node is determined by the following formula:

[0146]

[0147] Among them, r1 is the risk level value of the child node, w a =∑ (w,1) w, w n =∑ (w,0)w, according to the influence value ep of all child nodes under the parent node, determine a quantile t, usually the third quartile is taken as t, and then determine the relationship between the first weighted deviation score ds and t. If ds < t, then w is w (w,0) =t-ds; if ds>t, then take w (w,1) =abs(ds).

[0148] iii: For each of the parent nodes, based on the weighted deviation calculation formula, determine the second weighted deviation score value between the predicted business indicator values ​​and the outlier values ​​of all child nodes under the parent node, as well as the weighted deviation score value of the parent node; based on the second weighted deviation score value and the weighted deviation score value of the parent node, determine the ripple effect value of the parent node.

[0149] Here, the second weighted deviation score value is determined by the following formula:

[0150]

[0151] Among them, r n is the second weighted deviation score, LD(e r ) is an element e in the root cause set RS r will affect all e∈LD(e r ), the element e in the root cause set RS r It is the most important root cause element determined based on the deviation score. For example, the deviation score of e1 is 0.8, which is greater than the deviation threshold, so e1 is taken as an element in RS. r By comparing these deviation scores, it can be determined that er1 is the most important root cause element because it contributes the most to the overall anomaly. r ) / f(e r )).

[0152] Here, the weighted deviation score value r of the parent node is determined by the following formula: d :

[0153]

[0154] Here, the ripple effect value r2 of the parent node is determined:

[0155]

[0156] Among them, the smaller r2 is, the closer it is to 0, indicating that the parent node conforms to the ripple effect and is a candidate factor for the abnormal cause with a relatively high possibility. If r2 is a relatively large value, it means that the prediction residuals of the child nodes under the parent node have a higher variance, and the parent node is unlikely to be the abnormal cause of the abnormal indicator.

[0157] iv: Based on the difference between the risk level value of the child node and the ripple effect value of the parent node corresponding to the node, determine the risk score of each child node under the abnormal partition. The child node corresponding to the highest risk score is regarded as the fundamental factor affecting the failure of the business timing indicator.

[0158] Here, the risk score of each child node under the abnormal partition is determined based on the difference between the risk level value of the child node and the ripple effect value of the parent node corresponding to the node. The child node corresponding to the highest risk score is regarded as the fundamental factor affecting the failure of the business timing indicator.

[0159] In a specific embodiment, a multi-dimensional measurement data table of a business timing indicator having two attributes is input as described in the following table:

[0160] Data Center type Actual value Predicted value X A1 130 390 X A2 39 130 Y A1 195 182 Y A2 390 390 Y A3 1300 1326

[0161] The outlier analysis and risk location technology processing are performed on the business time series indicators with two attributes. According to the risk ranking, {(X, A1)} with the largest risk is the root cause of the overall abnormal decline.

[0162] The beneficial effects of this application are: 1. The performance is significantly improved compared to the original: Compared with the existing system, this solution greatly reduces the number of daily alarms under the same monitoring indicators, and the coverage rate is also significantly improved. 2. Save a lot of manpower costs: Compared with the existing manual rule system, this solution greatly improves the labor efficiency in terms of indicator rule configuration time and abnormal root cause location time after the abnormality is triggered. At the same time, it also reduces the differentiation of alarm rules and maintenance costs that vary from person to person. 3. Universality of the model: This solution has good versatility in anomaly detection and can be applied to the abnormal monitoring needs of most business scenarios. At the same time, it is combined with the root cause location solution to achieve integrated detection and analysis.

[0163] In this application, curve division is added when the time series is input to distinguish the type of time series data using time domain and frequency domain information. Then, based on the periodic type, RobustSTL is used to extract the residual component for subsequent anomaly detection and prediction. LSTM is used to perform anomaly detection and prediction on non-periodic business time series indicators. The final output of the anomaly value and the predicted value is combined with RiskLoc technology for corresponding fault location analysis, which achieves the reduction of the false alarm rate caused by the rules while covering real fault events, while improving the work efficiency of operators.

[0164] The embodiment of the present application provides an intelligent early warning and abnormal root cause location solution combined with multi-dimensional business indicator data, and the intelligent early warning and abnormal root cause location solution includes: obtaining multiple business timing indicators to be detected, clustering the multiple business timing indicators based on the time domain characteristics and frequency domain characteristics of each business timing indicator, and determining the business timing indicators with periodic characteristics and the business timing indicators with non-periodic characteristics; inputting the periodic timing characteristics of the business timing indicators with periodic characteristics into a pre-trained deep neural network model to determine the abnormal values ​​of the business timing indicators, and inputting the non-periodic timing characteristics of the business timing indicators with non-periodic characteristics into a pre-trained long short-term memory model to determine the abnormal values ​​of the business timing indicators; based on risk location technology, performing fault location analysis on the abnormal values ​​of the abnormal business timing indicators and the predicted values ​​corresponding to each of the abnormal values, and determining the fundamental factors affecting the failure of multiple business timing indicators; wherein the predicted values ​​are determined based on the model corresponding to the business timing indicators. By dividing the business timing indicators and using different models to detect outliers for business timing indicators with different characteristics, the accuracy of outlier detection is improved. The risk location technology can quickly and accurately determine the root factors that affect the failure of business timing indicators.

[0165] See also Figure 6 , Figure 7 , Figure 6 One of the structural schematic diagrams of an intelligent early warning and abnormal root cause location device combining multi-dimensional business indicator data provided in an embodiment of the present application; Figure 7 The second structural diagram of an intelligent early warning and abnormal root cause location device combining multi-dimensional business indicator data provided by the embodiment of the present application. Figure 6 As shown in , the intelligent early warning and abnormal root cause positioning device 600 includes:

[0166] The division module 610 is used to obtain multiple service timing indicators to be detected, cluster the multiple service timing indicators based on the time domain characteristics and frequency domain characteristics of each service timing indicator, and determine the service timing indicators belonging to periodic characteristics and the service timing indicators belonging to non-periodic characteristics;

[0167] Anomaly detection module 620, used for inputting the periodic time series features of the business time series indicators belonging to periodic characteristics into a pre-trained deep neural network model to determine the abnormal value of the business time series indicators, and inputting the non-periodic time series features of the business time series indicators belonging to non-periodic characteristics into a pre-trained long short-term memory model to determine the abnormal value of the business time series indicators;

[0168] The root cause location module 630 is used to perform fault location analysis on the abnormal values ​​of the abnormal business timing indicators and the predicted values ​​corresponding to each abnormal value based on risk location technology, and determine the fundamental factors affecting the failure of multiple business timing indicators; wherein the predicted values ​​are determined based on the model corresponding to the business timing indicators.

[0169] Further, such as Figure 7 As shown, the intelligent early warning and abnormal root cause location device 600 also includes a model training module 640, and the model training module 640 trains the deep neural network model through the following steps:

[0170] Inputting sample periodic time series features of sample business time series indicators belonging to periodic characteristics into the time series decomposition network layer of the initial deep neural network model, processing the sample periodic time series features, and generating first sample features;

[0171] Inputting the first sample feature into the feature engineering network layer of the initial deep neural network model, performing wavelet decomposition on the first sample feature to extract wavelet features, performing cosine similarity calculation on the wavelet features and the corresponding historical time series features in the same-chain-month time window to extract correlation features;

[0172] Inputting the wavelet feature and the correlation feature into the processing network layer of the initial deep neural network model, standardizing the correlation feature and the wavelet feature, and predicting the sample prediction value of the sample period time series based on the standardized correlation feature and the second sample feature;

[0173] The deep neural network model is obtained by iteratively changing the initial deep neural network model based on the loss value between the sample prediction value and the sample business indicator value of the sample period time series.

[0174] Further, such as Figure 7As shown, the intelligent early warning and abnormal root cause location device 600 also includes a data processing module 650. The data processing module 650 determines the sample service time series indicators belonging to the periodic characteristics through the following steps:

[0175] Eliminate the business indicators corresponding to holidays from the initial business time series indicators, and use the business indicators of the same and month-on-month periods to supplement the eliminated business indicators to determine the supplemented initial business time series indicators;

[0176] Performing missing value interpolation processing on the supplemented initial business time series indicators to determine the initial business time series indicators after the missing value interpolation processing;

[0177] The initial business time series indicators after the missing value interpolation processing are subjected to abnormal value interpolation processing to determine the sample business time series indicators.

[0178] Further, when the model training module 640 is used to input the sample periodic timing features of the sample business timing indicators belonging to the periodic characteristics into the timing decomposition network layer of the initial deep neural network model, and process the sample periodic timing features to generate the first sample features, the model training module 640 is specifically used to:

[0179] Performing bilateral filtering on the sample periodic time series features to obtain the periodic time series features after denoising;

[0180] Performing minimum absolute deviation regression trend analysis on the denoised sample periodic time series characteristics to obtain trend characteristics;

[0181] The difference feature between the denoised sample periodic time series feature and the trend feature is seasonally decomposed to obtain the first sample feature.

[0182] Further, when the anomaly detection module 620 is used to input the non-periodic time series features of the business time series indicators belonging to the non-periodic characteristics into the pre-trained long short-term memory model to determine the abnormal value of the business time series indicators, the anomaly detection module 620 is specifically used to:

[0183] Inputting the non-periodic time series features into the long short-term memory model, predicting the business indicator value at each time point in the non-periodic time series features, and outputting the predicted value at each time point in the non-periodic time series features;

[0184] Determine the mean square error between the predicted value at each time point in the non-periodic time series feature and the actual service data value at each time point;

[0185] If the mean square error is less than a preset threshold, the actual business data value at the time point corresponding to the mean square error is an abnormal value.

[0186] Further, when the root cause location module 630 is used to perform fault location analysis on the abnormal values ​​of the abnormal business timing indicators and the predicted values ​​corresponding to each abnormal value based on the risk location technology to determine the fundamental factors affecting the failure of multiple business timing indicators, the root cause location module 630 is specifically used to:

[0187] Based on the time point corresponding to the abnormal value of the business time series indicator with abnormality and the time window threshold, multiple abnormal values ​​of the business time series indicator are divided into regions to determine multiple abnormal partitions;

[0188] Taking the abnormal value of the business time series indicator as a sub-node in the abnormal partition, performing weighted deviation calculation and ripple effect processing based on the abnormal value and predicted value of the sub-node, and determining the risk score of each sub-node in each abnormal partition;

[0189] The subnode corresponding to the highest risk score is regarded as the fundamental factor affecting the failure of the business timing indicator.

[0190] Further, when the root cause location module 630 is used for each of the abnormal partitions, taking the abnormal value of the business timing indicator as a sub-node in the abnormal partition, performing weighted deviation calculation and ripple effect processing based on the abnormal value and predicted value of the sub-node, and determining the risk score of each of the sub-nodes in each of the abnormal partitions, the root cause location module 630 is specifically used to:

[0191] Based on the abnormal value and predicted value of the child node, the actual business indicator value of the parent node corresponding to the child node and the predicted value of the parent node, determine the influence degree value of the child node on the parent node; wherein the parent node is the dimension for dividing the business time series indicator;

[0192] For each of the subnodes, the predicted business value of the subnode and the abnormal value of the subnode are calculated based on the weighted deviation calculation formula to determine a first weighted deviation score value of the subnode, and the risk level value of the subnode is determined based on the influence level value of the subnode and the first weighted deviation score value of the subnode;

[0193] For each of the parent nodes, a second weighted deviation score value between the predicted business indicator value and the abnormal value of all child nodes under the parent node and the weighted deviation score value of the parent node are determined based on the weighted deviation calculation formula, and a ripple effect value of the parent node is determined based on the second weighted deviation score value and the weighted deviation score value of the parent node;

[0194] Based on the difference between the risk level value of the child node and the ripple effect value of the parent node corresponding to the node, the risk score of each child node under the abnormal partition is determined.

[0195] The embodiment of the present application provides an intelligent early warning and abnormal root cause location device combined with multi-dimensional business indicator data, and the intelligent early warning and abnormal root cause location device includes: a division module, which is used to obtain multiple business timing indicators to be detected, cluster the multiple business timing indicators based on the time domain characteristics and frequency domain characteristics of each business timing indicator, and determine the business timing indicators with periodic characteristics and the business timing indicators with non-periodic characteristics; an abnormality detection module, which is used to input the periodic timing characteristics of the business timing indicators with periodic characteristics into a pre-trained deep neural network model to determine the abnormal value of the business timing indicator, and input the non-periodic timing characteristics of the business timing indicators with non-periodic characteristics into a pre-trained long short-term memory model to determine the abnormal value of the business timing indicator; a root cause location module, which is used to perform fault location analysis on the abnormal values ​​of the business timing indicators with abnormalities and the predicted values ​​corresponding to each of the abnormal values ​​based on risk location technology, and determine the fundamental factors affecting the failure of multiple business timing indicators; wherein the predicted value is determined based on the model corresponding to the business timing indicator. By dividing the business timing indicators and using different models to detect outliers for business timing indicators with different characteristics, the accuracy of outlier detection is improved. The risk location technology can quickly and accurately determine the root factors that affect the failure of business timing indicators.

[0196] See also Figure 8 , Figure 8 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. Figure 8 As shown in , the electronic device 800 includes a processor 810 , a memory 820 and a bus 830 .

[0197] The memory 820 stores machine-readable instructions executable by the processor 810. When the electronic device 800 is running, the processor 810 communicates with the memory 820 via the bus 830. When the machine-readable instructions are executed by the processor 810, the above-mentioned Figure 1 The method embodiment shown is a step of an intelligent early warning and abnormal root cause location solution that combines multi-dimensional business indicator data. The specific implementation method can be found in the method embodiment and will not be repeated here.

[0198] The present application also provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the computer program can execute the above-mentioned Figure 1The method embodiment shown is a step of an intelligent early warning and abnormal root cause location solution that combines multi-dimensional business indicator data. The specific implementation method can be found in the method embodiment and will not be repeated here.

[0199] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0200] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, and the indirect coupling or communication connection of devices or units can be electrical, mechanical or other forms.

[0201] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0202] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0203] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a non-volatile computer-readable storage medium that is executable by a processor. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0204] Finally, it should be noted that the above-described embodiments are only specific implementation methods of the present application, which are used to illustrate the technical solutions of the present application, rather than to limit them. The protection scope of the present application is not limited thereto. Although the present application is described in detail with reference to the above-mentioned embodiments, ordinary technicians in the field should understand that any technician familiar with the technical field can still modify the technical solutions recorded in the above-mentioned embodiments within the technical scope disclosed in the present application, or can easily think of changes, or make equivalent replacements for some of the technical features therein; and these modifications, changes or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application, and should be included in the protection scope of the present application. Therefore, the protection scope of the present application shall be based on the protection scope of the claims.

Claims

1. An intelligent early warning and abnormal root cause location solution combining multi-dimensional business indicator data, characterized in that: The intelligent early warning and abnormal root cause location solution includes: Acquire multiple service timing indicators to be detected, cluster the multiple service timing indicators based on the time domain characteristics and frequency domain characteristics of each service timing indicator, and determine the service timing indicators belonging to periodic characteristics and the service timing indicators belonging to non-periodic characteristics; Input the periodic time series features of the business time series indicators with periodic characteristics into a pre-trained deep neural network model to determine the abnormal values ​​of the business time series indicators, and input the non-periodic time series features of the business time series indicators with non-periodic characteristics into a pre-trained long short-term memory model to determine the abnormal values ​​of the business time series indicators; Based on the risk location technology, fault location analysis is performed on the abnormal values ​​of the abnormal business timing indicators and the predicted values ​​corresponding to each abnormal value to determine the fundamental factors affecting the failure of multiple business timing indicators; wherein the predicted values ​​are determined based on the model corresponding to the business timing indicators.

2. The intelligent early warning and abnormal root cause location solution according to claim 1 is characterized in that: The deep neural network model is trained by the following steps: Inputting sample periodic time series features of sample business time series indicators belonging to periodic characteristics into the time series decomposition network layer of the initial deep neural network model, processing the sample periodic time series features, and generating first sample features; Inputting the first sample feature into the feature engineering network layer of the initial deep neural network model, performing wavelet decomposition on the first sample feature to extract wavelet features, performing cosine similarity calculation on the wavelet features and the corresponding historical time series features in the same-chain-month time window to extract correlation features; Inputting the wavelet feature and the correlation feature into the processing network layer of the initial deep neural network model, standardizing the correlation feature and the wavelet feature, and predicting the sample prediction value of the sample period time series based on the standardized correlation feature and the second sample feature; The deep neural network model is obtained by iteratively changing the initial deep neural network model based on the loss value between the sample prediction value and the sample business indicator value of the sample period time series.

3. The intelligent early warning and abnormal root cause location solution according to claim 2 is characterized in that: The following steps are used to determine the sample business timing indicators that belong to periodic characteristics: Eliminate the business indicators corresponding to holidays from the initial business time series indicators, and use the business indicators of the same and month-on-month periods to supplement the eliminated business indicators to determine the supplemented initial business time series indicators; Performing missing value interpolation processing on the supplemented initial business time series indicators to determine the initial business time series indicators after the missing value interpolation processing; The initial business time series indicators after the missing value interpolation processing are subjected to abnormal value interpolation processing to determine the sample business time series indicators.

4. The intelligent early warning and abnormal root cause location solution according to claim 2 is characterized in that: The step of inputting the sample periodic time series features of the sample business time series indicators belonging to the periodic characteristics into the time series decomposition network layer of the initial deep neural network model, processing the sample periodic time series features, and generating the first sample features includes: Performing bilateral filtering on the sample periodic time series features to obtain the periodic time series features after denoising; Performing minimum absolute deviation regression trend analysis on the denoised sample periodic time series characteristics to obtain trend characteristics; The difference feature between the denoised sample periodic time series feature and the trend feature is seasonally decomposed to obtain the first sample feature.

5. The intelligent early warning and abnormal root cause location solution according to claim 1 is characterized in that: The step of inputting the non-periodic time series features of the business time series indicators belonging to the non-periodic characteristics into a pre-trained long short-term memory model to determine the abnormal value of the business time series indicators includes: Inputting the non-periodic time series features into the long short-term memory model, predicting the business indicator value at each time point in the non-periodic time series features, and outputting the predicted value at each time point in the non-periodic time series features; Determine the mean square error between the predicted value at each time point in the non-periodic time series feature and the actual service data value at each time point; If the mean square error is less than a preset threshold, the actual business data value at the time point corresponding to the mean square error is an abnormal value.

6. The intelligent early warning and abnormal root cause location solution according to claim 1 is characterized in that: The risk location technology is used to perform fault location analysis on the abnormal values ​​of the abnormal business timing indicators and the predicted values ​​corresponding to each abnormal value to determine the fundamental factors that affect the failure of multiple business timing indicators, including: Based on the time point corresponding to the abnormal value of the business time series indicator with abnormality and the time window threshold, multiple abnormal values ​​of the business time series indicator are divided into regions to determine multiple abnormal partitions; Taking the abnormal value of the business time series indicator as a sub-node in the abnormal partition, performing weighted deviation calculation and ripple effect processing based on the abnormal value and predicted value of the sub-node, and determining the risk score of each sub-node in each abnormal partition; The subnode corresponding to the highest risk score is regarded as the fundamental factor affecting the failure of the business timing indicator.

7. The intelligent early warning and abnormal root cause location solution according to claim 6 is characterized in that: For each of the abnormal partitions, the abnormal value of the business time series indicator is used as a sub-node in the abnormal partition, and weighted deviation calculation and ripple effect processing are performed based on the abnormal value and predicted value of the sub-node to determine the risk score of each of the sub-nodes in each of the abnormal partitions, including: Based on the abnormal value and predicted value of the child node, the actual business indicator value of the parent node corresponding to the child node and the predicted value of the parent node, determine the influence degree value of the child node on the parent node; wherein the parent node is the dimension for dividing the business time series indicator; For each of the subnodes, the predicted business value of the subnode and the abnormal value of the subnode are calculated based on the weighted deviation calculation formula to determine a first weighted deviation score value of the subnode, and the risk level value of the subnode is determined based on the influence level value of the subnode and the first weighted deviation score value of the subnode; For each of the parent nodes, a second weighted deviation score value between the predicted business indicator value and the abnormal value of all child nodes under the parent node and the weighted deviation score value of the parent node are determined based on the weighted deviation calculation formula, and a ripple effect value of the parent node is determined based on the second weighted deviation score value and the weighted deviation score value of the parent node; Based on the difference between the risk level value of the child node and the ripple effect value of the parent node corresponding to the node, the risk score of each child node under the abnormal partition is determined.

8. An intelligent early warning and abnormal root cause location device combining multi-dimensional business indicator data, characterized in that: The intelligent early warning and abnormal root cause positioning device includes: A division module, used to obtain multiple service timing indicators to be detected, cluster the multiple service timing indicators based on the time domain characteristics and frequency domain characteristics of each service timing indicator, and determine the service timing indicators belonging to periodic characteristics and the service timing indicators belonging to non-periodic characteristics; An anomaly detection module, used for inputting the periodic time series features of the business time series indicators belonging to periodic characteristics into a pre-trained deep neural network model to determine the abnormal value of the business time series indicators, and inputting the non-periodic time series features of the business time series indicators belonging to non-periodic characteristics into a pre-trained long short-term memory model to determine the abnormal value of the business time series indicators; The root cause location module is used to perform fault location analysis on the abnormal values ​​of the abnormal business timing indicators and the predicted values ​​corresponding to each abnormal value based on risk location technology, and determine the fundamental factors affecting the failure of multiple business timing indicators; wherein the predicted values ​​are determined based on the model corresponding to the business timing indicators.

9. An electronic device, characterized in that: include: A processor, a memory and a bus, wherein the memory stores machine-readable instructions executable by the processor. When the electronic device is running, the processor and the memory communicate through the bus. When the processor is running, the machine-readable instructions execute the steps of the intelligent early warning and abnormal root cause location solution combined with multi-dimensional business indicator data as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by the processor, the steps of the intelligent early warning and abnormal root cause location solution combined with multi-dimensional business indicator data as described in any one of claims 1 to 7 are executed.

Images