Abnormal positioning method and device, computer readable storage medium and electronic equipment

Abstract

The invention discloses an anomaly positioning method. The method relates to the field of distributed application, and comprises the following steps: acquiring full-link topological data in an abnormal target application system; updating the full-link topological graph based on a preset time interval and the full-link topological data; performing anomaly detection on the N nodes according to a preset detection sequence based on the full-link topological graph, and determining abnormal nodes; on the basis of a causal detection technology, whether a causal relationship exists between the abnormal node and the abnormal target application system is judged, the reason for the abnormity of the target application system is determined, and the reason for the abnormity comprises one of resource layer abnormity, application class abnormity and database abnormity. By means of the method and device, the problem that in the related technology, the efficiency of locating the cause of the abnormity in a distributed application system is low is solved.

Description

Technical Field

[0001] The present application relates to the field of distributed applications, and in particular, to an abnormality location method, device, computer-readable storage medium, and electronic device. Background Art

[0002] With the rapid development of distributed applications and the increasing complexity of IT architecture, especially the widespread application of cloud-native technologies, the system infrastructure has changed frequently and dynamically. Traditional operation and maintenance monitoring and fault recovery methods can no longer meet the demand for high system availability. Once a critical application fails, it will not only directly affect normal operations, but may also cause economic losses. Therefore, it is crucial to achieve rapid fault location and recovery.

[0003] Existing monitoring and fault recovery systems have obvious deficiencies in handling complex link failures. They are often limited to a single monitoring indicator or a single level of fault detection, and lack the ability to comprehensively analyze the three-dimensional topology of the entire business link. When a failure occurs, operation and maintenance personnel need to manually troubleshoot, from applications, databases, middleware to infrastructure resources, to locate the problem layer by layer. This process is often time-consuming and cannot quickly respond to damage.

[0004] With regard to the problem of slow efficiency in locating the cause of anomalies in distributed application systems in related technologies, no effective solution has been proposed so far. Summary of the invention

[0005] The embodiments of the present invention provide an abnormality location method, device, computer-readable storage medium and electronic device to at least solve the technical problem of low efficiency in locating the cause of abnormality in a distributed application system in the related art.

[0006] In order to achieve the above-mentioned purpose, according to one aspect of the present application, a method for locating an abnormality is provided. The method includes: obtaining the full-link topology data in the target application system with an abnormality, wherein the full-link topology data includes the relationship between N nodes, N is a positive integer greater than 1, and the node represents the fault domain in the full-link topology in the target application system; based on the preset time interval and the full-link topology data, updating the full-link topology map; based on the full-link topology map, in accordance with the preset detection order, performing anomaly detection on N nodes to determine the nodes with abnormalities; based on the causal detection technology, judging whether there is a causal relationship between the abnormal node and the target application system with abnormality, and determining the cause of the abnormality in the target application system, wherein the cause of the abnormality includes one of the following: resource layer abnormality, application class abnormality and database abnormality.

[0007] Optionally, based on the full-link topology diagram, in accordance with a preset detection order, anomaly detection is performed on N nodes to determine the nodes with abnormalities, including: performing anomaly detection on the access layer nodes, combination layer nodes, and component layer nodes among the N nodes in turn; when at least one of the access layer nodes, combination layer nodes, and component layer nodes has an abnormality, continuing to perform anomaly detection on the container-type nodes to determine the nodes with abnormalities.

[0008] Optionally, the method further includes: when the abnormality detection result of the container-type node is that there is no abnormality, determining that the cause of the abnormality is an application-type abnormality.

[0009] Optionally, the method also includes: when the anomaly detection results of the access layer node, the combination layer node and the component layer node are all that there is no anomaly, continuing to perform anomaly detection on the middleware node; when the anomaly detection result of the middleware node is that there is an anomaly, determining that the cause of the anomaly is a middleware anomaly.

[0010] Optionally, when the abnormality detection result of the container class node is that an abnormality exists, based on the causal detection technology, it is judged whether there is a causal relationship between the abnormal node and the target application system with the abnormality, and the cause of the abnormality in the target application system is determined, including: based on the causal detection technology, judging whether there is a causal relationship between the abnormal container class node and the target application system with the abnormality; when there is a causal relationship between the abnormal container class node and the target application system with the abnormality, based on the type of the abnormal container class node, determining the cause of the abnormality in the target application system, wherein the cause of the abnormality includes one of the following: database abnormality and application class abnormality.

[0011] Optionally, the method also includes: when there is no causal relationship between the abnormal container class node and the abnormal target application system, continuing to perform anomaly detection on the resource class node; when the anomaly detection result of the resource class node is that an anomaly exists, determining that the cause of the anomaly is a resource layer anomaly.

[0012] Optionally, anomaly detection is performed on N nodes to determine abnormal nodes, including: inputting the working status data corresponding to each of the N nodes into a target one-dimensional time series anomaly detection model to determine the anomaly detection results corresponding to each of the N nodes, wherein the target one-dimensional time series anomaly detection model is trained based on an initial one-dimensional time series anomaly detection model; and determining the abnormal nodes based on the anomaly detection results corresponding to each of the N nodes.

[0013] Optionally, before obtaining the full-link topology data in the target application system where the abnormality exists, it also includes: obtaining the golden indicators of the target application system, wherein the golden indicators include transaction rate, response time, system success rate and business success rate; based on the golden indicators, judging whether there is an abnormality in the target application system, and obtaining the abnormality detection result of the target application system.

[0014] Optionally, the method corresponding to the causal detection technology is a Granger causal detection method.

[0015] In order to achieve the above-mentioned purpose, according to another aspect of the present application, an abnormality positioning device is provided. The device includes: an acquisition module, which is used to acquire the full-link topology data in the target application system with an abnormality, wherein the full-link topology data includes the relationship between N nodes, N is a positive integer greater than 1, and the node represents the fault domain in the full-link topology in the target application system; an update module, which is used to update the full-link topology map based on a preset time interval and the full-link topology data; a detection module, which is used to perform abnormality detection on N nodes based on the full-link topology map in accordance with a preset detection order to determine the node with an abnormality; a determination module, which is used to determine whether there is a causal relationship between the node with an abnormality and the target application system with an abnormality based on causal detection technology, and determine the cause of the abnormality in the target application system, wherein the cause of the abnormality includes one of the following: resource layer abnormality, application class abnormality and database abnormality.

[0016] Optionally, the detection module includes: a first detection unit and a first determination unit, wherein the first detection unit is used to perform anomaly detection on access layer nodes, combination layer nodes and component layer nodes among the N nodes in turn; and the first determination unit is used to continue to perform anomaly detection on container type nodes to determine the abnormal nodes when at least one of the access layer nodes, combination layer nodes and component layer nodes has an abnormality.

[0017] Optionally, the detection module further includes: a second determination unit, wherein the second determination unit is configured to determine that the cause of the abnormality is an application-type abnormality when the abnormality detection result of the container-type node is that there is no abnormality.

[0018] Optionally, the detection module also includes: a second detection unit and a third determination unit, wherein the second detection unit is used to continue to perform anomaly detection on the middleware node when the anomaly detection results of the access layer node, the combination layer node and the component layer node are all that there is no anomaly; and the third determination unit is used to determine that the cause of the anomaly is a middleware anomaly when the anomaly detection result of the middleware node is that there is an anomaly.

[0019] Optionally, the determination module also includes: a first judgment unit and a fourth determination unit, wherein the first judgment unit is used to determine whether there is a causal relationship between the abnormal container class node and the abnormal target application system based on causal detection technology; the fourth determination unit is used to determine the cause of the abnormality in the target application system based on the type of the abnormal container class node when there is a causal relationship between the abnormal container class node and the abnormal target application system, wherein the cause of the abnormality includes one of the following: database abnormality and application class abnormality.

[0020] Optionally, the determination module also includes: a third detection unit and a fifth determination unit, wherein the third detection unit is used to continue to perform anomaly detection on the resource class nodes when there is no causal relationship between the abnormal container class nodes and the abnormal target application system; and the fifth determination unit is used to determine that the cause of the anomaly is a resource layer anomaly when the anomaly detection result of the resource class node is that an anomaly exists.

[0021] Optionally, the detection module also includes: a sixth determination unit and a seventh determination unit, wherein the sixth determination unit is used to input the working status data corresponding to each of the N nodes into the target one-dimensional time series anomaly detection model to determine the anomaly detection results corresponding to each of the N nodes, wherein the target one-dimensional time series anomaly detection model is trained based on the initial one-dimensional time series anomaly detection model; and the seventh determination unit is used to determine the nodes with abnormalities based on the anomaly detection results corresponding to each of the N nodes.

[0022] Optionally, the device also includes: an acquisition unit and a second judgment unit, wherein the acquisition unit is used to acquire the golden indicators of the target application system, wherein the golden indicators include transaction rate, response time, system success rate and business success rate; the second judgment unit is used to judge whether there is an abnormality in the target application system based on the golden indicators, and obtain the abnormality detection result of the target application system.

[0023] Optionally, the method corresponding to the causal detection technology in the determination module is a Granger causal detection method.

[0024] In an embodiment of the present invention, an anomaly locating method is adopted, by obtaining full-link topology data in a target application system where an anomaly exists, wherein the full-link topology data includes the relationship between N nodes, N is a positive integer greater than 1, and the node represents a fault domain in the full-link topology in the target application system; based on a preset time interval and the full-link topology data, the full-link topology map is updated; based on the full-link topology map, in accordance with a preset detection order, an anomaly detection is performed on N nodes to determine the nodes where an anomaly exists; based on causal detection technology, it is determined whether there is a causal relationship between the node where an anomaly exists and the target application system where an anomaly exists, and the cause of the anomaly in the target application system is determined, wherein the cause of the anomaly includes one of the following: resource layer anomaly, application class anomaly and database anomaly, thereby achieving the purpose of quickly locating the abnormal node and accurately determining the cause of the anomaly, thereby realizing the technical effect of improving the efficiency and accuracy of anomaly detection, and further solving the technical problem of slow efficiency in locating the cause of anomaly in a distributed application system in the related art. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] The drawings constituting a part of the present application are used to provide a further understanding of the present application. The illustrative embodiments and descriptions of the present application are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0026] Figure 1 It is a hardware structure block diagram of a computer terminal for implementing an abnormality locating method;

[0027] Figure 2 is a flow chart of an abnormality locating method provided according to an embodiment of the present application;

[0028] Figure 3 is a schematic diagram of a fault delimitation algorithm provided according to an optional embodiment of the present application;

[0029] Figure 4 It is a schematic diagram of an abnormality location process provided according to an optional embodiment of the present application;

[0030] Figure 5 It is a schematic diagram of the relationship between the score value and the data flow in a SPOT technology provided according to an optional embodiment of the present application;

[0031] Figure 6 is a training diagram of a SPOT model provided according to an optional embodiment of the present application;

[0032] Figure 7 It is a flowchart of a fault demarcation solution based on an abnormality location method provided according to an optional embodiment of the present application;

[0033] Figure 8 is a schematic diagram of an abnormality locating device provided according to an embodiment of the present application;

[0034] Fig. 9 It is a structural block diagram of an electronic device provided according to an embodiment of the present application. DETAILED DESCRIPTION

[0035] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0036] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0037] First, some nouns or terms that appear in the description of the embodiments of the present application are subject to the following explanations:

[0038] In IT system architecture and operation and maintenance management, a topology diagram is a graphical model used to describe the connection relationship between system components. It can help operation and maintenance and technical personnel understand the system's architectural layout and the dependencies between various resources, thereby providing key support in fault detection, performance analysis, capacity planning, and security policy implementation.

[0039] Causal detection technology is a data analysis method used to identify the causal relationship between two or more variables, that is, to determine whether and how one variable (or a combination of multiple variables) affects another variable.

[0040] Graph search technology,Graph search technology is a set of algorithms for finding specific paths or nodes in a graph data structure. It is mainly used to solve various problems on the graph, such as the shortest path, connectivity analysis, network flow, matching problems, resource allocation, etc.

[0041] SPOT technology, the full name of which is "Sequential Probability-based Outlier Detection", is an advanced algorithm for real-time anomaly detection. SPOT technology is mainly used to process time series data. It can dynamically detect anomalies in the data and automatically adjust the threshold of anomaly detection through extreme value theory and maximum likelihood estimation to adapt to the natural fluctuation of data over time, avoiding the limitations of traditional fixed threshold methods when processing dynamic data.

[0042] DFS algorithm, short for Depth-First Search, is an algorithm used to traverse or search a tree or graph data structure. The DFS algorithm starts from the root node and searches the branches of the tree as deeply as possible. When the branch where the node is located has reached the bottom, the algorithm will backtrack to the previous node and continue to explore other unvisited branches until all nodes have been visited.

[0043] It should be noted that the collected information (including but not limited to application operation information, etc.) and data (including but not limited to data for display, data for analysis, etc.) involved in this application are information and data authorized by the system or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of relevant data are in compliance with relevant laws, regulations and standards, necessary confidentiality measures are taken, and public order and good customs are not violated, and corresponding operation entrances are provided for choosing authorization or refusal. For example, an interface is set up between this system and related applications or institutions, providing corresponding operation entrances, and you can choose to agree or reject the automated decision results; if you choose to reject, you will enter the expert decision-making process.

[0044] Example 1

[0045] According to an embodiment of the present application, an embodiment of an abnormality locating method is also provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0046] The method embodiment provided in the first embodiment of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Figure 1 The hardware structure block diagram of a computer terminal used to implement the abnormality positioning method is shown in FIG. Figure 1As shown, the computer terminal 10 (or mobile device) may include one or more (102a, 102b, ..., 102n are used to illustrate) processors 102 (the processor 102 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 104 for storing data, and a transmission device 106 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the BUS bus), a network interface, a power supply and / or a camera. It can be understood by those skilled in the art that Figure 1 The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations are shown.

[0047] It should be noted that the one or more processors 102 and / or other data processing circuits described above may generally be referred to herein as "data processing circuits". The data processing circuits may be embodied in whole or in part as software, hardware, firmware, or any other combination thereof. In addition, the data processing circuit may be a single independent processing module, or may be incorporated in whole or in part into any of the other components in the computer terminal 10 (or mobile device). As described in the embodiments of the present application, the data processing circuit acts as a processor control (e.g., selection of a variable resistor terminal path connected to an interface).

[0048] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the abnormality location method in the embodiment of the present application. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, that is, the above-mentioned abnormality location method is realized. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 104 may further include a memory remotely arranged relative to the processor 102, and these remote memories may be connected to the computer terminal 10 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof.

[0049] The transmission device 106 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the computer terminal 10. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 can be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0050] The display may be, for example, a touch screen liquid crystal display (LCD) that enables a user to interact with a user interface of the computer terminal 10 (or mobile device).

[0051] Under the above operating environment, this application provides Figure 2 The anomaly location method shown. Figure 2 It is a flowchart of an abnormality locating method provided according to an embodiment of the present application.

[0052] Step S201, obtain the full-link topology data in the target application system with the abnormality, wherein the full-link topology data includes the relationship between N nodes, N is a positive integer greater than 1, and the node represents the fault domain in the full-link topology in the target application system.

[0053] In this step, the full-link topology data includes N nodes and the relationship between N nodes. The nodes of the full-link topology cover all levels and resources of the application, including but not limited to application groups, SETs, containers, virtual machines, physical machines, middleware (such as NOS / DMQS), databases, host groups, availability zones (AZs), regions, etc. Table 1 is a data structure definition table of nodes. As shown in Table 1, each node (Node) is an object that may fail and has monitoring indicators or alarms, representing a fault domain in the full-link three-dimensional topology, which means that when the system is abnormal, these nodes may be the source of the problem.

[0054]

[0055]

[0056] Table 1 Node data structure definition table

[0057] The relationship between N nodes can be represented as an edge in the topology data, including: depends_on, including, runs_on, calls_on and other relationships, where depends_on represents the dependency of one node on another node, which is commonly seen between the application layer and the database layer, or between the middleware and the application; including represents the inclusion relationship at the group level, such as an application group includes multiple services (Set), or a service contains multiple instances (Pod); runs_on represents the relationship between a container or service running on a certain resource, such as a container running on a virtual machine, and a virtual machine running on a physical machine; calls_on represents the calling relationship between applications or services, which is used to describe the direction of business data flow.

[0058] Table 2 is a data structure definition table of an edge. As shown in Table 2, the attributes of an edge include attributes such as relationship type and weight.

[0059]

[0060] Table 2 Edge data structure definition table

[0061] The full-link topology data is stored in the graph database to support fast query and update. For nodes that do not change frequently, such as groups, host groups, availability zones, regions, etc., they can be refreshed regularly (such as once a day) according to actual conditions, while for nodes with high dynamic changes, such as containers, a minute-level update mechanism can be implemented.

[0062] Step S202: Update the full-link topology map based on the preset time interval and the full-link topology data.

[0063] In this step, the full-link topology data includes all key nodes in the target application system (such as applications, services, containers, virtual machines, physical machines, databases, middleware, etc.) and the relationships between them (such as call relationships, dependencies, and running relationships). These data reflect the real-time status and architectural layout of the system and are the basis for fault detection and demarcation. Among them, the middleware class node is treated as an independent node, and the lower-level nodes / Sets are no longer divided. The dependency relationship of the application group node is built on the topology map, and may also include DSF / SLB according to the fault domain requirements. Dependencies may include dependencies between the access layer and the combination layer, the combination layer and the component layer, the application group and the middleware, etc. The call relationship may include the call relationship of the business traffic between Pods, and the running relationship may include the running relationship between the container and the VM, the VM and the PM, and the container and the bare metal.

[0064] The time interval for updating the full-link topology map can be set according to the dynamic characteristics of the node. In order to achieve the requirement of "1 minute discovery, 5 minutes delimitation, and 10 minutes recovery", a full-scale construction can be performed at a time interval of minutes, that is, each node and edge in the full-link topology data is obtained at the minute level to update the full-link topology map. In addition, an aging mechanism can also be considered. For example, a topology map that is greater than 1 month (configurable) can be marked as an aging state to reduce subsequent processing and storage overhead. The advantage of this embodiment is that the topology map is updated almost in real time. Under the premise of accurate source data, the algorithm logic is simple, and the final effect can be guaranteed to the greatest extent. However, the amount of data is large and the storage space requirement is high.

[0065] In addition, this embodiment also proposes an update method in which static topology is constructed on a daily basis and dynamic topology is constructed on a minute basis. Specifically, static topology refers to parts that do not change frequently, such as groups and group relationships, IaaS layer nodes and relationships, etc., and dynamic topology refers to container nodes managed by K8S, etc., which may be dynamically expanded or reduced according to business needs. Static topology can be updated once a day, and dynamic data is updated every minute. The advantage of this solution is that the amount of topology data is small and the storage space requirement is low. The disadvantage is that if the nodes and relationships in the static topology change temporarily, the topology map is not refreshed in real time, and the target requirements may not be met, because when a failure occurs, it is likely that part of the static topology map has also changed.

[0066] Step S203: Based on the full-link topology graph, perform anomaly detection on N nodes in a preset detection order to determine the nodes with abnormalities.

[0067] In this step, anomaly detection can be performed based on the life and death indicator data of N nodes, and the training data can be fitted using multi-indicator reconstruction technology to learn the normal mode of multi-indicator data. Then, the threshold of the anomaly score can be dynamically determined by using the SPOT technology, and the judgment of whether a fault has occurred is obtained based on the comparison result of the anomaly score and the anomaly threshold. Among them, the life and death indicator data is time series data.

[0068] In addition, for nodes in the topology diagram that cannot provide indicator data, if they contain alarm data, they can also participate in the root cause derivation as the health status of the node. At this time, they no longer participate in the causal detection of the root cause derivation process, and a positive causal relationship exists by default.

[0069] Step S204, based on causal detection technology, determine whether there is a causal relationship between the abnormal node and the target application system with the abnormality, and determine the cause of the abnormality in the target application system, where the cause of the abnormality includes one of the following: resource layer abnormality, application class abnormality and database abnormality.

[0070] In this step, based on the causal detection technology, the causal relationship between abnormal nodes can be calculated, and then combined with the graph search technology, the fault list, propagation path and fault impact range can be output to finally determine the cause of the abnormality in the target application system. Among them, the causal detection technology is used to analyze whether the anomalies between different nodes have direct or indirect causal relationships. In IT operation and maintenance scenarios, this usually involves the analysis of time series data to determine whether the anomaly of a resource or component has caused the failure of the target application system. Common causal detection techniques include but are not limited to time series correlation analysis (such as Pearson correlation coefficient), Granger causality test, and more complex machine learning models (such as LSTM-based recurrent neural networks). Figure 3 is a schematic diagram of a fault delimitation algorithm provided according to an optional embodiment of the present application, such as Figure 3 As shown in the figure, through the above process, the causal relationship between the abnormal node and the target application system can be accurately determined based on the causal detection technology, and then the cause of the fault can be accurately demarcated and a recovery strategy can be quickly generated to meet the production requirements of "1 minute discovery, 5 minutes demarcation, and 10 minutes recovery". This can greatly improve the accuracy and efficiency of fault diagnosis and provide strong support for rapid response and resolution of production problems.

[0071] Optionally, in the anomaly locating method provided in the embodiment of the present application, based on the full-link topology map, in accordance with a preset detection order, anomaly detection is performed on N nodes to determine the nodes with abnormalities, including: performing anomaly detection on the access layer nodes, combination layer nodes, and component layer nodes among the N nodes in turn; when at least one of the access layer nodes, combination layer nodes, and component layer nodes has an abnormality, continuing to perform anomaly detection on the container-type nodes to determine the nodes with abnormalities.

[0072] Figure 4 is a schematic diagram of an abnormality location process provided according to an optional embodiment of the present application, such as Figure 4As shown in the figure, by inputting the full-link topology diagram, application golden indicators, and other node life and death indicators, the output can include three categories of application anomalies, database anomalies, and resource anomalies, as well as the corresponding subcategories and propagation paths of the anomalies; in addition, if the above three categories of anomalies do not exist, the possible anomalies of the middleware nodes can also be output based on the anomaly detection results of the middleware. Access layer nodes usually include front-end services, gateways, or load balancers, etc., which are the first contact point for user requests to enter the system. First, detect the anomalies of the access layer nodes, such as response time delays, increased request failure rates, etc., to quickly locate whether there are problems at the entrance. The combination layer nodes involve middle-layer services for business logic processing, such as microservices, API gateways, etc. After confirming that there are no anomalies in the access layer or the previous round of detection, you can shift your attention to the combination layer and detect the performance indicators of these nodes, such as CPU usage, memory consumption, etc., to determine whether the problem originates from the processing logic. Component layer nodes represent lower-level system components, such as databases, message queues, cache services, etc. If the detection of the access layer and the combination layer does not find anomalies, it will go deep into the component layer for detection to determine whether there are problems with the data storage or data processing components. When it is confirmed that at least one node in the access layer, combination layer, and component layer is abnormal, the container node can be detected for abnormalities. As an important part of the application architecture, the state of the container is directly related to the operation of the application. By detecting the resource usage and health status of the container, the specific location of the problem can be further located. Through the layered detection mechanism, the non-abnormal layer can be quickly excluded, and the detection scope can be narrowed to the level where the problem is located, which significantly improves the speed of fault location. The top-down detection process helps to accurately define the abnormality and determine whether it is caused by insufficient container resources, application logic problems, or failures in external services (such as databases), providing more accurate guidance for subsequent fault recovery.

[0073] Optionally, in the anomaly locating method provided in the embodiment of the present application, when the anomaly detection result of the container-type node is that there is no anomaly, it is determined that the cause of the anomaly is an application-type anomaly.

[0074] like Figure 4 As shown in the figure, when the abnormality detection result of the container node is that there is no abnormality, and the upper layer detection (such as the access layer, combination layer, and component layer) has confirmed the existence of the fault, it can be further inferred that the cause of the fault is an application-related abnormality caused by the application's own logical errors, configuration problems, code defects, etc. This is because, after excluding the problems of the underlying resources and the health status of the container, the most likely cause points to the application layer. By systematically eliminating the problems of container nodes, the cause of the abnormality can be more accurately located at the application layer, reducing the uncertainty in fault diagnosis and improving the efficiency and accuracy of abnormality location.

[0075] Optionally, in the anomaly locating method provided in the embodiment of the present application, when the anomaly detection results of the access layer node, the combination layer node and the component layer node are all that there is no anomaly, the middleware node continues to be detected for anomaly; when the anomaly detection result of the middleware node is that there is an anomaly, it is determined that the cause of the anomaly is a middleware anomaly.

[0076] like Figure 4 As shown in the figure, after confirming that there are no abnormalities in the access layer, combination layer, and component layer, the middleware nodes can be tested. Middleware nodes include NOS (Network-Attached Storage), DMQS (Distributed Message Queue System), etc., which provide key services such as communication and data storage between applications. Through layered detection, possible fault points can be fully checked. Even if no abnormalities are found at the higher level, the middleware level can be further checked to ensure the comprehensiveness and accuracy of fault diagnosis. When the detection results at the higher level are all normal, abnormal detection of the middleware node can accurately locate the fault to the middleware layer, avoiding blind troubleshooting at all levels and improving the efficiency of fault location.

[0077] Optionally, in the anomaly locating method provided in the embodiment of the present application, when the anomaly detection result of the container class node is that an anomaly exists, based on the causal detection technology, it is judged whether there is a causal relationship between the node with the anomaly and the target application system with the anomaly, and the cause of the anomaly in the target application system is determined, including: based on the causal detection technology, it is judged whether there is a causal relationship between the container class node with the anomaly and the target application system with the anomaly; when there is a causal relationship between the container class node with the anomaly and the target application system with the anomaly, based on the type of the container class node with the anomaly, the cause of the anomaly in the target application system is determined, wherein the cause of the anomaly includes one of the following: database anomaly and application class anomaly.

[0078] like Figure 4 As shown in the figure, after confirming that both the container node and the target application system are abnormal, causal detection technology (such as Pearson correlation analysis, Granger causality test or more advanced machine learning models) can be used to determine whether there is a causal relationship between the two anomalies. The analysis is mainly based on time series data, and by observing whether the indicator changes of the abnormal node are ahead of the abnormal performance of the target application system, it is possible to infer whether there is a causal relationship.

[0079] If the causal relationship analysis shows that the abnormality of the container node directly affects the performance of the target application system, the specific cause of the abnormality can be further determined based on the type of container. If the container carries a database service, and its abnormality is manifested as data read and write delays, abnormal number of connections, etc., then it can be determined that the abnormality of the target application system is caused by a database problem. If the container carries an application service, its abnormality may be manifested as a code bug, logical error, improper configuration, etc., then it can be inferred that the abnormality of the target application system is caused by a problem with the application service itself. Through the use of causal detection technology, it is possible to more accurately determine whether the abnormality of the container node directly causes the failure of the target application system, avoid misdiagnosis and missed diagnosis, and improve the accuracy of fault location.

[0080] Optionally, in the anomaly location method provided in the embodiment of the present application, when there is no causal relationship between the abnormal container class node and the abnormal target application system, the resource class node continues to be detected for anomalies; when the anomaly detection result of the resource class node is that an anomaly exists, it is determined that the cause of the anomaly is a resource layer anomaly.

[0081] like Figure 4 As shown in the figure, if the analysis based on causal detection technology (such as Pearson correlation analysis, Granger causality test, etc.) confirms that there is no direct causal relationship between the abnormal container node and the abnormality of the target application system, it means that the abnormality of the container is not the direct cause of the failure of the target application system. Subsequently, the abnormality detection of resource nodes can be performed. Resource nodes include but are not limited to virtual machines (VMs), physical machines (PMs), computing nodes, bare metal servers, etc., which provide computing, storage and network resources for containers and applications. After excluding the direct causal relationship between containers and applications, the detection of resource nodes helps to further locate the source of the fault and determine whether it is a problem at the resource layer. This step-by-step troubleshooting strategy improves the accuracy of fault location and reduces misdiagnosis and unnecessary troubleshooting.

[0082] Optionally, in the anomaly location method provided in the embodiment of the present application, anomaly detection is performed on N nodes to determine the nodes with abnormalities, including: inputting the working status data corresponding to each of the N nodes into a target one-dimensional time series anomaly detection model to determine the anomaly detection results corresponding to each of the N nodes, wherein the target one-dimensional time series anomaly detection model is trained based on an initial one-dimensional time series anomaly detection model; and determining the nodes with abnormalities based on the anomaly detection results corresponding to each of the N nodes.

[0083] In order to detect system failures, outliers can usually be determined by setting a threshold for the anomaly score, and data that exceeds the threshold range is determined to be an outlier. In traditional methods, professional technicians usually set a fixed threshold based on relevant experience. However, in actual production environments, the various indicators of a system often change dynamically, and there will be overall fluctuations of rising or falling. Therefore, manually setting the threshold is not advisable, and a model for automatically learning the threshold is needed. Therefore, the SPOT model is adopted, and the extreme value theory is used to dynamically adjust the threshold to complete the fault discovery. The two theoretical supports of SPOT are extreme value theory (EVT) and maximum likelihood estimation. Figure 5 is a schematic diagram of the relationship between the score value and the data flow in a SPOT technology provided according to an optional embodiment of the present application, Figure 6 1 is a training diagram of a SPOT model provided according to an optional embodiment of the present application. As shown in the figure, the SPOT model mainly includes two sets that need to be dynamically maintained (peak set Y, anomaly set A) and five parameters that need to be dynamically adjusted (peak number N t , number of observation points k, anomaly threshold z q , ). You can manually set the expected normal value probability q and select the first n data to initialize the model parameters (peak threshold t, anomaly threshold z q and the number of observation points k). The observation value X input after initialization t Successively with z q Compared with t, it is higher than z q The value of is added to the exception set A; q But the values ​​higher than t are added to the peak set Y, and the peak number N t And the number of observation points k plus 1, and then use the new peak set Y to update Then combine q, k,N t , t calculates the new anomaly threshold z q ; If the value is lower than the peak threshold t, only the number of observation points k is updated. By using SPOT technology, the threshold of the anomaly score can be dynamically determined, and the judgment of whether a fault occurs is obtained based on the comparison result between the anomaly score and the anomaly threshold.

[0084] Optionally, in the anomaly location method provided in the embodiment of the present application, before obtaining the full-link topology data in the target application system where the anomaly exists, it also includes: obtaining the golden indicators of the target application system, wherein the golden indicators include transaction rate, response time, system success rate and business success rate; based on the golden indicators, judging whether there is an anomaly in the target application system, and obtaining the anomaly detection result of the target application system.

[0085] Golden indicators are key indicators that can directly reflect the core health status and business performance of the application system. Table 3 is a schematic table of optional application golden indicators. As shown in Table 3, golden indicators may include: transaction rate, the number of transactions processed by the system per unit time, reflecting the system load and business activity; response time, the time required for the system to process a request and return a response, reflecting the processing speed and efficiency of the system; system success rate, the proportion of requests successfully processed by the system, reflecting the stability and reliability of the system; business success rate, the proportion of transactions successfully processed at the business logic level, reflecting the correctness and efficiency of the business process.

[0086] Classification name type frequency meaning APP Transaction Rate Gauge 5s Transaction Rate APP Response time Gauge 5s Response time APP System success rate Gauge 5s System success rate APP Business success rate Gauge 5s Business success rate

[0087] Table 3 Schematic diagram of an optional application of golden indicators

[0088] Through real-time monitoring and data analysis, these indicator values ​​are collected regularly (for example, every 5 seconds), stored and analyzed to provide data support for subsequent anomaly detection. These indicators are usually obtained through application logs, performance monitoring tools or special monitoring systems. The obtained golden indicator data is input into the SPOT model to determine whether there are anomalies in the target application system.

[0089] Optionally, in the anomaly location method provided in the embodiment of the present application, the method corresponding to the causal detection technology is a Granger causality detection method.

[0090] Common causal detection methods include time series data correlation analysis and Granger causality test. The effects of different specific methods can be verified according to actual scenario tests. In this embodiment, the Granger causality detection method can be selected. Granger causality test is a statistical hypothesis test. Causality can be tested by measuring the predictive ability of an earlier sequence on the future value of another lagged time series. Fault detection can be performed on each node on the topology map first, and then causal detection can be performed on the node where the fault is found. The node with causal relationship may be the root cause of the application failure. In addition, time series data correlation analysis can be used. The time series correlation can use the Pearson algorithm. The Pearson algorithm can measure how two continuous signals change together over time, and can express the linear relationship between them with the numbers -1 (negative correlation), 0 (irrelevant) and 1 (completely correlated). Granger causality detection can quickly screen out nodes related to the fault, reduce the in-depth analysis of irrelevant nodes, thereby improving the efficiency of abnormal location and helping to achieve the goal of rapid recovery.

[0091] As an optional embodiment, a fault demarcation solution based on an anomaly location method is also provided. Figure 7is a flow chart of a fault demarcation solution based on an abnormality location method provided according to an optional embodiment of the present application, such as Figure 7 As shown, the overall process of the program is as follows:

[0092] S1: Anomaly detection is performed based on the multi-dimensional life and death indicator data of each node. The multi-indicator reconstruction technology is used to fit the training data, and the normal pattern of the multi-indicator data is learned. Then, the threshold of the anomaly score is dynamically determined by using the SPOT technology. The judgment of whether a fault has occurred is obtained based on the comparison result of the anomaly score and the anomaly threshold.

[0093] S2: Based on the full-link topology data, a full-link topology graph is constructed in real time and stored in the graph database.

[0094] S3: Based on causal detection technology, the causal relationship between abnormal nodes is calculated, and then combined with graph search technology, the fault list, propagation path and fault impact range are output.

[0095] The anomaly locating method provided in the embodiment of the present application obtains the full-link topology data in the target application system where the anomaly exists, wherein the full-link topology data includes the relationship between N nodes, N is a positive integer greater than 1, and the node represents the fault domain in the full-link topology in the target application system; based on the preset time interval and the full-link topology data, the full-link topology map is updated; based on the full-link topology map, according to the preset detection order, the N nodes are detected for anomalies to determine the nodes where the anomalies exist; based on the causal detection technology, it is determined whether there is a causal relationship between the nodes where the anomalies exist and the target application system where the anomalies exist, and the cause of the anomaly in the target application system is determined, wherein the cause of the anomaly includes one of the following: resource layer anomaly, application class anomaly and database anomaly, which solves the technical problem of slow efficiency in locating the cause of the anomaly in the distributed application system in the related technology, thereby achieving the effect of improving the efficiency and accuracy of anomaly detection.

[0096] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0097] Example 2

[0098] The embodiment of the present application also provides an abnormality locating device. It should be noted that the abnormality locating device of the embodiment of the present application can be used to execute the abnormality locating method provided by the embodiment of the present application. The abnormality locating device provided by the embodiment of the present application is introduced below.

[0099] According to an embodiment of the present application, a device for implementing the above-mentioned abnormality locating method is also provided. Figure 8 is a schematic diagram of an abnormality locating device provided according to an embodiment of the present application, such as Figure 8 As shown, the device comprises:

[0100] The acquisition module 81 is used to obtain the full-link topology data in the target application system with an abnormality, wherein the full-link topology data includes the relationship between N nodes, N is a positive integer greater than 1, and the node represents the fault domain in the full-link topology in the target application system.

[0101] The updating module 82 is connected to the acquiring module 81 and is used to update the full-link topology map based on a preset time interval and the full-link topology data.

[0102] The detection module 83 is connected to the update module 82, and is used to perform anomaly detection on N nodes based on the full-link topology diagram and in a preset detection order to determine the nodes with abnormalities.

[0103] The determination module 84 is connected to the detection module 83, and is used to determine whether there is a causal relationship between the abnormal node and the abnormal target application system based on the causal detection technology, and determine the cause of the abnormality in the target application system, wherein the cause of the abnormality includes one of the following: resource layer abnormality, application class abnormality and database abnormality.

[0104] The abnormality locating device provided in the embodiment of the present application is used to obtain the full-link topology data in the target application system with the abnormality through the acquisition module 81, wherein the full-link topology data includes the relationship between N nodes, N is a positive integer greater than 1, and the node represents the fault domain in the full-link topology in the target application system; the update module 82 is used to update the full-link topology map based on the preset time interval and the full-link topology data; the detection module 83 is used to perform abnormality detection on N nodes according to the preset detection order based on the full-link topology map, and determine the abnormal nodes; the determination module 84 is used to determine whether there is a causal relationship between the abnormal node and the target application system with the abnormality based on the causal detection technology, and determine the reason for the abnormality in the target application system, wherein the reason for the abnormality includes one of the following: resource layer abnormality, application class abnormality and database abnormality, which solves the technical problem of slow efficiency in locating the cause of the abnormality in the distributed application system in the related technology, thereby achieving the effect of improving the efficiency and accuracy of abnormality detection.

[0105] Optionally, in the anomaly locating device provided in the embodiment of the present application, the detection module 83 includes: a first detection unit and a first determination unit, wherein the first detection unit is used to perform anomaly detection on the access layer nodes, combination layer nodes and component layer nodes among the N nodes in turn; the first determination unit is used to continue to perform anomaly detection on the container-type nodes to determine the nodes with abnormalities when at least one of the access layer nodes, combination layer nodes and component layer nodes has an abnormality.

[0106] Optionally, in the anomaly locating device provided in the embodiment of the present application, the detection module 83 further includes: a second determination unit, wherein the second determination unit is used to determine that the cause of the anomaly is an application-type anomaly when the anomaly detection result of the container-type node is that there is no anomaly.

[0107] Optionally, in the anomaly locating device provided in the embodiment of the present application, the detection module 83 also includes: a second detection unit and a third determination unit, wherein the second detection unit is used to continue to perform anomaly detection on the middleware node when the anomaly detection results of the access layer node, the combination layer node and the component layer node are all that there is no anomaly; the third determination unit is used to determine that the cause of the anomaly is a middleware anomaly when the anomaly detection result of the middleware node is that there is an anomaly.

[0108] Optionally, in the anomaly locating device provided in the embodiment of the present application, the determination module 84 also includes: a first judgment unit and a fourth determination unit, wherein the first judgment unit is used to determine whether there is a causal relationship between the abnormal container class node and the abnormal target application system based on the causal detection technology; the fourth determination unit is used to determine the cause of the abnormality in the target application system based on the type of the abnormal container class node when there is a causal relationship between the abnormal container class node and the abnormal target application system, wherein the cause of the abnormality includes one of the following: database abnormality and application class abnormality.

[0109] Optionally, in the anomaly locating device provided in the embodiment of the present application, the determination module 84 also includes: a third detection unit and a fifth determination unit, wherein the third detection unit is used to continue to perform anomaly detection on the resource class node when there is no causal relationship between the abnormal container class node and the abnormal target application system; the fifth determination unit is used to determine that the cause of the anomaly is a resource layer anomaly when the anomaly detection result of the resource class node is that an anomaly exists.

[0110] Optionally, in the anomaly locating device provided in the embodiment of the present application, the detection module 83 also includes: a sixth determination unit and a seventh determination unit, wherein the sixth determination unit is used to input the working status data corresponding to each of the N nodes into the target one-dimensional time series anomaly detection model, and determine the anomaly detection results corresponding to each of the N nodes, wherein the target one-dimensional time series anomaly detection model is trained based on the initial one-dimensional time series anomaly detection model; the seventh determination unit is used to determine the nodes with abnormalities based on the anomaly detection results corresponding to each of the N nodes.

[0111] Optionally, in the anomaly locating device provided in the embodiment of the present application, the device also includes: an acquisition unit and a second judgment unit, wherein the acquisition unit is used to acquire the golden indicators of the target application system, wherein the golden indicators include transaction rate, response time, system success rate and business success rate; the second judgment unit is used to judge whether there is an anomaly in the target application system based on the golden indicators, and obtain the anomaly detection result of the target application system.

[0112] Optionally, in the anomaly locating device provided in the embodiment of the present application, the method corresponding to the causal detection technology in the determination module 84 is a Granger causal detection method.

[0113] It should be noted that the acquisition module 81, update module 82, detection module 83 and determination module 84 correspond to steps S201 to S204 in Example 1, and the two modules and the corresponding steps implement the same examples and application scenarios, but are not limited to the contents disclosed in the above-mentioned Example 1. It should be noted that the above-mentioned modules or units can be hardware components or software components stored in a memory (e.g., memory 104) and processed by one or more processors (e.g., processors 102a, 102b, ..., 102n), and the above-mentioned modules can also be run in the computer terminal 10 provided in Example 1 as part of the device.

[0114] Example 3

[0115] An embodiment of the present application may provide an electronic device, Fig. 9 is a structural block diagram of an electronic device provided according to an embodiment of the present application. Fig. 9 As shown, the electronic device may include: one or more ( Fig. 9 (only one is shown) processor 902, memory 904, storage controller, and peripheral interface, wherein the peripheral interface is connected to the radio frequency module, audio module and display.

[0116] Among them, the memory can be used to store software programs and modules, such as program instructions / modules corresponding to the methods and devices in the embodiments of the present application, and the processor executes various functional applications and data processing by running the software programs and modules stored in the memory, that is, realizing the above-mentioned method. The memory may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory may further include a memory remotely arranged relative to the processor, and these remote memories may be connected to the terminal via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0117] The processor can call the information and application programs stored in the memory through the transmission device to perform the following steps: obtain the full-link topology data in the target application system with the abnormality, wherein the full-link topology data includes the relationship between N nodes, N is a positive integer greater than 1, and the node represents the fault domain in the full-link topology in the target application system; based on the preset time interval and the full-link topology data, update the full-link topology map; based on the full-link topology map, perform anomaly detection on N nodes in a preset detection order to determine the nodes with abnormalities; based on the causal detection technology, determine whether there is a causal relationship between the nodes with abnormalities and the target application system with abnormalities, and determine the cause of the abnormality in the target application system, wherein the cause of the abnormality includes one of the following: resource layer abnormality, application class abnormality and database abnormality.

[0118] The processor can also call the information and application programs stored in the memory through the transmission device to perform the following steps: based on the full-link topology map, according to the preset detection order, perform abnormality detection on N nodes to determine the nodes with abnormalities, including: sequentially perform abnormality detection on the access layer nodes, combination layer nodes and component layer nodes among the N nodes; when at least one of the access layer nodes, combination layer nodes and component layer nodes has an abnormality, continue to perform abnormality detection on the container-type nodes to determine the nodes with abnormalities.

[0119] The processor may also call the information and application program stored in the memory through the transmission device to perform the following steps: when the abnormality detection result of the container node is that there is no abnormality, determine that the cause of the abnormality is an application abnormality.

[0120] The processor can also call the information and application programs stored in the memory through the transmission device to perform the following steps: when the abnormality detection results of the access layer node, the combination layer node and the component layer node are all that there is no abnormality, continue to perform abnormality detection on the middleware node; when the abnormality detection result of the middleware node is that there is an abnormality, determine that the cause of the abnormality is a middleware abnormality.

[0121] The processor can also call the information and application programs stored in the memory through the transmission device to perform the following steps: when the abnormality detection result of the container-type node is that an abnormality exists, based on the causal detection technology, determine whether there is a causal relationship between the abnormal node and the target application system with the abnormality, and determine the cause of the abnormality in the target application system, including: based on the causal detection technology, determine whether there is a causal relationship between the abnormal container-type node and the target application system with the abnormality; when there is a causal relationship between the abnormal container-type node and the target application system with the abnormality, determine the cause of the abnormality in the target application system based on the type of the abnormal container-type node, wherein the cause of the abnormality includes one of the following: database abnormality and application class abnormality.

[0122] The processor can also call the information and application programs stored in the memory through the transmission device to perform the following steps: when there is no causal relationship between the abnormal container node and the abnormal target application system, continue to perform abnormality detection on the resource node; when the abnormality detection result of the resource node is that an abnormality exists, determine that the cause of the abnormality is a resource layer abnormality.

[0123] The processor can also call the information and application programs stored in the memory through the transmission device to perform the following steps: perform anomaly detection on N nodes to determine the nodes with abnormalities, including: inputting the working status data corresponding to each of the N nodes into the target one-dimensional time series anomaly detection model to determine the anomaly detection results corresponding to each of the N nodes, wherein the target one-dimensional time series anomaly detection model is trained based on the initial one-dimensional time series anomaly detection model; based on the anomaly detection results corresponding to each of the N nodes, determine the nodes with abnormalities.

[0124] The processor can also call the information and application programs stored in the memory through the transmission device to perform the following steps: before obtaining the full-link topology data in the target application system with an abnormality, it also includes: obtaining the golden indicators of the target application system, wherein the golden indicators include transaction rate, response time, system success rate and business success rate; based on the golden indicators, determine whether the target application system has an abnormality, and obtain the abnormality detection result of the target application system.

[0125] The processor can also call the information and application programs stored in the memory through the transmission device to perform the following steps: The method corresponding to the causal detection technology is the Granger causal detection method.

[0126] By adopting the embodiment of the present application, a method for locating anomalies is provided. By obtaining the full-link topology data in the target application system with anomalies, wherein the full-link topology data includes the relationship between N nodes, N is a positive integer greater than 1, and the node represents the fault domain in the full-link topology in the target application system; based on the preset time interval and the full-link topology data, the full-link topology map is updated; based on the full-link topology map, according to the preset detection order, the N nodes are detected for anomalies to determine the nodes with anomalies; based on the causal detection technology, it is determined whether there is a causal relationship between the node with anomalies and the target application system with anomalies, and the cause of the abnormality in the target application system is determined, wherein the cause of the abnormality includes one of the following: resource layer abnormality, application class abnormality and database abnormality, which solves the technical problem of slow efficiency in locating the cause of abnormality in the distributed application system in the related technology, thereby achieving the effect of improving the efficiency and accuracy of anomaly detection.

[0127] It can be understood by those skilled in the art that Fig. 9 The structure shown is for illustration only, and the electronic device may also be a smart phone (such as an Android phone, an iOS phone, etc.), a tablet computer, a PDA, a mobile Internet device (Mobile Internet Devices, MID), a PAD, and other terminal devices. Fig. 9 The structure of the electronic device is not limited. Fig. 9 More or fewer components (such as network interfaces, display devices, etc.) shown in, or having Fig. 9 Different configurations are shown.

[0128] A person of ordinary skill in the art can understand that all or part of the steps in the various methods of the above embodiments can be completed by instructing the hardware related to the terminal device through a program, and the program can be stored in a computer-readable storage medium, and the storage medium may include: a flash drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0129] Example 4

[0130] The embodiment of the present application further provides a storage medium. Optionally, in this embodiment, the storage medium can be used to store the program code executed by the abnormality location method provided in the first embodiment.

[0131] Optionally, in this embodiment, the above storage medium may be located in any computer terminal in a computer terminal group in a computer network, or in any mobile terminal in a mobile terminal group.

[0132] The present application also provides a computer program product, which, when executed on a data processing device, is suitable for executing the steps of the anomaly locating method.

[0133] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0134] In the above embodiments of the present application, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0135] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0136] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0137] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0138] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, in essence, or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, disk or optical disk and other media that can store program codes.

[0139] The above is only a preferred implementation of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A method for locating an abnormality, characterized in that: include: Acquire full-link topology data in the target application system with the abnormality, wherein the full-link topology data includes a relationship between N nodes, N is a positive integer greater than 1, and the node represents a fault domain in the full-link topology in the target application system; Based on the preset time interval and the full link topology data, updating the full link topology map; Based on the full-link topology graph, in accordance with a preset detection order, anomaly detection is performed on the N nodes to determine nodes with abnormalities; Based on causal detection technology, determine whether there is a causal relationship between the abnormal node and the target application system with the abnormality, and determine the cause of the abnormality in the target application system, where the cause of the abnormality includes one of the following: resource layer abnormality, application class abnormality and database abnormality.

2. The method according to claim 1, characterized in that The performing abnormality detection on the N nodes based on the full-link topology graph and in a preset detection order to determine abnormal nodes includes: Performing abnormality detection on access layer nodes, combination layer nodes and component layer nodes in the N nodes in turn; In the case that at least one of the access layer nodes, the combination layer nodes and the component layer nodes has an abnormality, the abnormality detection of the container type nodes continues to be performed to determine the abnormal node.

3. The method according to claim 2, characterized in that The method further comprises: When the abnormality detection result of the container node is that there is no abnormality, it is determined that the cause of the abnormality is an application abnormality.

4. The method according to claim 2, characterized in that: The method further comprises: When the abnormality detection results of the access layer node, the combination layer node and the component layer node are all that there is no abnormality, continue to perform abnormality detection on the middleware node; When the abnormality detection result of the middleware node is that an abnormality exists, it is determined that the cause of the abnormality exists is a middleware abnormality.

5. The method according to claim 1, characterized in that When the abnormality detection result of the container node is that an abnormality exists, the causal detection technology is used to determine whether there is a causal relationship between the abnormal node and the target application system with the abnormality, and determine the cause of the abnormality of the target application system, including: Based on the causal detection technology, determine whether there is a causal relationship between the abnormal container node and the target application system with the abnormality; In the case that there is a causal relationship between the abnormal container class node and the abnormal target application system, the cause of the abnormality in the target application system is determined based on the type of the abnormal container class node, wherein the cause of the abnormality includes one of the following: database abnormality and application class abnormality.

6. The method according to claim 5, characterized in that The method further comprises: In the case that there is no causal relationship between the abnormal container node and the abnormal target application system, continue to perform abnormality detection on the resource node; When the abnormality detection result of the resource node is that an abnormality exists, it is determined that the cause of the abnormality is a resource layer abnormality.

7. The method according to claim 1, characterized in that The performing anomaly detection on the N nodes to determine the abnormal nodes includes: Inputting the working status data corresponding to each of the N nodes into a target one-dimensional time series anomaly detection model to determine anomaly detection results corresponding to each of the N nodes, wherein the target one-dimensional time series anomaly detection model is trained based on an initial one-dimensional time series anomaly detection model; The node with the abnormality is determined based on the abnormality detection results corresponding to each of the N nodes.

8. The method according to claim 1, characterized in that Before obtaining the full-link topology data in the target application system with the abnormality, the method further includes: Acquire the golden indicators of the target application system, wherein the golden indicators include transaction rate, response time, system success rate and business success rate; Based on the golden indicator, it is determined whether the target application system has an abnormality, and an abnormality detection result of the target application system is obtained.

9. The method according to claim 1, characterized in that: The method corresponding to the causal detection technology is the Granger causal detection method.

10. An abnormality locating device, characterized in that: include: An acquisition module, used to acquire full-link topology data in a target application system with an abnormality, wherein the full-link topology data includes a relationship between N nodes, N is a positive integer greater than 1, and the node represents a fault domain in the full-link topology in the target application system; An updating module, used for updating the full-link topology map based on a preset time interval and the full-link topology data; A detection module, configured to perform anomaly detection on the N nodes based on the full-link topology graph and in a preset detection order to determine the nodes with abnormalities; A determination module is used to determine whether there is a causal relationship between the abnormal node and the target application system with the abnormality based on causal detection technology, and determine the cause of the abnormality in the target application system, wherein the cause of the abnormality includes one of the following: resource layer abnormality, application class abnormality and database abnormality.

11. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes a stored executable program, wherein when the executable program is run, the device where the computer-readable storage medium is located is controlled to execute the abnormality locating method according to any one of claims 1 to 9.

12. An electronic device, characterized in that: include: A memory storing an executable program; A processor is used to run the program, wherein the program executes the abnormality locating method described in any one of claims 1 to 9 when running.

13. A computer program product comprising computer instructions, characterized in that: When the computer instructions are executed by a processor, the steps of the abnormality locating method described in any one of claims 1 to 9 are implemented.

Images